Staging EKS Infra 1.29 upgrade

infra-as-code/terraform/egov-staging/main.tf

@@ -0,0 +1,235 @@
+terraform {
+  backend "s3" {
+    bucket = "egov-staging-terraform-state"
+    key = "terraform"
+    region = "ap-south-1"
+  }
+}
+
+module "network" {
+  source             = "../modules/kubernetes/aws/network"
+  vpc_cidr_block     = "${var.vpc_cidr_block}"
+  cluster_name       = "${var.cluster_name}"
+  availability_zones = "${var.network_availability_zones}"
+}
+
+# PostGres DB
+module "db" {
+  source                        = "../modules/db/aws"
+  subnet_ids                    = "${module.network.private_subnets}"
+  vpc_security_group_ids        = ["${module.network.rds_db_sg_id}"]
+  availability_zone             = "${element(var.availability_zone, 0)}"
+  instance_class                = "db.m6g.large"  ## postgres db instance type
+  engine_version                = "12.17"   ## postgres version
+  storage_type                  = "gp3"
+  storage_gb                    = "165"     ## postgres disk size
+  backup_retention_days         = "7"
+  administrator_login           = "${var.db_username}"
+  administrator_login_password  = "${var.db_password}"
+  db_name                       = "${var.db_name}"
+  db_subnet_group               = "${var.db_subnet_group}"
+  environment                   = "${var.cluster_name}"
+}
+
+data "aws_eks_cluster" "cluster" {
+  name = "${module.eks.cluster_id}"
+}
+
+data "aws_eks_cluster_auth" "cluster" {
+  name = "${module.eks.cluster_id}"
+}
+
+data "aws_caller_identity" "current" {}
+
+data "tls_certificate" "thumb" {
+  url = "${data.aws_eks_cluster.cluster.identity.0.oidc.0.issuer}"
+}
+
+provider "kubernetes" {
+  host                   = "${data.aws_eks_cluster.cluster.endpoint}"
+  cluster_ca_certificate = "${base64decode(data.aws_eks_cluster.cluster.certificate_authority.0.data)}"
+  token                  = "${data.aws_eks_cluster_auth.cluster.token}"
+  #load_config_file       = false
+}
+
+module "iam_user_deployer" {
+  source  = "terraform-aws-modules/iam/aws//modules/iam-user"
+
+  name          = "${var.cluster_name}-kube-deployer"
+  force_destroy = true  
+  create_iam_user_login_profile = false
+  create_iam_access_key         = true
+
+  # User "egovterraform" has uploaded his public key here - https://keybase.io/egovterraform/pgp_keys.asc
+  pgp_key = "${var.iam_keybase_user}"
+}
+
+module "iam_user_admin" {
+  source  = "terraform-aws-modules/iam/aws//modules/iam-user"
+
+  name          = "${var.cluster_name}-kube-admin"
+  force_destroy = true  
+  create_iam_user_login_profile = false
+  create_iam_access_key         = true
+
+  # User "egovterraform" has uploaded his public key here - https://keybase.io/egovterraform/pgp_keys.asc
+  pgp_key = "${var.iam_keybase_user}"
+}
+
+module "iam_user_user" {
+  source  = "terraform-aws-modules/iam/aws//modules/iam-user"
+
+  name          = "${var.cluster_name}-kube-user"
+  force_destroy = true  
+  create_iam_user_login_profile = false
+  create_iam_access_key         = true
+
+  # User "test" has uploaded his public key here - https://keybase.io/test/pgp_keys.asc
+  pgp_key = "${var.iam_keybase_user}"
+}
+
+module "eks" {
+  source          = "terraform-aws-modules/eks/aws"
+  version         = "17.24.0"
+  cluster_name    = "${var.cluster_name}"
+  vpc_id          = "${module.network.vpc_id}"
+  cluster_version = "${var.kubernetes_version}"
+  subnets         = "${concat(module.network.private_subnets, module.network.public_subnets)}"
+
+  worker_groups = [
+    {
+      name                          = "spot"
+      ami_id                        = "ami-01d4aea4600d4dd60"   
+      subnets                       = "${concat(slice(module.network.private_subnets, 0, length(var.availability_zones)))}"
+      instance_type                 = "${var.instance_type}"
+      override_instance_types       = "${var.override_instance_types}"
+      kubelet_extra_args            = "--node-labels=node.kubernetes.io/lifecycle=spot"
+      asg_max_size                  = "${var.number_of_worker_nodes}"
+      asg_desired_capacity          = "${var.number_of_worker_nodes}"
+      spot_allocation_strategy      = "capacity-optimized"
+      spot_instance_pools           = null
+    }
+  ]
+  tags = "${
+    tomap({
+      "kubernetes.io/cluster/${var.cluster_name}" = "owned",
+      "KubernetesCluster" = "${var.cluster_name}"
+    })}"
+}
+
+resource "aws_iam_role" "eks_iam" {
+  name = "${var.cluster_name}-eks"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17",
+    Statement = [
+      {
+        Sid = "EKSWorkerAssumeRole"
+        Effect = "Allow",
+        Principal = {
+          Federated = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:oidc-provider/${replace(data.aws_eks_cluster.cluster.identity[0].oidc[0].issuer, "https://", "")}"
+        },
+        Action = "sts:AssumeRoleWithWebIdentity",
+        Condition = {
+          StringEquals = {
+            "${replace(data.aws_eks_cluster.cluster.identity[0].oidc[0].issuer, "https://", "")}:sub" = "system:serviceaccount:kube-system:ebs-csi-controller-sa"
+          }
+        }
+      }
+    ]
+  })
+}
+
+resource "kubernetes_annotations" "example" {
+  api_version = "v1"
+  kind        = "ServiceAccount"
+  metadata {
+    name = "ebs-csi-controller-sa"
+    namespace = "kube-system"
+  }
+  annotations = {
+    "eks.amazonaws.com/role-arn" = "${aws_iam_role.eks_iam.arn}"
+  }
+}
+
+resource "aws_iam_role_policy_attachment" "cluster_AmazonEBSCSIDriverPolicy" {
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
+  role       = "${aws_iam_role.eks_iam.name}"
+}
+
+resource "aws_iam_role_policy_attachment" "cluster_AmazonEC2FullAccess" {
+  policy_arn = "arn:aws:iam::aws:policy/AmazonEC2FullAccess"
+  role       = "${aws_iam_role.eks_iam.name}"
+}
+
+resource "aws_iam_openid_connect_provider" "eks_oidc_provider" {
+  client_id_list = ["sts.amazonaws.com"]
+  thumbprint_list = ["${data.tls_certificate.thumb.certificates.0.sha1_fingerprint}"] # This should be empty or provide certificate thumbprints if needed
+  url            = "${data.aws_eks_cluster.cluster.identity[0].oidc[0].issuer}" # Replace with the OIDC URL from your EKS cluster details
+}
+
+resource "aws_eks_addon" "kube_proxy" {
+  cluster_name      = data.aws_eks_cluster.cluster.name
+  addon_name        = "kube-proxy"
+  resolve_conflicts = "OVERWRITE"
+}
+resource "aws_eks_addon" "core_dns" {
+  cluster_name      = data.aws_eks_cluster.cluster.name
+  addon_name        = "coredns"
+  resolve_conflicts = "OVERWRITE"
+}
+resource "aws_eks_addon" "aws_ebs_csi_driver" {
+  cluster_name      = data.aws_eks_cluster.cluster.name
+  addon_name        = "aws-ebs-csi-driver"
+  addon_version     = "v1.23.0-eksbuild.1"
+  resolve_conflicts = "OVERWRITE"
+}
+
+module "es-master" {
+
+  source = "../modules/storage/aws"
+  storage_count = 3
+  environment = "${var.cluster_name}"
+  disk_prefix = "es-master"
+  availability_zones = "${var.availability_zones}"
+  storage_sku = "gp2"
+  disk_size_gb = "2"
+
+}
+module "es-data-v1" {
+
+  source = "../modules/storage/aws"
+  storage_count = 3
+  environment = "${var.cluster_name}"
+  disk_prefix = "es-data-v1"
+  availability_zones = "${var.availability_zones}"
+  storage_sku = "gp2"
+  disk_size_gb = "25"
+
+}
+
+module "zookeeper" {
+
+  source = "../modules/storage/aws"
+  storage_count = 3
+  environment = "${var.cluster_name}"
+  disk_prefix = "zookeeper"
+  availability_zones = "${var.availability_zones}"
+  storage_sku = "gp2"
+  disk_size_gb = "2"
+
+}
+
+module "kafka" {
+
+  source = "../modules/storage/aws"
+  storage_count = 3
+  environment = "${var.cluster_name}"
+  disk_prefix = "kafka"
+  availability_zones = "${var.availability_zones}"
+  storage_sku = "gp2"
+  disk_size_gb = "55"
+
+}
+
+

infra-as-code/terraform/egov-staging/outputs.tf

@@ -0,0 +1,58 @@
+output "vpc_id" {
+  value = "${module.network.vpc_id}"
+}
+
+output "private_subnets" {
+  value = "${module.network.private_subnets}"
+}
+
+output "public_subnets" {
+  value = "${module.network.public_subnets}"
+}
+
+output "cluster_endpoint" {
+  description = "Endpoint for EKS control plane."
+  value       = "${module.eks.cluster_endpoint}"
+}
+
+output "kubectl_config" {
+  description = "kubectl config as generated by the module."
+  value       = "${module.eks.kubeconfig}"
+}
+
+output "es_master_volume_ids" {
+  value = "${module.es-master.volume_ids}"
+}
+
+output "es_data_volume_ids" {
+  value = "${module.es-data-v1.volume_ids}"
+}
+
+output "zookeeper_volume_ids" {
+  value = "${module.zookeeper.volume_ids}"
+}
+
+output "kafka_vol_ids" {
+  value = "${module.kafka.volume_ids}"
+}
+
+output "db_instance_endpoint" {
+  value = "${module.db.db_instance_endpoint}"
+}
+
+
+output "db_instance_name" {
+  description = "The database name"
+  value       = "${module.db.db_instance_name}"
+}
+
+output "db_instance_username" {
+  description = "The master username for the database"
+  value       = "${module.db.db_instance_username}"
+  sensitive   = true
+}
+
+output "db_instance_port" {
+  description = "The database port"
+  value       = "${module.db.db_instance_port}"
+}

infra-as-code/terraform/staging/providers.tf → infra-as-code/terraform/egov-staging/providers.tf

@@ -4,7 +4,6 @@
 
 provider "aws" {
   region = "ap-south-1"
-
 }
 
 # Using these data sources allows the configuration to be

infra-as-code/terraform/staging/remote-state/main.tf → infra-as-code/terraform/egov-staging/remote-state/main.tf

@@ -3,19 +3,23 @@ provider "aws" {
 }
 
 resource "aws_s3_bucket" "terraform_state" {
-  bucket = "egov-staging-terraform-state"
-
-  versioning {
-    enabled = true
-  }
+  bucket = "${var.bucket_name}"
 
   lifecycle {
     prevent_destroy = true
   }
 }
 
+resource "aws_s3_bucket_versioning" "versioning" {
+  bucket = aws_s3_bucket.terraform_state.id
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+
 resource "aws_dynamodb_table" "terraform_state_lock" {
-  name           = "egov-staging-terraform-state"
+  name           = "${var.bucket_name}"
   read_capacity  = 1
   write_capacity = 1
   hash_key       = "LockID"

infra-as-code/terraform/egov-staging/remote-state/variables.tf

@@ -0,0 +1,3 @@
+variable "bucket_name" {
+  default = "egov-staging-terraform-state"
+}