aws-k3s.yaml

{{- $createVpcCIDR := "10.8.0.0/18" -}}
{{- $region := .variables.region -}}
{{- $azs := list "" -}}
{{- if .variables.azs -}}
{{- $azs = .variables.azs -}}
{{- else -}}
{{- $azs = list (printf "%sa" $region) (printf "%sb" $region) (printf "%sc" $region) -}}
{{- end -}}
{{- $azs_count := len $azs -}}
_p: &provider_aws
- aws:
    region: {{ .variables.region }}

name: aws-k3s
kind: StackTemplate
cliVersion: ">=v0.8.0"
units:
  -
    name: aws_key_pair
    type: tfmodule
    source: github.com/terraform-aws-modules/terraform-aws-key-pair?ref=v0.6.0
    providers: *provider_aws
    inputs:
      create_key_pair: true
      public_key: {{ .variables.public_key }}
      key_name: {{ .variables.public_key_name }}
  {{- if .variables.domain }}
  -
    name: route53
    type: tfmodule
    providers: *provider_aws
    source: github.com/shalb/cluster.dev-domain?ref=0.1.0
    inputs:
      region: {{ .variables.region }}
      cluster_name: {{ .variables.cluster_name }}
      cluster_domain: {{ .variables.domain }}
      zone_delegation: {{ if eq .variables.domain "cluster.dev" }}true{{ else }}false{{ end }}
  {{- end }}
  {{- if not .variables.vpc_id }}
  -
    name: vpc
    type: tfmodule
    providers: *provider_aws
    source: terraform-aws-modules/vpc/aws
    version: "4.0.2"
    inputs:
      name: {{ .variables.cluster_name }}
      cidr: {{ $createVpcCIDR }}
      enable_nat_gateway: true
      map_public_ip_on_launch: true
      single_nat_gateway: true
      one_nat_gateway_per_az: false
      enable_dns_hostnames: true
      enable_dns_support: true
      create_egress_only_igw: true
      enable_vpn_gateway: true
      create_database_subnet_group: true
      public_subnets:
      {{- range $index, $_ := $azs }}
        - {{ cidrSubnet $createVpcCIDR 4 $index }}
      {{- end }}
      private_subnets:
      {{- range $index, $_ := $azs }}
        - {{ cidrSubnet $createVpcCIDR 4 (add $index $azs_count ) }}
      {{- end }}
      database_subnets:
      {{- range $index, $_ := $azs }}
        - {{ cidrSubnet $createVpcCIDR 4 (add $index $azs_count $azs_count ) }}
      {{- end }}
      public_subnet_tags:
        "kubernetes.io/cluster/{{ .variables.cluster_name }}": "owned"
        "kubernetes.io/role/lb": 1
      private_subnet_tags:
        "kubernetes.io/cluster/{{ .variables.cluster_name }}": "owned"
        "kubernetes.io/role/internal-lb": 1
      azs: {{ insertYAML $azs }}
  {{- end }}
  -
    name: k3s
    type: tfmodule
    source: github.com/shalb/terraform-aws-k3s?ref=v0.5.0
    providers: *provider_aws
    inputs:
      cluster_name: {{ .variables.cluster_name }}
      extra_args:
        - "--disable traefik"
      {{ if .variables.domain }}
      domain: {{ remoteState "this.route53.domain" }}
      {{ end  }}
      k3s_version: {{ .variables.k3s_version }}
      {{- if .variables.vpc_id }}
      public_subnets: {{ insertYAML .variables.public_subnets }}
      {{- else }}
      public_subnets: {{ remoteState "this.vpc.public_subnets" }}
      {{- end }}
      key_name: {{ remoteState "this.aws_key_pair.this_key_pair_key_name" }}
      region: {{ .variables.region }}
      s3_bucket: {{ .variables.bucket }}
      master_node_count: {{ .variables.master_node_count }}
      worker_node_groups: {{ insertYAML .variables.worker_node_groups  }}
      master_iam_policies:
        - {{ remoteState "this.iam-policy-external-dns.arn" }}
      enable_asg_rolling_auto_update: true
  -
    name: kubeconfig
    type: tfmodule
    providers: *provider_aws
    force_apply: true
    depends_on: this.k3s
    source: github.com/shalb/terraform-modules//local-file?ref=0.0.1
    inputs:
      filename: /tmp/kubeconfig_{{ .variables.cluster_name }}
      source_s3:
        bucket: {{ .variables.bucket }}
        key: {{ .variables.cluster_name }}/kubeconfig
      file_permission: "0600"
  {{- if .variables.domain }}
  -
    name: iam-policy-external-dns
    type: tfmodule
    source: "terraform-aws-modules/iam/aws//modules/iam-policy"
    version: "5.30.0"
    providers: *provider_aws
    inputs:
      name: AllowRoute53ZoneManagement-{{ .variables.cluster_name }}
      policy: |
        {
            "Version": "2012-10-17",
            "Statement": [
            {
                "Effect": "Allow",
                "Action": [
                "route53:ChangeResourceRecordSets",
                "route53:GetChange"
                ],
                "Resource": [
                "arn:aws:route53:::hostedzone/{{ .variables.domain }}",
                "arn:aws:route53:::change/*"
                ]
            },
            {
                "Effect": "Allow",
                "Action": [
                "route53:ListHostedZones",
                "route53:ListResourceRecordSets",
                "route53:ListHostedZonesByName"
                ],
                "Resource": [
                "*"
                ]
            }
            ]
        }
  -
    name: external-dns
    type: helm
    source:
      repository: "https://charts.bitnami.com/bitnami"
      chart: "external-dns"
      version: "6.26.3"
    kubeconfig: {{ remoteState "this.kubeconfig.path" }}
    additional_options:
      namespace: "external-dns"
      create_namespace: true
    values:
      - file: ./values/external-dns.yaml
  -
    name: cert-manager
    type: helm
    source:
      repository: "https://charts.jetstack.io"
      chart: "cert-manager"
      version: "v1.6.1"
    kubeconfig: {{ output "this.kubeconfig.path" }}
    additional_options:
      namespace: "cert-manager"
      create_namespace: true
    inputs:
      installCRDs: true
      webhook.enabled: false
      ingressShim.defaultIssuerName: letsencrypt-prod
      ingressShim.defaultIssuerKind: ClusterIssuer
      ingressShim.defaultACMEChallengeType: dns01
      securityContext.enabled: false
      serviceAccount.create: true
  -
    name: cert-manager-issuer
    type: kubernetes
    depends_on: this.cert-manager
    source: ./cert-manager/issuer.yaml
    kubeconfig: {{ remoteState "this.kubeconfig.path" }}
  {{- end }}
  -
    name: ingress-nginx
    type: helm
    source:
      repository: "https://kubernetes.github.io/ingress-nginx"
      chart: "ingress-nginx"
      version: "4.7.3"
    kubeconfig: {{ output "this.kubeconfig.path" }}
    additional_options:
      namespace: "ingress-nginx"
      create_namespace: true
      timeout: 60
    inputs:
        service.type: LoadBalancer
        controller.admissionWebhooks.enabled: false
        service.externalTrafficPolicy: Local
        controller.ingressClassResource.default: true
  -
    name: outputs
    type: printer
    outputs:
      cluster_name: {{ .variables.cluster_name }}
      region: {{ .variables.region }}
      kubeconfig: {{ output "this.kubeconfig.path" }}
      k3s_version: {{ .variables.k3s_version }}