diff --git a/README.md b/README.md index 1add855..6b22c00 100644 --- a/README.md +++ b/README.md @@ -160,128 +160,128 @@ _Note: Since this module manages all of the Kubernetes addon dependencies requir [^1]: When running Apache Pulsar in Kubernetes, we make use of EBS backed Kubernetes Persistent Volume Claims (PVC). EBS volumes themselves are zonal, which means [an EC2 instance can only mount a volume that exists in its same AWS Availability Zone](https://aws.amazon.com/blogs/containers/amazon-eks-cluster-multi-zone-auto-scaling-groups/). For this reason we have added node group "zone affinity" functionality into our module, where **an EKS node group is created per AWS Availability Zone**. This is controlled by the number of subnets you pass to the EKS module, creating one node group per subnet. In addition, we also create node groups based on instance classes, which allows us to perform more fine tuned control around scheduling and resource utilization. To illustrate, if a cluster is being created across 3 availability zones and the default 4 instance classes are being used, then 12 total node groups will be created, all except the nodes belonging to the `xlarge` (which has a default capicty of `1` for initial scheduling of workloads) group will remain empty until a corresponding Pulsar or addon workload is deployed. - ## Requirements -| Name | Version | -| --------------------------------------------------------------------------- | -------- | -| [terraform](#requirement_terraform) | >= 1.3.2 | -| [aws](#requirement_aws) | 5.75.0 | -| [kubernetes](#requirement_kubernetes) | 2.32.0 | +| Name | Version | +|------|---------| +| [terraform](#requirement\_terraform) | >= 1.3.2 | +| [aws](#requirement\_aws) | 5.75.0 | +| [kubernetes](#requirement\_kubernetes) | 2.32.0 | ## Providers -| Name | Version | -| ------------------------------------------------ | ------- | -| [aws](#provider_aws) | 5.75.0 | +| Name | Version | +|------|---------| +| [aws](#provider\_aws) | 5.75.0 | ## Modules -| Name | Source | Version | -| ----------------------------------------------------------- | ----------------------------------------------- | ------- | -| [eks](#module_eks) | terraform-aws-modules/eks/aws | 20.29.0 | -| [eks_auth](#module_eks_auth) | terraform-aws-modules/eks/aws//modules/aws-auth | 20.29.0 | -| [vpc_tags](#module_vpc_tags) | ./modules/eks-vpc-tags | n/a | +| Name | Source | Version | +|------|--------|---------| +| [eks](#module\_eks) | terraform-aws-modules/eks/aws | 20.29.0 | +| [eks\_auth](#module\_eks\_auth) | terraform-aws-modules/eks/aws//modules/aws-auth | 20.29.0 | +| [vpc\_tags](#module\_vpc\_tags) | ./modules/eks-vpc-tags | n/a | ## Resources -| Name | Type | -| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- | -| [aws_ec2_tag.cluster_security_group](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/resources/ec2_tag) | resource | -| [aws_iam_role.cluster](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/resources/iam_role) | resource | -| [aws_iam_role.ng](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/resources/iam_role) | resource | -| [aws_iam_role_policy_attachment.cluster_AmazonEKSClusterPolicy](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/resources/iam_role_policy_attachment) | resource | -| [aws_iam_role_policy_attachment.cluster_AmazonEKSServicePolicy](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/resources/iam_role_policy_attachment) | resource | -| [aws_iam_role_policy_attachment.cluster_AmazonEKSVPCResourceControllerPolicy](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/resources/iam_role_policy_attachment) | resource | -| [aws_iam_role_policy_attachment.ng_AmazonEKSServicePolicy](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/resources/iam_role_policy_attachment) | resource | -| [aws_iam_role_policy_attachment.ng_AmazonEKSVPCResourceControllerPolicy](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/resources/iam_role_policy_attachment) | resource | -| [aws_iam_role_policy_attachment.ng_AmazonEKSWorkerNodePolicy](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/resources/iam_role_policy_attachment) | resource | -| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/data-sources/caller_identity) | data source | -| [aws_iam_policy_document.cluster_assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/data-sources/iam_policy_document) | data source | -| [aws_iam_policy_document.ng_assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/data-sources/iam_policy_document) | data source | -| [aws_kms_key.ebs_default](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/data-sources/kms_key) | data source | -| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/data-sources/partition) | data source | -| [aws_subnet.private_subnets](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/data-sources/subnet) | data source | -| [aws_subnet.public_subnets](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/data-sources/subnet) | data source | +| Name | Type | +|------|------| +| [aws_ec2_tag.cluster_security_group](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/resources/ec2_tag) | resource | +| [aws_iam_role.cluster](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/resources/iam_role) | resource | +| [aws_iam_role.ng](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/resources/iam_role) | resource | +| [aws_iam_role_policy_attachment.cluster_AmazonEKSClusterPolicy](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/resources/iam_role_policy_attachment) | resource | +| [aws_iam_role_policy_attachment.cluster_AmazonEKSServicePolicy](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/resources/iam_role_policy_attachment) | resource | +| [aws_iam_role_policy_attachment.cluster_AmazonEKSVPCResourceControllerPolicy](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/resources/iam_role_policy_attachment) | resource | +| [aws_iam_role_policy_attachment.ng_AmazonEKSServicePolicy](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/resources/iam_role_policy_attachment) | resource | +| [aws_iam_role_policy_attachment.ng_AmazonEKSVPCResourceControllerPolicy](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/resources/iam_role_policy_attachment) | resource | +| [aws_iam_role_policy_attachment.ng_AmazonEKSWorkerNodePolicy](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/resources/iam_role_policy_attachment) | resource | +| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/data-sources/caller_identity) | data source | +| [aws_iam_policy_document.cluster_assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/data-sources/iam_policy_document) | data source | +| [aws_iam_policy_document.ng_assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/data-sources/iam_policy_document) | data source | +| [aws_kms_key.ebs_default](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/data-sources/kms_key) | data source | +| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/data-sources/partition) | data source | +| [aws_subnet.private_subnets](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/data-sources/subnet) | data source | +| [aws_subnet.public_subnets](https://registry.terraform.io/providers/hashicorp/aws/5.75.0/docs/data-sources/subnet) | data source | ## Inputs -| Name | Description | Type | Default | Required | -| ------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | :------: | -| [add_vpc_tags](#input_add_vpc_tags) | Adds tags to VPC resources necessary for ingress resources within EKS to perform auto-discovery of subnets. Defaults to "true". Note that this may cause resource cycling (delete and recreate) if you are using Terraform to manage your VPC resources without having a `lifecycle { ignore_changes = [ tags ] }` block defined within them, since the VPC resources will want to manage the tags themselves and remove the ones added by this module. | `bool` | `true` | no | -| [additional_tags](#input_additional_tags) | Additional tags to be added to the resources created by this module. | `map(any)` | `{}` | no | -| [allowed_public_cidrs](#input_allowed_public_cidrs) | List of CIDR blocks that are allowed to access the EKS cluster's public endpoint. Defaults to "0.0.0.0/0" (any). | `list(string)` | 
[
 "0.0.0.0/0"
]
| no | -| [bootstrap_self_managed_addons](#input_bootstrap_self_managed_addons) | Indicates whether or not to bootstrap self-managed addons after the cluster has been created | `bool` | `null` | no | -| [cluster_enabled_log_types](#input_cluster_enabled_log_types) | A list of the desired control plane logging to enable. For more information, see Amazon EKS Control Plane Logging documentation (https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html). | `list(string)` | 
[
 "api",
 "audit",
 "authenticator",
 "controllerManager",
 "scheduler"
]
| no | -| [cluster_encryption_config](#input_cluster_encryption_config) | Configuration block with encryption configuration for the cluster. To disable secret encryption, set this value to `{}` | `any` | `{}` | no | -| [cluster_iam](#input_cluster_iam) | Cluster IAM settings | `any` | `null` | no | -| [cluster_name](#input_cluster_name) | The name of your EKS cluster and associated resources. Must be 16 characters or less. | `string` | `""` | no | -| [cluster_networking](#input_cluster_networking) | Cluster Networking settings | `any` | `null` | no | -| [cluster_security_group_additional_rules](#input_cluster_security_group_additional_rules) | Additional rules to add to the cluster security group. Set source_node_security_group = true inside rules to set the node_security_group as source. | `any` | `{}` | no | -| [cluster_security_group_id](#input_cluster_security_group_id) | The ID of an existing security group to use for the EKS cluster. If not provided, a new security group will be created. | `string` | `""` | no | -| [cluster_service_ipv4_cidr](#input_cluster_service_ipv4_cidr) | The CIDR block to assign Kubernetes service IP addresses from. If you don't specify a block, Kubernetes assigns addresses from either the 10.100.0.0/16 or 172.20.0.0/16 CIDR blocks | `string` | `null` | no | -| [cluster_version](#input_cluster_version) | The version of Kubernetes to be installed. | `string` | `"1.20"` | no | -| [create_cluster_security_group](#input_create_cluster_security_group) | Whether to create a new security group for the EKS cluster. If set to false, you must provide an existing security group via the cluster_security_group_id variable. | `bool` | `true` | no | -| [create_node_security_group](#input_create_node_security_group) | Whether to create a new security group for the EKS nodes. If set to false, you must provide an existing security group via the node_security_group_id variable. | `bool` | `true` | no | -| [disable_public_eks_endpoint](#input_disable_public_eks_endpoint) | Whether to disable public access to the EKS control plane endpoint. If set to "true", additional configuration is required in order for the cluster to function properly, such as AWS PrivateLink for EC2, ECR, and S3, along with a VPN to access the EKS control plane. It is recommended to keep this setting to "false" unless you are familiar with this type of configuration. | `bool` | `false` | no | -| [disk_encryption_kms_key_arn](#input_disk_encryption_kms_key_arn) | The KMS Key ARN to use for EBS disk encryption. If not set, the default EBS encryption key will be used. | `string` | `""` | no | -| [enable_bootstrap](#input_enable_bootstrap) | deprecated | `bool` | `false` | no | -| [enable_cilium](#input_enable_cilium) | deprecated | `bool` | `false` | no | -| [enable_istio](#input_enable_istio) | deprecated | `bool` | `false` | no | -| [enable_node_pool_monitoring](#input_enable_node_pool_monitoring) | Enable CloudWatch monitoring for the default pool(s). | `bool` | `false` | no | -| [enable_nodes_use_public_subnet](#input_enable_nodes_use_public_subnet) | When set to true, the node groups will use public subnet rather private subnet, and the public subnet must enable auto-assing public ip so that nodes can have public ip to access internet. Default is false. | `bool` | `false` | no | -| [enable_resource_creation](#input_enable_resource_creation) | deprecated | `bool` | `true` | no | -| [enable_sncloud_control_plane_access](#input_enable_sncloud_control_plane_access) | Whether to enable access to the EKS control plane endpoint. If set to "false", additional configuration is required in order for the cluster to function properly, such as AWS PrivateLink for EC2, ECR, and S3, along with a VPN to access the EKS control plane. It is recommended to keep this setting to "true" unless you are familiar with this type of configuration. | `bool` | `true` | no | -| [enable_v3_node_groups](#input_enable_v3_node_groups) | Enable v3 node groups, which uses a single ASG and all other node groups enabled elsewhere | `bool` | `false` | no | -| [enable_v3_node_migration](#input_enable_v3_node_migration) | Enable v3 node and v2 node groups at the same time. Intended for use with migration to v3 nodes. | `bool` | `false` | no | -| [enable_v3_node_taints](#input_enable_v3_node_taints) | When v3 node groups are enabled, use the node taints. Defaults to true | `bool` | `true` | no | -| [enable_vpc_cni_prefix_delegation](#input_enable_vpc_cni_prefix_delegation) | Whether set ENABLE_PREFIX_DELEGATION for vpc-cni addon | `bool` | `true` | no | -| [iam_path](#input_iam_path) | An IAM Path to be used for all IAM resources created by this module. Changing this from the default will cause issues with StreamNative's Vendor access, if applicable. | `string` | `"/StreamNative/"` | no | -| [manage_aws_auth_configmap](#input_manage_aws_auth_configmap) | Whether to manage the aws_auth configmap | `bool` | `true` | no | -| [map_additional_iam_roles](#input_map_additional_iam_roles) | A list of IAM role bindings to add to the aws-auth ConfigMap. | 
list(object({
 rolearn = string
 username = string
 groups = list(string)
 }))
| `[]` | no | -| [node_groups](#input_node_groups) | Map of EKS managed node group definitions to create | `any` | `null` | no | -| [node_pool_ami_id](#input_node_pool_ami_id) | The AMI ID to use for the EKS cluster nodes. Defaults to the latest EKS Optimized AMI provided by AWS. | `string` | `""` | no | -| [node_pool_azs](#input_node_pool_azs) | A list of availability zones to use for the EKS node group. If not set, the module will use the same availability zones with the cluster. | `list(string)` | `[]` | no | -| [node_pool_desired_size](#input_node_pool_desired_size) | Desired number of worker nodes in the node pool. | `number` | `0` | no | -| [node_pool_disk_iops](#input_node_pool_disk_iops) | The amount of provisioned IOPS for the worker node root EBS volume. | `number` | `3000` | no | -| [node_pool_disk_size](#input_node_pool_disk_size) | Disk size in GiB for worker nodes in the node pool. Defaults to 50. | `number` | `100` | no | -| [node_pool_disk_type](#input_node_pool_disk_type) | Disk type for worker nodes in the node pool. Defaults to gp3. | `string` | `"gp3"` | no | -| [node_pool_ebs_optimized](#input_node_pool_ebs_optimized) | If true, the launched EC2 instance(s) will be EBS-optimized. Specify this if using a custom AMI with pre-user data. | `bool` | `true` | no | -| [node_pool_instance_types](#input_node_pool_instance_types) | Set of instance types associated with the EKS Node Groups. Defaults to ["m6i.large", "m6i.xlarge", "m6i.2xlarge", "m6i.4xlarge", "m6i.8xlarge"], which will create empty node groups of each instance type to account for any workload configurable from StreamNative Cloud. | `list(string)` | 
[
 "m6i.large",
 "m6i.xlarge",
 "m6i.2xlarge",
 "m6i.4xlarge",
 "m6i.8xlarge"
]
| no | -| [node_pool_labels](#input_node_pool_labels) | A map of kubernetes labels to add to the node pool. | `map(string)` | `{}` | no | -| [node_pool_max_size](#input_node_pool_max_size) | The maximum size of the node pool Autoscaling group. | `number` | n/a | yes | -| [node_pool_min_size](#input_node_pool_min_size) | The minimum size of the node pool AutoScaling group. | `number` | `0` | no | -| [node_pool_pre_userdata](#input_node_pool_pre_userdata) | The user data to apply to the worker nodes in the node pool. This is applied before the bootstrap.sh script. | `string` | `""` | no | -| [node_pool_tags](#input_node_pool_tags) | A map of tags to add to the node groups and supporting resources. | `map(string)` | `{}` | no | -| [node_pool_taints](#input_node_pool_taints) | A list of taints in map format to apply to the node pool. | `any` | `{}` | no | -| [node_security_group_additional_rules](#input_node_security_group_additional_rules) | Additional ingress rules to add to the node security group. Set source_cluster_security_group = true inside rules to set the cluster_security_group as source | `any` | `{}` | no | -| [node_security_group_id](#input_node_security_group_id) | An ID of an existing security group to use for the EKS node groups. If not specified, a new security group will be created. | `string` | `""` | no | -| [permissions_boundary_arn](#input_permissions_boundary_arn) | If required, provide the ARN of the IAM permissions boundary to use for restricting StreamNative's vendor access. | `string` | `null` | no | -| [private_subnet_ids](#input_private_subnet_ids) | The ids of existing private subnets. | `list(string)` | `[]` | no | -| [public_subnet_ids](#input_public_subnet_ids) | The ids of existing public subnets. | `list(string)` | `[]` | no | -| [region](#input_region) | The AWS region. | `string` | `null` | no | -| [use_runtime_policy](#input_use_runtime_policy) | Legacy variable, will be deprecated in future versions. The preference of this module is to have the parent EKS module create and manage the IAM role. However some older configurations may have had the cluster IAM role managed seperately, and this variable allows for backwards compatibility. | `bool` | `false` | no | -| [v3_node_group_core_instance_type](#input_v3_node_group_core_instance_type) | The instance to use for the core node group | `string` | `"m6i.large"` | no | -| [vpc_id](#input_vpc_id) | The ID of the AWS VPC to use. | `string` | `""` | no | +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [add\_vpc\_tags](#input\_add\_vpc\_tags) | Adds tags to VPC resources necessary for ingress resources within EKS to perform auto-discovery of subnets. Defaults to "true". Note that this may cause resource cycling (delete and recreate) if you are using Terraform to manage your VPC resources without having a `lifecycle { ignore_changes = [ tags ] }` block defined within them, since the VPC resources will want to manage the tags themselves and remove the ones added by this module. | `bool` | `true` | no | +| [additional\_tags](#input\_additional\_tags) | Additional tags to be added to the resources created by this module. | `map(any)` | `{}` | no | +| [allowed\_public\_cidrs](#input\_allowed\_public\_cidrs) | List of CIDR blocks that are allowed to access the EKS cluster's public endpoint. Defaults to "0.0.0.0/0" (any). | `list(string)` | 
[
  "0.0.0.0/0"
]
| no | +| [bootstrap\_self\_managed\_addons](#input\_bootstrap\_self\_managed\_addons) | Indicates whether or not to bootstrap self-managed addons after the cluster has been created | `bool` | `null` | no | +| [cluster\_enabled\_log\_types](#input\_cluster\_enabled\_log\_types) | A list of the desired control plane logging to enable. For more information, see Amazon EKS Control Plane Logging documentation (https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html). | `list(string)` | 
[
  "api",
  "audit",
  "authenticator",
  "controllerManager",
  "scheduler"
]
| no | +| [cluster\_encryption\_config](#input\_cluster\_encryption\_config) | Configuration block with encryption configuration for the cluster. To disable secret encryption, set this value to `{}` | `any` | `{}` | no | +| [cluster\_iam](#input\_cluster\_iam) | Cluster IAM settings | `any` | `null` | no | +| [cluster\_name](#input\_cluster\_name) | The name of your EKS cluster and associated resources. Must be 16 characters or less. | `string` | `""` | no | +| [cluster\_networking](#input\_cluster\_networking) | Cluster Networking settings | `any` | `null` | no | +| [cluster\_security\_group\_additional\_rules](#input\_cluster\_security\_group\_additional\_rules) | Additional rules to add to the cluster security group. Set source\_node\_security\_group = true inside rules to set the node\_security\_group as source. | `any` | `{}` | no | +| [cluster\_security\_group\_id](#input\_cluster\_security\_group\_id) | The ID of an existing security group to use for the EKS cluster. If not provided, a new security group will be created. | `string` | `""` | no | +| [cluster\_service\_ipv4\_cidr](#input\_cluster\_service\_ipv4\_cidr) | The CIDR block to assign Kubernetes service IP addresses from. If you don't specify a block, Kubernetes assigns addresses from either the 10.100.0.0/16 or 172.20.0.0/16 CIDR blocks | `string` | `null` | no | +| [cluster\_version](#input\_cluster\_version) | The version of Kubernetes to be installed. | `string` | `"1.20"` | no | +| [create\_cluster\_security\_group](#input\_create\_cluster\_security\_group) | Whether to create a new security group for the EKS cluster. If set to false, you must provide an existing security group via the cluster\_security\_group\_id variable. | `bool` | `true` | no | +| [create\_iam\_policies](#input\_create\_iam\_policies) | deprecated | `bool` | `false` | no | +| [create\_node\_security\_group](#input\_create\_node\_security\_group) | Whether to create a new security group for the EKS nodes. If set to false, you must provide an existing security group via the node\_security\_group\_id variable. | `bool` | `true` | no | +| [disable\_public\_eks\_endpoint](#input\_disable\_public\_eks\_endpoint) | Whether to disable public access to the EKS control plane endpoint. If set to "true", additional configuration is required in order for the cluster to function properly, such as AWS PrivateLink for EC2, ECR, and S3, along with a VPN to access the EKS control plane. It is recommended to keep this setting to "false" unless you are familiar with this type of configuration. | `bool` | `false` | no | +| [disk\_encryption\_kms\_key\_arn](#input\_disk\_encryption\_kms\_key\_arn) | The KMS Key ARN to use for EBS disk encryption. If not set, the default EBS encryption key will be used. | `string` | `""` | no | +| [enable\_bootstrap](#input\_enable\_bootstrap) | deprecated | `bool` | `false` | no | +| [enable\_cilium](#input\_enable\_cilium) | deprecated | `bool` | `false` | no | +| [enable\_istio](#input\_enable\_istio) | deprecated | `bool` | `false` | no | +| [enable\_node\_pool\_monitoring](#input\_enable\_node\_pool\_monitoring) | Enable CloudWatch monitoring for the default pool(s). | `bool` | `false` | no | +| [enable\_nodes\_use\_public\_subnet](#input\_enable\_nodes\_use\_public\_subnet) | When set to true, the node groups will use public subnet rather private subnet, and the public subnet must enable auto-assing public ip so that nodes can have public ip to access internet. Default is false. | `bool` | `false` | no | +| [enable\_resource\_creation](#input\_enable\_resource\_creation) | deprecated | `bool` | `true` | no | +| [enable\_sncloud\_control\_plane\_access](#input\_enable\_sncloud\_control\_plane\_access) | Whether to enable access to the EKS control plane endpoint. If set to "false", additional configuration is required in order for the cluster to function properly, such as AWS PrivateLink for EC2, ECR, and S3, along with a VPN to access the EKS control plane. It is recommended to keep this setting to "true" unless you are familiar with this type of configuration. | `bool` | `true` | no | +| [enable\_v3\_node\_groups](#input\_enable\_v3\_node\_groups) | Enable v3 node groups, which uses a single ASG and all other node groups enabled elsewhere | `bool` | `false` | no | +| [enable\_v3\_node\_migration](#input\_enable\_v3\_node\_migration) | Enable v3 node and v2 node groups at the same time. Intended for use with migration to v3 nodes. | `bool` | `false` | no | +| [enable\_v3\_node\_taints](#input\_enable\_v3\_node\_taints) | When v3 node groups are enabled, use the node taints. Defaults to true | `bool` | `true` | no | +| [enable\_vpc\_cni\_prefix\_delegation](#input\_enable\_vpc\_cni\_prefix\_delegation) | Whether set ENABLE\_PREFIX\_DELEGATION for vpc-cni addon | `bool` | `true` | no | +| [iam\_path](#input\_iam\_path) | An IAM Path to be used for all IAM resources created by this module. Changing this from the default will cause issues with StreamNative's Vendor access, if applicable. | `string` | `"/StreamNative/"` | no | +| [manage\_aws\_auth\_configmap](#input\_manage\_aws\_auth\_configmap) | Whether to manage the aws\_auth configmap | `bool` | `true` | no | +| [map\_additional\_iam\_roles](#input\_map\_additional\_iam\_roles) | A list of IAM role bindings to add to the aws-auth ConfigMap. | 
list(object({
    rolearn  = string
    username = string
    groups   = list(string)
  }))
| `[]` | no | +| [node\_groups](#input\_node\_groups) | Map of EKS managed node group definitions to create | `any` | `null` | no | +| [node\_pool\_ami\_id](#input\_node\_pool\_ami\_id) | The AMI ID to use for the EKS cluster nodes. Defaults to the latest EKS Optimized AMI provided by AWS. | `string` | `""` | no | +| [node\_pool\_azs](#input\_node\_pool\_azs) | A list of availability zones to use for the EKS node group. If not set, the module will use the same availability zones with the cluster. | `list(string)` | `[]` | no | +| [node\_pool\_capacity\_type](#input\_node\_pool\_capacity\_type) | The capacity type for the node group. Defaults to "ON\_DEMAND". If set to "SPOT", the node group will be a spot instance node group. | `string` | `"ON_DEMAND"` | no | +| [node\_pool\_desired\_size](#input\_node\_pool\_desired\_size) | Desired number of worker nodes in the node pool. | `number` | `0` | no | +| [node\_pool\_disk\_iops](#input\_node\_pool\_disk\_iops) | The amount of provisioned IOPS for the worker node root EBS volume. | `number` | `3000` | no | +| [node\_pool\_disk\_size](#input\_node\_pool\_disk\_size) | Disk size in GiB for worker nodes in the node pool. Defaults to 50. | `number` | `100` | no | +| [node\_pool\_disk\_type](#input\_node\_pool\_disk\_type) | Disk type for worker nodes in the node pool. Defaults to gp3. | `string` | `"gp3"` | no | +| [node\_pool\_ebs\_optimized](#input\_node\_pool\_ebs\_optimized) | If true, the launched EC2 instance(s) will be EBS-optimized. Specify this if using a custom AMI with pre-user data. | `bool` | `true` | no | +| [node\_pool\_instance\_types](#input\_node\_pool\_instance\_types) | Set of instance types associated with the EKS Node Groups. Defaults to ["m6i.large", "m6i.xlarge", "m6i.2xlarge", "m6i.4xlarge", "m6i.8xlarge"], which will create empty node groups of each instance type to account for any workload configurable from StreamNative Cloud. | `list(string)` | 
[
  "m6i.large",
  "m6i.xlarge",
  "m6i.2xlarge",
  "m6i.4xlarge",
  "m6i.8xlarge"
]
| no | +| [node\_pool\_labels](#input\_node\_pool\_labels) | A map of kubernetes labels to add to the node pool. | `map(string)` | `{}` | no | +| [node\_pool\_max\_size](#input\_node\_pool\_max\_size) | The maximum size of the node pool Autoscaling group. | `number` | n/a | yes | +| [node\_pool\_min\_size](#input\_node\_pool\_min\_size) | The minimum size of the node pool AutoScaling group. | `number` | `0` | no | +| [node\_pool\_pre\_userdata](#input\_node\_pool\_pre\_userdata) | The user data to apply to the worker nodes in the node pool. This is applied before the bootstrap.sh script. | `string` | `""` | no | +| [node\_pool\_tags](#input\_node\_pool\_tags) | A map of tags to add to the node groups and supporting resources. | `map(string)` | `{}` | no | +| [node\_pool\_taints](#input\_node\_pool\_taints) | A list of taints in map format to apply to the node pool. | `any` | `{}` | no | +| [node\_security\_group\_additional\_rules](#input\_node\_security\_group\_additional\_rules) | Additional ingress rules to add to the node security group. Set source\_cluster\_security\_group = true inside rules to set the cluster\_security\_group as source | `any` | `{}` | no | +| [node\_security\_group\_id](#input\_node\_security\_group\_id) | An ID of an existing security group to use for the EKS node groups. If not specified, a new security group will be created. | `string` | `""` | no | +| [permissions\_boundary\_arn](#input\_permissions\_boundary\_arn) | If required, provide the ARN of the IAM permissions boundary to use for restricting StreamNative's vendor access. | `string` | `null` | no | +| [private\_subnet\_ids](#input\_private\_subnet\_ids) | The ids of existing private subnets. | `list(string)` | `[]` | no | +| [public\_subnet\_ids](#input\_public\_subnet\_ids) | The ids of existing public subnets. | `list(string)` | `[]` | no | +| [region](#input\_region) | The AWS region. | `string` | `null` | no | +| [use\_runtime\_policy](#input\_use\_runtime\_policy) | Legacy variable, will be deprecated in future versions. The preference of this module is to have the parent EKS module create and manage the IAM role. However some older configurations may have had the cluster IAM role managed seperately, and this variable allows for backwards compatibility. | `bool` | `false` | no | +| [v3\_node\_group\_core\_instance\_type](#input\_v3\_node\_group\_core\_instance\_type) | The instance to use for the core node group | `string` | `"m6i.large"` | no | +| [vpc\_id](#input\_vpc\_id) | The ID of the AWS VPC to use. | `string` | `""` | no | ## Outputs -| Name | Description | -| -------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| [eks](#output_eks) | All outputs of module.eks for provide convenient approach to access child module's outputs. | -| [eks_cluster_arn](#output_eks_cluster_arn) | The ARN for the EKS cluster created by this module | -| [eks_cluster_certificate_authority_data](#output_eks_cluster_certificate_authority_data) | Base64 encoded certificate data required to communicate with the cluster | -| [eks_cluster_endpoint](#output_eks_cluster_endpoint) | The endpoint for the EKS cluster created by this module | -| [eks_cluster_identity_oidc_issuer_arn](#output_eks_cluster_identity_oidc_issuer_arn) | The ARN for the OIDC issuer created by this module | -| [eks_cluster_identity_oidc_issuer_string](#output_eks_cluster_identity_oidc_issuer_string) | A formatted string containing the prefix for the OIDC issuer created by this module. Same as "cluster_oidc_issuer_url", but with "https://" stripped from the name. This output is typically used in other StreamNative modules that request the "oidc_issuer" input. | -| [eks_cluster_identity_oidc_issuer_url](#output_eks_cluster_identity_oidc_issuer_url) | The URL for the OIDC issuer created by this module | -| [eks_cluster_name](#output_eks_cluster_name) | The name of the EKS cluster created by this module | -| [eks_cluster_platform_version](#output_eks_cluster_platform_version) | The platform version for the EKS cluster created by this module | -| [eks_cluster_primary_security_group_id](#output_eks_cluster_primary_security_group_id) | The id of the primary security group created by the EKS service itself, not by this module. This is labeled "Cluster Security Group" in the EKS console. | -| [eks_cluster_secondary_security_group_id](#output_eks_cluster_secondary_security_group_id) | The id of the secondary security group created by this module. This is labled "Additional Security Groups" in the EKS console. | -| [eks_node_group_iam_role_arn](#output_eks_node_group_iam_role_arn) | The IAM Role ARN used by the Worker configuration | -| [eks_node_group_security_group_id](#output_eks_node_group_security_group_id) | Security group ID attached to the EKS node groups | -| [eks_node_groups](#output_eks_node_groups) | Map of all attributes of the EKS node groups created by this module | -| [inuse_azs](#output_inuse_azs) | The availability zones in which the EKS nodes is deployed | - +| Name | Description | +|------|-------------| +| [eks](#output\_eks) | All outputs of module.eks for provide convenient approach to access child module's outputs. | +| [eks\_cluster\_arn](#output\_eks\_cluster\_arn) | The ARN for the EKS cluster created by this module | +| [eks\_cluster\_certificate\_authority\_data](#output\_eks\_cluster\_certificate\_authority\_data) | Base64 encoded certificate data required to communicate with the cluster | +| [eks\_cluster\_endpoint](#output\_eks\_cluster\_endpoint) | The endpoint for the EKS cluster created by this module | +| [eks\_cluster\_identity\_oidc\_issuer\_arn](#output\_eks\_cluster\_identity\_oidc\_issuer\_arn) | The ARN for the OIDC issuer created by this module | +| [eks\_cluster\_identity\_oidc\_issuer\_string](#output\_eks\_cluster\_identity\_oidc\_issuer\_string) | A formatted string containing the prefix for the OIDC issuer created by this module. Same as "cluster\_oidc\_issuer\_url", but with "https://" stripped from the name. This output is typically used in other StreamNative modules that request the "oidc\_issuer" input. | +| [eks\_cluster\_identity\_oidc\_issuer\_url](#output\_eks\_cluster\_identity\_oidc\_issuer\_url) | The URL for the OIDC issuer created by this module | +| [eks\_cluster\_name](#output\_eks\_cluster\_name) | The name of the EKS cluster created by this module | +| [eks\_cluster\_platform\_version](#output\_eks\_cluster\_platform\_version) | The platform version for the EKS cluster created by this module | +| [eks\_cluster\_primary\_security\_group\_id](#output\_eks\_cluster\_primary\_security\_group\_id) | The id of the primary security group created by the EKS service itself, not by this module. This is labeled "Cluster Security Group" in the EKS console. | +| [eks\_cluster\_secondary\_security\_group\_id](#output\_eks\_cluster\_secondary\_security\_group\_id) | The id of the secondary security group created by this module. This is labled "Additional Security Groups" in the EKS console. | +| [eks\_node\_group\_iam\_role\_arn](#output\_eks\_node\_group\_iam\_role\_arn) | The IAM Role ARN used by the Worker configuration | +| [eks\_node\_group\_security\_group\_id](#output\_eks\_node\_group\_security\_group\_id) | Security group ID attached to the EKS node groups | +| [eks\_node\_groups](#output\_eks\_node\_groups) | Map of all attributes of the EKS node groups created by this module | +| [inuse\_azs](#output\_inuse\_azs) | The availability zones in which the EKS nodes is deployed | diff --git a/main.tf b/main.tf index f37bda9..2c39b9c 100644 --- a/main.tf +++ b/main.tf @@ -96,6 +96,7 @@ locals { desired_size = var.node_pool_desired_size ebs_optimized = var.node_pool_ebs_optimized enable_monitoring = var.enable_node_pool_monitoring + capacity_type = var.node_pool_capacity_type min_size = var.node_pool_min_size max_size = var.node_pool_max_size pre_bootstrap_user_data = var.node_pool_pre_userdata @@ -114,6 +115,7 @@ locals { for i, j in data.aws_subnet.private_subnets : { subnet_ids = [data.aws_subnet.private_subnets[i].id] instance_types = [instance_type] + capacity_type = var.node_pool_capacity_type name = "snc-${split(".", instance_type)[1]}-${data.aws_subnet.private_subnets[i].availability_zone}" use_name_prefix = true taints = {} @@ -138,6 +140,7 @@ locals { "snc-core" = { subnet_ids = local.node_group_subnet_ids instance_types = [var.v3_node_group_core_instance_type] + capacity_type = var.node_pool_capacity_type name = "snc-core" use_name_prefix = true taints = local.v3_node_taints diff --git a/variables.tf b/variables.tf index 4dc555a..9992259 100644 --- a/variables.tf +++ b/variables.tf @@ -333,6 +333,13 @@ variable "node_pool_ebs_optimized" { type = bool } +variable "node_pool_capacity_type" { + description = "The capacity type for the node group. Defaults to \"ON_DEMAND\". If set to \"SPOT\", the node group will be a spot instance node group." + type = string + default = "ON_DEMAND" + +} + variable "node_pool_desired_size" { default = 0 description = "Desired number of worker nodes in the node pool."