Terraform EKS Fargate Cluster

This module provides a fully functional EKS Fargate only cluster, which should be used to get started with EKS Fargate and/or test workloads.

To see which variables are worth changing look at the “Variables” section.

After the deployment, you need to edit some settings inside your cluster manually since there are some configurations, that can’t be changed with Terraform or aren’t supported by this module at the time. You can see instructions at the “Deployed? What now?”.

NOTE: This module deploys network resources too. This isn’t the BPA way to provision resources, in real-world scenarios you would use a module for this to be as dynamic as possible. Anyway, you can use this module in production, you should use tagging to not always pull the latest version, which maybe is incompatible with your configuration. The main branch is going to be always validated and ready to use.

Requirements

Getting started

You can use this deployment without changing any variables. The most common is to change the VPC/Subnet CIDRs nor add/remove subnets. Just copy and paste this snippet to get started.

Basic usage:

module "eks-fargate" {
    source = "github.com/holgerson97/terraform-eks-fargate-cluster/terraform-eks-fargate-cluster"
}

Advanced usage:

module "eks-fargate" {
    source = "github.com/holgerson97/terraform-eks-fargate-cluster//terraform-eks-fargate-cluster"
    eks_cluster_name   = "eks-cluster-stage"
    kubernetes_version = "1.19"
    vpc_cidr           = "10.10.0.0/16"
    public_subnet      = "10.10.1.0/24"
    private_subnets    = {
                          "subnet-first"  = "10.10.2.0/24",
                          "subnet-second" = "10.10.3.0/24",
                          "subnet-third"  = "10.10.4.0/24"
                         }
}

Variables

Deployed? What now?

Getting access to cluster

Since Terraform uses an IAM user to authenticate with AWS CDK, the Kubernetes Cluster-Administrator role is only applied to the IAM user ARN. To change this you need to log in with the user’s credentials at AWS CLI. Then you need to update your kubeconfig file to get access to the cluster.

aws eks update-kubeconfig --name <cluster-name>

NOTE: You may also need to add the region in which you deployed your EKS cluster. This depends on the default region of your AWC CLI profile (—region). If you added the IAM user credentials to a new user you may also need to specify the profile (—profile).

After that, you can change the aws-auth config map and add your roles, groups, and users. Just run the following command.

kubectl edit configmap -n kube-system aws-auth

Reference: https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html

Updating CoreDNS deployment to run on Fargate

By default, the CoreDNS deployment is configured to run on worker nodes. Since we don’t attach any worker node pools to the EKS cluster you need to patch the deployment. Currently, it’s not possible to patch deployment via the Kubernetes Terraform provider, so you need to do it by hand.

kubectl patch deployment coredns \
            -n kube-system \
            --type json \
            -p='[{"op": "remove", "path": "/spec/template/metadata/annotations/eks.amazonaws.com~1compute-type"}]'

kubectl rollout restart -n kube-system deployment coredns

Reference: https://docs.aws.amazon.com/eks/latest/userguide/fargate-getting-started.html

Adding more Fargate profiles

In case you want to add more deployments/replicasets/… to your EKS cluster, that don’t run in kube-system namespace and/or need a different selector (e.g. labels), you need to add more Fargate profiles. You can simply add them to your root configuration.

resource "aws_eks_fargate_profile" "<resource_name>" {
    cluster_name           = module.<name_of_this_module>.cluster_name
    fargate_profile_name   = <name_of_fargate_profile>
    pod_execution_role_arn = module.<name_of_this_module>.pod_execution_role_arn
    subnet_ids             = <subnets_where_you_want_to_deploy>
    selector {
        namespace = <namesapce_selector>
    }
    tags = {
        Name = <name_of_fargate_profile>
    }
    depends_on = [ module.<name_of_this_module> ]
}

Contributing

Feel free to create pull requests.