Eks With Istio Save

:whale: :package: :rocket: - Terraform template for a production ready EKS Cluster and ISTIO Service Mesh

Project README

Welcome to EKS with Istio Setup with Terraform 👋

Version Documentation License: MIT Twitter: fidelissauro

Terraform Versions Compatibility

Terraform 0.13 Terraform 0.14 Terraform 0.15 Terraform 1.0.0 Terraform 1.1.0

🏠 Architecture / Topology

topology

Requirements

Name Version
aws >= 5.0
helm ~> 2.0
kubectl ~> 1.14
kubernetes ~> 2.0
tls ~> 3.1.0

Providers

Name Version
aws 5.33.0
helm 2.12.1
kubectl 1.14.0
kubernetes 2.25.2
tls 3.1.0

Modules

No modules.

Resources

Name Type
aws_api_gateway_vpc_link.nlb resource
aws_cloudwatch_event_rule.node_termination_handler_instance_terminate resource
aws_cloudwatch_event_rule.node_termination_handler_rebalance resource
aws_cloudwatch_event_rule.node_termination_handler_scheduled_change resource
aws_cloudwatch_event_rule.node_termination_handler_spot_termination resource
aws_cloudwatch_event_rule.node_termination_handler_state_change resource
aws_cloudwatch_event_target.node_termination_handler_instance_terminate resource
aws_cloudwatch_event_target.node_termination_handler_rebalance resource
aws_cloudwatch_event_target.node_termination_handler_scheduled_change resource
aws_cloudwatch_event_target.node_termination_handler_spot_termination resource
aws_cloudwatch_event_target.node_termination_handler_state_change resource
aws_cloudwatch_log_group.prometheus resource
aws_eip.vpc_iep resource
aws_eks_addon.cni resource
aws_eks_addon.coredns resource
aws_eks_addon.csi_driver resource
aws_eks_addon.kubeproxy resource
aws_eks_cluster.main resource
aws_eks_node_group.main resource
aws_grafana_workspace.grafana resource
aws_iam_instance_profile.nodes resource
aws_iam_openid_connect_provider.eks resource
aws_iam_policy.aws_load_balancer_controller_policy resource
aws_iam_policy.aws_node_termination_handler_policy resource
aws_iam_policy.cluster_autoscaler_policy resource
aws_iam_policy.csi_driver resource
aws_iam_policy.karpenter_policy resource
aws_iam_policy.keda_policy resource
aws_iam_policy.managed_prometheus_policy resource
aws_iam_policy_attachment.aws_load_balancer_controller_policy resource
aws_iam_policy_attachment.aws_node_termination_handler_policy resource
aws_iam_policy_attachment.cluster_autoscaler resource
aws_iam_policy_attachment.csi_driver resource
aws_iam_policy_attachment.karpenter_policy resource
aws_iam_policy_attachment.keda resource
aws_iam_policy_attachment.managed_prometheus_policy resource
aws_iam_role.alb_controller resource
aws_iam_role.aws_node_termination_handler_role resource
aws_iam_role.cluster_autoscaler_role resource
aws_iam_role.eks_cluster_role resource
aws_iam_role.eks_nodes_roles resource
aws_iam_role.grafana resource
aws_iam_role.karpenter_role resource
aws_iam_role.keda_role resource
aws_iam_role.managed_prometheus_role resource
aws_iam_role_policy_attachment.cloudwatch resource
aws_iam_role_policy_attachment.cni resource
aws_iam_role_policy_attachment.ecr resource
aws_iam_role_policy_attachment.eks-cluster-cluster resource
aws_iam_role_policy_attachment.eks-cluster-service resource
aws_iam_role_policy_attachment.node resource
aws_iam_role_policy_attachment.ssm resource
aws_internet_gateway.gw resource
aws_kms_alias.eks resource
aws_kms_key.eks resource
aws_launch_template.karpenter resource
aws_lb.ingress resource
aws_lb_listener.ingress_443 resource
aws_lb_listener.ingress_80 resource
aws_lb_target_group.http resource
aws_lb_target_group.https resource
aws_nat_gateway.nat resource
aws_prometheus_workspace.main resource
aws_route.nat_access resource
aws_route.public_internet_access resource
aws_route53_record.nlb resource
aws_route53_zone.private resource
aws_route_table.igw_route_table resource
aws_route_table.nat resource
aws_route_table_association.pods_1a resource
aws_route_table_association.pods_1b resource
aws_route_table_association.pods_1c resource
aws_route_table_association.private1a resource
aws_route_table_association.private1b resource
aws_route_table_association.private1c resource
aws_route_table_association.public_1a resource
aws_route_table_association.public_1b resource
aws_route_table_association.public_1c resource
aws_security_group.cluster_nodes_sg resource
aws_security_group.cluster_sg resource
aws_security_group_rule.cluster_ingress_https resource
aws_security_group_rule.nodeport resource
aws_security_group_rule.nodeport_cluster resource
aws_security_group_rule.nodeport_cluster_udp resource
aws_sqs_queue.node_termination_handler resource
aws_sqs_queue_policy.node_termination_handler resource
aws_subnet.pods_subnet_1a resource
aws_subnet.pods_subnet_1b resource
aws_subnet.pods_subnet_1c resource
aws_subnet.private_subnet_1a resource
aws_subnet.private_subnet_1b resource
aws_subnet.private_subnet_1c resource
aws_subnet.public_subnet_1a resource
aws_subnet.public_subnet_1b resource
aws_subnet.public_subnet_1c resource
aws_vpc.cluster_vpc resource
aws_vpc_ipv4_cidr_block_association.pods resource
helm_release.alb_ingress_controller resource
helm_release.argo_rollouts resource
helm_release.chaos_mesh resource
helm_release.cluster_autoscaler resource
helm_release.descheduler resource
helm_release.istio_base resource
helm_release.istio_ingress resource
helm_release.istiod resource
helm_release.jaeger resource
helm_release.karpenter resource
helm_release.keda resource
helm_release.kiali-server resource
helm_release.kube_state_metrics resource
helm_release.managed_prometheus resource
helm_release.metrics_server resource
helm_release.node_termination_handler resource
helm_release.prometheus resource
kubectl_manifest.grafana_gateway resource
kubectl_manifest.grafana_service resource
kubectl_manifest.istio_target_group_binding_http resource
kubectl_manifest.istio_target_group_binding_https resource
kubectl_manifest.jaeger_gateway resource
kubectl_manifest.jaeger_virtual_service resource
kubectl_manifest.karpenter_provisioner resource
kubectl_manifest.karpenter_template resource
kubectl_manifest.kiali_gateway resource
kubectl_manifest.kiali_virtual_service resource
kubectl_manifest.rollouts_gateway resource
kubectl_manifest.rollouts_virtual_service resource
kubernetes_config_map.aws-auth resource
aws_caller_identity.current data source
aws_eks_cluster_auth.default data source
aws_iam_policy_document.aws_load_balancer_controller_assume_role data source
aws_iam_policy_document.aws_load_balancer_controller_policy data source
aws_iam_policy_document.aws_node_termination_handler_policy data source
aws_iam_policy_document.aws_node_termination_handler_role data source
aws_iam_policy_document.cluster_autoscaler_policy data source
aws_iam_policy_document.cluster_autoscaler_role data source
aws_iam_policy_document.csi_driver data source
aws_iam_policy_document.eks_cluster_role data source
aws_iam_policy_document.eks_nodes_role data source
aws_iam_policy_document.karpenter_policy data source
aws_iam_policy_document.karpenter_role data source
aws_iam_policy_document.keda_policy data source
aws_iam_policy_document.keda_role data source
aws_iam_policy_document.managed_prometheus_policy data source
aws_iam_policy_document.managed_prometheus_role data source
aws_ssm_parameter.eks data source
tls_certificate.eks data source

Inputs

Name Description Type Default Required
addon_cni_version Specifies the version of the AWS VPC CNI (Container Network Interface) plugin to use, which manages the network interfaces for pod networking. string "v1.14.1-eksbuild.1" no
addon_coredns_version Defines the version of CoreDNS to use, a DNS server/forwarder that is integral to internal Kubernetes DNS resolution. string "v1.11.1-eksbuild.4" no
addon_csi_version Indicates the version of the Container Storage Interface (CSI) driver to use for managing storage volumes in Kubernetes. string "v1.26.1-eksbuild.1" no
addon_kubeproxy_version Sets the version of Kubeproxy to be used, which handles Kubernetes network services like forwarding the requests to correct containers. string "v1.29.0-eksbuild.1" no
argo_rollouts_toggle Enables the installation of Argo Rollouts, providing advanced deployment strategies like Canary and Blue-Green deployments in Kubernetes. bool true no
argo_rollouts_virtual_service_host The hostname for the Argo Rollouts virtual service, used for advanced deployment capabilities like canary and blue-green deployments in Kubernetes. string "argo-rollouts.k8s.raj.ninja" no
auto_scale_options Configuration for the EKS cluster auto-scaling. It includes the minimum (min), maximum (max), and desired (desired) number of worker nodes. map 
{
  "desired": 6,
  "max": 10,
  "min": 4
}
 no
aws_region AWS region where the EKS cluster will be deployed. This should be set to the region where you want your Kubernetes resources to reside. string "us-east-1" no
chaos_mesh_toggle Determines whether to install Chaos Mesh, a cloud-native Chaos Engineering platform that orchestrates chaos experiments on Kubernetes environments. bool false no
cluster_autoscaler_toggle Enable or disable the Cluster Autoscaler installation. When true, Cluster Autoscaler is installed to automatically adjust the number of nodes in the cluster. bool false no
cluster_name The name of the Amazon EKS cluster. This is a unique identifier for your EKS cluster within the AWS region. string "eks-cluster" no
cluster_private_zone The private DNS zone name for the EKS cluster in AWS Route53. This zone is used for internal DNS resolution within the cluster. string "k8s.cluster" no
default_tags A map of default tags to apply to all resources. These tags can help with identifying and organizing resources within the AWS environment. map(string) 
{
  "Environment": "prod",
  "Foo": "Bar",
  "Ping": "Pong"
}
 no
descheduler_toggle Controls the installation of the Descheduler, a tool to balance and optimize the distribution of Pods across the cluster for improved efficiency. bool false no
enable_cross_zone_load_balancing Controls whether cross-zone load balancing is enabled for the Network Load Balancer, allowing even traffic distribution across all zones. bool false no
enable_managed_prometheus Determines if the managed Prometheus service should be enabled. Managed Prometheus provides a fully managed monitoring service compatible with Prometheus. bool false no
enable_prometheus_stack n/a bool true no
grafana_virtual_service_host The hostname for the Grafana virtual service, used in Istio routing. This host is used to access Grafana dashboards for monitoring metrics. string "grafana.k8s.raj.ninja" no
istio_ingress_max_pods The maximum number of pods to scale up for the Istio ingress gateway. This limits the resources used and manages the scaling behavior. number 9 no
istio_ingress_min_pods The minimum number of pods to maintain for the Istio ingress gateway. This ensures basic availability and load handling. number 3 no
jaeger_virtual_service_host The hostname for the Jaeger virtual service, used for tracing and monitoring microservices within the Istio service mesh. string "jaeger.k8s.raj.ninja" no
k8s_version The version of Kubernetes to use for the EKS cluster. This version should be compatible with the AWS EKS service and other infrastructure components. string "1.29" no
karpenter_availability_zones A list of AWS availability zones where Karpenter should launch nodes. These zones should be in the same region as the EKS cluster. list(any) 
[
  "us-east-1a",
  "us-east-1b",
  "us-east-1c"
]
 no
karpenter_capacity_type Defines the capacity types for provisioning instances in the cluster, such as 'spot' or 'on_demand', offering cost-saving options or consistent availability respectively. list(any) 
[
  "spot"
]
 no
karpenter_instance_family Defines a list of EC2 instance families to be considered by Karpenter for node provisioning. Instance families like 'c6' and 'c5' offer different compute capabilities. list(any) 
[
  "c6",
  "c6a",
  "c5"
]
 no
karpenter_instance_sizes Specifies a list of instance sizes within the chosen instance families to allow diversity in the provisioned nodes by Karpenter. list(any) 
[
  "large",
  "2xlarge"
]
 no
karpenter_toggle Determines whether Karpenter is enabled for the EKS cluster. Karpenter is an open-source auto-scaler for Kubernetes clusters. bool true no
keda_toggle Activates the installation of KEDA (Kubernetes Event-Driven Autoscaling), which adds event-driven scaling capabilities to Kubernetes workloads. bool true no
kiali_virtual_service_host The hostname for the Kiali virtual service, a part of Istio's service mesh visualization. It provides insights into the mesh topology and performance. string "kiali.k8s.raj.ninja" no
managed_grafana_authentication_providers A list of authentication providers for managed Grafana. For example, 'SAML' can be used for integrating with identity providers, ensuring secure and centralized user management. list(string) 
[
  "SAML"
]
 no
managed_grafana_datasources Specifies the data sources that managed Grafana can access. Includes options like 'CLOUDWATCH', 'PROMETHEUS', and 'XRAY', providing a wide range of data for comprehensive monitoring solutions. list(string) 
[
  "CLOUDWATCH",
  "PROMETHEUS",
  "XRAY"
]
 no
managed_grafana_notification_destinations Lists the notification channels supported by managed Grafana. For instance, 'SNS' allows Grafana to send alerts and notifications through AWS Simple Notification Service. list(string) 
[
  "SNS"
]
 no
managed_grafana_permission_type Defines the permission model for managed Grafana. 'SERVICE_MANAGED' allows AWS to manage permissions, simplifying the setup and management of Grafana. string "SERVICE_MANAGED" no
managed_prometheus_access_type Specifies the access type for managed Prometheus. 'CURRENT_ACCOUNT' limits access to the current AWS account, ensuring isolated and secure access to the monitoring data. string "CURRENT_ACCOUNT" no
nlb_ingress_enable_termination_protection Determines if termination protection is enabled for the Network Load Balancer, preventing accidental deletion. bool false no
nlb_ingress_internal Indicates whether the Network Load Balancer (NLB) for the EKS cluster should be internal, restricting access to within the AWS network. bool false no
nlb_ingress_type Specifies the type of ingress to be used, such as 'network', determining how the NLB handles incoming traffic to the EKS cluster. string "network" no
node_termination_handler_toggle Enables the AWS Node Termination Handler, which ensures that Kubernetes workloads are gracefully handled during EC2 instance terminations or disruptions. bool true no
nodes_instances_sizes A list of EC2 instance types to use for the EKS worker nodes. These instance types should balance between cost, performance, and resource requirements for your workload. list 
[
  "t3.large"
]
 no
proxy_protocol_v2 Enables or disables Proxy Protocol v2 on the Network Load Balancer, used for preserving client IP addresses and other connection information. bool false no

Outputs

Name Description
cluster_name n/a
istio_ingress_vpclink n/a

✨ Demo

Install

terraform apply

Usage

terraform apply

Run tests

terraform plan

Author

👤 Matheus Fidelis

🤝 Contributing

Contributions, issues and feature requests are welcome!
Feel free to check issues page.

Show your support

Give a ⭐️ if this project helped you!

📝 License

Copyright © 2021 Matheus Fidelis.
This project is MIT licensed.

_This README was generated with ❤️ by readme-md-generator_

Open Source Agenda is not affiliated with "Eks With Istio" Project. README Source: msfidelis/eks-with-istio
Stars
128
Open Issues
6
Last Commit
1 month ago
Repository
msfidelis/eks-with-istio
License
MIT
Tags
Aws Cluster Cluster Autoscaler Docker Eks Eks Cluster Fargate Istio Kubernetes Service Mesh

Open Source Agenda Badge

Open Source Agenda Rating
Submit Review Review Your Favorite Project
Submit Resource Articles, Courses, Videos
Submit Article Submit a post to our blog

From the blog

Dec 11, 2022

How to Choose Which Programming Language to Learn First?

From the blog

Dec 11, 2022

How to Choose Which Programming Language to Learn First?