EKS

Implementation of EKS setup using Terraform. Terraform module located in terraform directory supports deployment to different AWS partitions. I have tested it with commercial and china partitions. I am actively using this configuration to run EKS setup in Ireland(eu-west-1), London(eu-west-2), North Virginia(us-east-1) and Beijing(cn-north-1).

Module details

Module creates:

VPC
VPC Endpoints- S3, ECR, STS, APS, GuardDuty
EKS Cluster
EKS Node Group to run cluster critical services
EKS Addons- coredns, kube-proxy, guardduty, aws-ebs-csi-driver, adot (requires cert-manger to be installed), kubecost, cloudwatch observability, snapshot-controller and identity agent
IAM Roles for worker nodes and Karpenter nodes
Additional IAM Roles for operators- load-balancer-controller, external-dns, cert-manager, adot-collector
SQS queue configuration to be used with Karpeneter while utlising Spot Instances.
CloudWatch log groups used by container insights.

Kubernetes addons and operators

I am utilising Flux2 to deploy all additional configurations. You can find them at https://github.com/marcincuber/kubernetes-fluxv2 I have built this as a separate repository to show how to develop a successful configuration for your own cluster using GitOps FluxV2 and Helm.

You will find configurations for:

AWS Load Balancer controller
AWS node termination handler
Cert Manager
External-DNS
External Secrets Operator
Metrics server
Reloader
VPC CNI Plugin
EBS CSI Driver
and more :)

Docs and other additional resources

Check out my stories on Medium if you want to learn more about specific topics.

Karpenter Upgrade guide from Beta to v1 API version

Karpenter Upgrade guide from alpha to beta API version

Migrate Karpenter resources from alpha to beta API version

Amazon EKS Addons

EKS + Kube-bench

Kube-bench implementation with EKS

EKS and ECR Pull-through cache implementation using Terraform

ECR pull through cache for DockerHub, Github, Quay, ECR public and kubernetes

Amazon EKS design, use of spot instances, and cluster scaling

More about my configuration can be found in the blog post I have written recently -> EKS design

IAM Roles for specific namespaces

Amazon EKS- RBAC with IAM access

IAM Roles for service accounts using OpenID Connect

Using OIDC provider to allow service accounts to assume IAM role

External DNS

Amazon EKS, setup external DNS with OIDC provider and kube2iam

EKS Managed Node Groups

Amazon EKS + managed node groups

Terraform module written by me can be found in -> https://registry.terraform.io/modules/umotif-public/eks-node-group

Gitlab runners on EKS

Kubernetes GitLab Runners on Amazon EKS

Useful resources

EKS platforms information Worker nodes upgrades

Generate kubeconfig file

On user's machine who has been added to EKS, they can configure .kube/config file using the following command:

$ aws eks list-clusters
$ aws eks update-kubeconfig --name ${cluster_name}

eks

Commits

Update README.md

Update eks-nodes-karpenter.tf

Update eks-managed-node-group-al2023.tf

Update eks-cluster.tf managed policy block

Updates to vpc and vpc endpoints

Update versions.tf

README

EKS