Terraform으로 AWS EKS 클러스터 만들기

Terraform으로 AWS EKS 클러스터 만들기

terraform을 사용하여 AWS EKS 클러스터를 만드는 예제입니다. EKS 클러스터 생성시 필요한 IAM role, CloudWatch Log Group, IAM OpenID Connect provider까지 생성하는 예시입니다. 아래의 코드사용시 subnet, security group을 생성해서 설정하거나, 사용할 subnet id, security group id로 치환해서 사용하셔야합니다. 참고로 아래의 코드에는 nodegroup을 생성하지 않습니다.

# eks cluster 이름 정의
locals {
  cluster_name = "eks-cluster"
}

# eks cluster에 필요한 IAM ROLE 생성
data "aws_iam_policy_document" "eks" {
  statement {
    sid     = "EKSClusterAssumeRole"
    actions = ["sts:AssumeRole"]

    principals {
      type        = "Service"
      identifiers = ["eks.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "eks" {
  name                  = "eks-cluster-role"
  assume_role_policy    = data.aws_iam_policy_document.eks.json
  force_detach_policies = true
}

# EKS Manage Policy 설정
data "aws_iam_policy" "eks_cluster" {
  name = "AmazonEKSClusterPolicy"
}

resource "aws_iam_role_policy_attachment" "eks_cluster" {
  role       = aws_iam_role.eks.name
  policy_arn = data.aws_iam_policy.eks_cluster.arn
}

data "aws_iam_policy" "eks_service" {
  name = "AmazonEKSServicePolicy"
}

resource "aws_iam_role_policy_attachment" "eks_service" {
  role       = aws_iam_role.eks.name
  policy_arn = data.aws_iam_policy.eks_service.arn
}

data "aws_iam_policy" "eks_resource" {
  name = "AmazonEKSVPCResourceController"
}

resource "aws_iam_role_policy_attachment" "eks_resource" {
  role       = aws_iam_role.eks.name
  policy_arn = data.aws_iam_policy.eks_resource.arn
}

# cloudwatch 로그 그룹 생성
resource "aws_cloudwatch_log_group" "eks" {
  name              = "/aws/eks/${local.cluster_name}/cluster"
  retention_in_days = 30
}

# eks cluster 생성
resource "aws_eks_cluster" "eks" {
  name                      = local.cluster_name
  version                   = "1.23"
  enabled_cluster_log_types = ["api", "audit", "authenticator", "controllerManager", "scheduler"]
  role_arn                  = aws_iam_role.eks.arn

  vpc_config {
    endpoint_private_access = true
    endpoint_public_access  = true
    public_access_cidrs     = ["0.0.0.0/0"]
    # kubernetes api-server에서 사용하는 서브넷
    subnet_ids              = tolist(["subnet-id1", "subnet-id2"])
    # kubernetes control plane에서 사용할 security group
    security_group_ids      = tolist(["sg-id1"])
  }

  kubernetes_network_config {
    service_ipv4_cidr = "10.100.0.0/16"
  }

  depends_on = [
    aws_iam_role.eks,
    aws_iam_role_policy_attachment.eks,
    aws_cloudwatch_log_group.eks,
  ]
}

# IRSA
data "tls_certificate" "eks" {
  url = aws_eks_cluster.eks[0].identity[0].oidc[0].issuer
}

resource "aws_iam_openid_connect_provider" "eks" {
  client_id_list  = ["sts.amazonaws.com"]
  thumbprint_list = [data.tls_certificate.eks[0].certificates[0].sha1_fingerprint]
  url             = aws_eks_cluster.eks[0].identity[0].oidc[0].issuer

  depends_on = [
    aws_eks_cluster.eks,
  ]
}

참고

GitHub - terraform-aws-modules/terraform-aws-eks: Terraform module to create an Elastic Kubernetes (EKS) cluster and associated