feat: Set default EKS to 1.26; install vpc-cni add-on (#207)

* add AWS EKS add-ons * amendments * example version * add EFS, role for vpc-cni * add coredns * amendment * change names * Update modules/app_eks/add-ons.tf Co-authored-by: Justin Brooks <[email protected]> * Update modules/app_eks/add-ons.tf Co-authored-by: Justin Brooks <[email protected]> * Update modules/app_eks/add-ons.tf Co-authored-by: Justin Brooks <[email protected]> * Update modules/app_eks/add-ons.tf Co-authored-by: Justin Brooks <[email protected]> --------- Co-authored-by: Justin Brooks <[email protected]>
wandb · May 8, 2024 · 0fa5767 · 0fa5767
1 parent 1774635
commit 0fa5767
Show file tree

Hide file tree

Showing 3 changed files with 81 additions and 29 deletions.
diff --git a/examples/public-dns-external/main.tf b/examples/public-dns-external/main.tf
@@ -28,7 +28,7 @@ module "wandb_infra" {
   allowed_inbound_cidr      = var.allowed_inbound_cidr
   allowed_inbound_ipv6_cidr = ["::/0"]
 
-  eks_cluster_version            = "1.25"
+  eks_cluster_version            = "1.26"
   kubernetes_public_access       = true
   kubernetes_public_access_cidrs = ["0.0.0.0/0"]
 

diff --git a/modules/app_eks/add-ons.tf b/modules/app_eks/add-ons.tf
@@ -0,0 +1,80 @@
+
+### IAM policy and role for vpc-cni
+data "aws_iam_policy_document" "oidc_assume_role" {
+  statement {
+    actions = ["sts:AssumeRoleWithWebIdentity"]
+    effect  = "Allow"
+
+    condition {
+      test     = "StringEquals"
+      variable = "${replace(module.eks.cluster_oidc_issuer_url, "https://", "")}:sub"
+      values   = ["system:serviceaccount:kube-system:aws-node"]
+    }
+
+    principals {
+      identifiers = [aws_iam_openid_connect_provider.eks.arn]
+      type        = "Federated"
+    }
+  }
+}
+
+resource "aws_iam_role_policy_attachment" "eks_oidc" {
+  policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
+  role       = aws_iam_role.oidc.name
+}
+
+resource "aws_iam_role" "oidc" {
+  name               = join("-", [var.namespace, "oidc"])
+  assume_role_policy = data.aws_iam_policy_document.oidc_assume_role.json
+}
+
+
+
+### add-ons
+resource "aws_eks_addon" "aws_efs_csi_driver" {
+   depends_on = [
+     aws_eks_addon.vpc-cni
+   ]
+   cluster_name               = var.namespace
+   addon_name                 = "aws-efs-csi-driver"
+   addon_version              = "v1.7.7-eksbuild.1"
+   resolve_conflicts          = "OVERWRITE"
+ }
+
+resource "aws_eks_addon" "aws_ebs_csi_driver" {
+  depends_on = [
+    aws_eks_addon.vpc_cni
+  ]
+  cluster_name                = var.namespace
+  addon_name                  = "aws-ebs-csi-driver"
+  addon_version               = "v1.25.0-eksbuild.1"
+  resolve_conflicts           = "OVERWRITE"
+}
+
+resource "aws_eks_addon" "coredns" {
+  depends_on = [
+    aws_eks_addon.vpc_cni
+  ]
+  cluster_name                = var.namespace
+  addon_name                  = "coredns"
+  addon_version               = "v1.9.3-eksbuild.11"
+  resolve_conflicts           = "OVERWRITE"
+}
+
+resource "aws_eks_addon" "kube_proxy" {
+  depends_on = [
+    aws_eks_addon.vpc_cni
+  ]
+  cluster_name                = var.namespace
+  addon_name                  = "kube-proxy"
+  addon_version               = "v1.25.14-eksbuild.2"
+  resolve_conflicts           = "OVERWRITE"
+}
+
+resource "aws_eks_addon" "vpc_cni" {
+  cluster_name                = var.namespace
+  addon_name                  = "vpc-cni"
+  addon_version               = "v1.18.0-eksbuild.1"
+  resolve_conflicts           = "OVERWRITE"
+  service_account_role_arn = aws_iam_role.oidc.arn
+}
diff --git a/modules/app_eks/main.tf b/modules/app_eks/main.tf
@@ -14,34 +14,6 @@ locals {
 }
 
 
-resource "aws_eks_addon" "eks" {
-  cluster_name = var.namespace
-  addon_name   = "aws-ebs-csi-driver"
-  depends_on = [
-    module.eks
-  ]
-}
-
-resource "aws_eks_addon" "efs" {
-  cluster_name      = module.eks.cluster_id
-  addon_name        = "aws-efs-csi-driver"
-  addon_version     = "v1.7.1-eksbuild.1" # Ensure this version is compatible
-  resolve_conflicts = "OVERWRITE"
-  depends_on = [
-    module.eks
-  ]
-}
-
-# removed due to conflict with 
-# AWS Load Balancer Controller
-# being installed with Helm.
-# See: https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.6/
-#resource "aws_eks_addon" "vpc_cni" {
-#  cluster_name = var.namespace
-#  addon_name   = "vpc-cni"
-#  depends_on   = [module.eks]
-#}
-
 module "eks" {
   source  = "terraform-aws-modules/eks/aws"
   version = "~> 17.23"