cloudposse/terraform-aws-eks-workers

Terraform module to provision an AWS AutoScaling Group, IAM Role, and Security Group for EKS Workers

terraform-aws-eks-workers

Terraform module to provision AWS resources to run EC2 worker nodes for Elastic Kubernetes Service.

Instantiate it multiple times to create many EKS worker node pools with specific settings such as GPUs, EC2 instance types, or autoscale parameters.

Tip

👽 Use Atmos with Terraform

Cloud Posse uses atmos to easily orchestrate multiple environments using Terraform.
Works with Github Actions, Atlantis, or Spacelift.

Watch demo of using Atmos with Terraform

Example of running atmos to manage infrastructure from our Quick Start tutorial.

Introduction

The module provisions the following resources:

• IAM Role and Instance Profile to allow Kubernetes nodes to access other AWS services
• Security Group with rules for EKS workers to allow networking traffic
• AutoScaling Group with Launch Template to configure and launch worker instances
• AutoScaling Policies and CloudWatch Metric Alarms to monitor CPU utilization on the EC2 instances and scale the number of instance in the AutoScaling Group up or down. If you don't want to use the provided functionality, or want to provide your own policies, disable it by setting the variable autoscaling_policies_enabled to "false".

Usage

For a complete example, see examples/complete

  provider "aws" {
    region = var.region
  }

  locals {
    # The usage of the specific kubernetes.io/cluster/* resource tags below are required
    # for EKS and Kubernetes to discover and manage networking resources
    # https://www.terraform.io/docs/providers/aws/guides/eks-getting-started.html#base-vpc-networking
    tags = merge(var.tags, map("kubernetes.io/cluster/${var.cluster_name}", "shared"))
  }

  module "vpc" {
    source  = "cloudposse/vpc/aws"
    version = "2.1.1"

    namespace = var.namespace
    stage     = var.stage
    name      = var.name

    ipv4_primary_cidr_block = "172.16.0.0/16"
    tags                    = local.tags
  }

  module "subnets" {
    source  = "cloudposse/dynamic-subnets/aws"
    version = "2.4.1"

    namespace = var.namespace
    stage     = var.stage
    name      = var.name

    availability_zones   = var.availability_zones
    vpc_id               = module.vpc.vpc_id
    igw_id               = [module.vpc.igw_id]
    ipv4_cidr_block      = [module.vpc.vpc_cidr_block]
    nat_gateway_enabled  = false
    nat_instance_enabled = false
    tags                 = local.tags
  }

  module "eks_workers" {
    source = "cloudposse/eks-workers/aws"
    # Cloud Posse recommends pinning every module to a specific version
    # version     = "x.x.x"
    namespace                          = var.namespace
    stage                              = var.stage
    name                               = var.name
    instance_type                      = var.instance_type
    vpc_id                             = module.vpc.vpc_id
    subnet_ids                         = module.subnets.public_subnet_ids
    health_check_type                  = var.health_check_type
    min_size                           = var.min_size
    max_size                           = var.max_size
    wait_for_capacity_timeout          = var.wait_for_capacity_timeout
    cluster_name                       = var.cluster_name
    cluster_endpoint                   = var.cluster_endpoint
    cluster_certificate_authority_data = var.cluster_certificate_authority_data
    cluster_security_group_id          = var.cluster_security_group_id

    # Auto-scaling policies and CloudWatch metric alarms
    autoscaling_policies_enabled           = var.autoscaling_policies_enabled
    cpu_utilization_high_threshold_percent = var.cpu_utilization_high_threshold_percent
    cpu_utilization_low_threshold_percent  = var.cpu_utilization_low_threshold_percent
  }

Important

In Cloud Posse's examples, we avoid pinning modules to specific versions to prevent discrepancies between the documentation and the latest released versions. However, for your own projects, we strongly advise pinning each module to the exact version you're using. This practice ensures the stability of your infrastructure. Additionally, we recommend implementing a systematic approach for updating versions to avoid unexpected changes.

Makefile Targets

Available targets:

  help                                Help screen
  help/all                            Display help for all targets
  help/short                          This help short screen
  lint                                Lint terraform code

Requirements

Name	Version
terraform	>= 1.0
aws	>= 5.16.0

Providers

Name	Version
aws	>= 5.16.0

Modules

Name	Source	Version
autoscale_group	cloudposse/ec2-autoscale-group/aws	0.39.0
label	cloudposse/label/null	0.25.0
this	cloudposse/label/null	0.25.0

Resources

Name	Type
aws_iam_instance_profile.default	resource
aws_iam_role.default	resource
aws_iam_role_policy_attachment.amazon_ec2_container_registry_read_only	resource
aws_iam_role_policy_attachment.amazon_eks_cni_policy	resource
aws_iam_role_policy_attachment.amazon_eks_worker_node_policy	resource
aws_iam_role_policy_attachment.existing_policies_attach_to_eks_workers_role	resource
aws_security_group.default	resource
aws_security_group_rule.egress	resource
aws_security_group_rule.ingress_cidr_blocks	resource
aws_security_group_rule.ingress_cluster	resource
aws_security_group_rule.ingress_security_groups	resource
aws_security_group_rule.ingress_self	resource
aws_ami.eks_worker	data source
aws_iam_instance_profile.default	data source
aws_iam_policy_document.assume_role	data source
aws_partition.current	data source

Inputs

Name	Description	Type	Default	Required
additional_security_group_ids	Additional list of security groups that will be attached to the autoscaling group	list(string)	[]	no
additional_tag_map	Additional key-value pairs to add to each map in tags_as_list_of_maps. Not added to tags or id. This is for some rare cases where resources want additional configuration of tags and therefore take a list of maps with tag key, value, and additional configuration.	map(string)	{}	no
after_cluster_joining_userdata	Additional commands to execute on each worker node after joining the EKS cluster (after executing the bootstrap.sh script). For mot info, see https://kubedex.com/90-days-of-aws-eks-in-production	string	""	no
allowed_cidr_blocks	List of CIDR blocks to be allowed to connect to the worker nodes	list(string)	[]	no
allowed_security_groups	List of Security Group IDs to be allowed to connect to the worker nodes	list(string)	[]	no
associate_public_ip_address	Associate a public IP address with an instance in a VPC	bool	false	no
attributes	ID element. Additional attributes (e.g. workers or cluster) to add to id, in the order they appear in the list. New attributes are appended to the end of the list. The elements of the list are joined by the delimiter and treated as a single ID element.	list(string)	[]	no
autoscaling_group_tags	Additional tags only for the autoscaling group, e.g. "k8s.io/cluster-autoscaler/node-template/taint/dedicated" = "ci-cd:NoSchedule".	map(string)	{}	no
autoscaling_policies_enabled	Whether to create aws_autoscaling_policy and aws_cloudwatch_metric_alarm resources to control Auto Scaling	bool	true	no
aws_iam_instance_profile_name	The name of the existing instance profile that will be used in autoscaling group for EKS workers. If empty will create a new instance profile.	string	""	no
before_cluster_joining_userdata	Additional commands to execute on each worker node before joining the EKS cluster (before executing the bootstrap.sh script). For mot info, see https://kubedex.com/90-days-of-aws-eks-in-production	string	""	no
block_device_mappings	Specify volumes to attach to the instance besides the volumes specified by the AMI	list(object({ device_name = string no_device = bool virtual_name = string ebs = object({ delete_on_termination = bool encrypted = bool iops = number kms_key_id = string snapshot_id = string volume_size = number volume_type = string }) }))	[]	no
bootstrap_extra_args	Extra arguments to the bootstrap.sh script to enable --enable-docker-bridge or --use-max-pods	string	""	no
cluster_certificate_authority_data	The base64 encoded certificate data required to communicate with the cluster	string	n/a	yes
cluster_endpoint	EKS cluster endpoint	string	n/a	yes
cluster_name	The name of the EKS cluster	string	n/a	yes
cluster_security_group_id	Security Group ID of the EKS cluster	string	n/a	yes
cluster_security_group_ingress_enabled	Whether to enable the EKS cluster Security Group as ingress to workers Security Group	bool	true	no
context	Single object for setting entire context at once. See description of individual variables for details. Leave string and numeric variables as null to use default value. Individual variable settings (non-null) override settings in context object, except for attributes, tags, and additional_tag_map, which are merged.	any	{ "additional_tag_map": {}, "attributes": [], "delimiter": null, "descriptor_formats": {}, "enabled": true, "environment": null, "id_length_limit": null, "label_key_case": null, "label_order": [], "label_value_case": null, "labels_as_tags": [ "unset" ], "name": null, "namespace": null, "regex_replace_chars": null, "stage": null, "tags": {}, "tenant": null }	no
cpu_utilization_high_evaluation_periods	The number of periods over which data is compared to the specified threshold	number	2	no
cpu_utilization_high_period_seconds	The period in seconds over which the specified statistic is applied	number	300	no
cpu_utilization_high_statistic	The statistic to apply to the alarm's associated metric. Either of the following is supported: SampleCount, Average, Sum, Minimum, Maximum	string	"Average"	no
cpu_utilization_high_threshold_percent	The value against which the specified statistic is compared	number	90	no
cpu_utilization_low_evaluation_periods	The number of periods over which data is compared to the specified threshold	number	2	no
cpu_utilization_low_period_seconds	The period in seconds over which the specified statistic is applied	number	300	no
cpu_utilization_low_statistic	The statistic to apply to the alarm's associated metric. Either of the following is supported: SampleCount, Average, Sum, Minimum, Maximum	string	"Average"	no
cpu_utilization_low_threshold_percent	The value against which the specified statistic is compared	number	10	no
credit_specification	Customize the credit specification of the instances	object({ cpu_credits = string })	null	no
default_cooldown	The amount of time, in seconds, after a scaling activity completes before another scaling activity can start	number	300	no
delimiter	Delimiter to be used between ID elements. Defaults to - (hyphen). Set to "" to use no delimiter at all.	string	null	no
descriptor_formats	Describe additional descriptors to be output in the descriptors output map. Map of maps. Keys are names of descriptors. Values are maps of the form {<br> format = string<br> labels = list(string)<br>} (Type is any so the map values can later be enhanced to provide additional options.) format is a Terraform format string to be passed to the format() function. labels is a list of labels, in order, to pass to format() function. Label values will be normalized before being passed to format() so they will be identical to how they appear in id. Default is {} (descriptors output will be empty).	any	{}	no
disable_api_termination	If true, enables EC2 Instance Termination Protection	bool	false	no
ebs_optimized	If true, the launched EC2 instance will be EBS-optimized	bool	false	no
eks_worker_ami_name_filter	AMI name filter to lookup the most recent EKS AMI if image_id is not provided	string	"amazon-eks-node-*"	no
eks_worker_ami_name_regex	A regex string to apply to the AMI list returned by AWS	string	"^amazon-eks-node-[0-9,.]+-v[0-9]{8}$"	no
elastic_gpu_specifications	Specifications of Elastic GPU to attach to the instances	object({ type = string })	null	no
enable_monitoring	Enable/disable detailed monitoring	bool	true	no
enabled	Set to false to prevent the module from creating any resources	bool	null	no
enabled_metrics	A list of metrics to collect. The allowed values are GroupMinSize, GroupMaxSize, GroupDesiredCapacity, GroupInServiceInstances, GroupPendingInstances, GroupStandbyInstances, GroupTerminatingInstances, GroupTotalInstances	list(string)	[ "GroupMinSize", "GroupMaxSize", "GroupDesiredCapacity", "GroupInServiceInstances", "GroupPendingInstances", "GroupStandbyInstances", "GroupTerminatingInstances", "GroupTotalInstances" ]	no
environment	ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'	string	null	no
force_delete	Allows deleting the autoscaling group without waiting for all instances in the pool to terminate. You can force an autoscaling group to delete even if it's in the process of scaling a resource. Normally, Terraform drains all the instances before deleting the group. This bypasses that behavior and potentially leaves resources dangling	bool	false	no
health_check_grace_period	Time (in seconds) after instance comes into service before checking health	number	300	no
health_check_type	Controls how health checking is done. Valid values are EC2 or ELB	string	"EC2"	no
id_length_limit	Limit id to this many characters (minimum 6). Set to 0 for unlimited length. Set to null for keep the existing setting, which defaults to 0. Does not affect id_full.	number	null	no
image_id	EC2 image ID to launch. If not provided, the module will lookup the most recent EKS AMI. See https://docs.aws.amazon.com/eks/latest/userguide/eks-optimized-ami.html for more details on EKS-optimized images	string	""	no
instance_initiated_shutdown_behavior	Shutdown behavior for the instances. Can be stop or terminate	string	"terminate"	no
instance_market_options	The market (purchasing) option for the instances	object({ market_type = string spot_options = object({ block_duration_minutes = number instance_interruption_behavior = string max_price = number spot_instance_type = string valid_until = string }) })	null	no
instance_type	Instance type to launch	string	n/a	yes
key_name	SSH key name that should be used for the instance	string	""	no
kubelet_extra_args	Extra arguments to pass to kubelet, like "--register-with-taints=dedicated=ci-cd:NoSchedule --node-labels=purpose=ci-worker"	string	""	no
label_key_case	Controls the letter case of the tags keys (label names) for tags generated by this module. Does not affect keys of tags passed in via the tags input. Possible values: lower, title, upper. Default value: title.	string	null	no
label_order	The order in which the labels (ID elements) appear in the id. Defaults to ["namespace", "environment", "stage", "name", "attributes"]. You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present.	list(string)	null	no
label_value_case	Controls the letter case of ID elements (labels) as included in id, set as tag values, and output by this module individually. Does not affect values of tags passed in via the tags input. Possible values: lower, title, upper and none (no transformation). Set this to title and set delimiter to "" to yield Pascal Case IDs. Default value: lower.	string	null	no
labels_as_tags	Set of labels (ID elements) to include as tags in the tags output. Default is to include all labels. Tags with empty values will not be included in the tags output. Set to [] to suppress all generated tags. Notes: The value of the name tag, if included, will be the id, not the name. Unlike other null-label inputs, the initial setting of labels_as_tags cannot be changed in later chained modules. Attempts to change it will be silently ignored.	set(string)	[ "default" ]	no
load_balancers	A list of elastic load balancer names to add to the autoscaling group. Only valid for classic load balancers. For ALBs, use target_group_arns instead	list(string)	[]	no
max_instance_lifetime	The maximum amount of time, in seconds, that an instance can be in service, values must be either equal to 0 or between 604800 and 31536000 seconds	number	null	no
max_size	The maximum size of the autoscale group	number	n/a	yes
metadata_http_endpoint_enabled	Set false to disable the Instance Metadata Service.	bool	true	no
metadata_http_put_response_hop_limit	The desired HTTP PUT response hop limit (between 1 and 64) for Instance Metadata Service requests. The default is 2 to support containerized workloads.	number	2	no
metadata_http_tokens_required	Set true to require IMDS session tokens, disabling Instance Metadata Service Version 1.	bool	true	no
metrics_granularity	The granularity to associate with the metrics to collect. The only valid value is 1Minute	string	"1Minute"	no
min_elb_capacity	Setting this causes Terraform to wait for this number of instances to show up healthy in the ELB only on creation. Updates will not wait on ELB instance number changes	number	0	no
min_size	The minimum size of the autoscale group	number	n/a	yes
mixed_instances_policy	policy to used mixed group of on demand/spot of differing types. Launch template is automatically generated. https://www.terraform.io/docs/providers/aws/r/autoscaling_group.html#mixed_instances_policy-1	object({ instances_distribution = object({ on_demand_allocation_strategy = string on_demand_base_capacity = number on_demand_percentage_above_base_capacity = number spot_allocation_strategy = string spot_instance_pools = number spot_max_price = string }) override = list(object({ instance_type = string weighted_capacity = number })) })	null	no
name	ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'. This is the only ID element not also included as a tag. The "name" tag is set to the full id string. There is no tag with the value of the name input.	string	null	no
namespace	ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique	string	null	no
placement	The placement specifications of the instances	object({ affinity = string availability_zone = string group_name = string host_id = string tenancy = string })	null	no
placement_group	The name of the placement group into which you'll launch your instances, if any	string	""	no
protect_from_scale_in	Allows setting instance protection. The autoscaling group will not select instances with this setting for terminination during scale in events	bool	false	no
regex_replace_chars	Terraform regular expression (regex) string. Characters matching the regex will be removed from the ID elements. If not set, "/[^a-zA-Z0-9-]/" is used to remove all characters other than hyphens, letters and digits.	string	null	no
scale_down_adjustment_type	Specifies whether the adjustment is an absolute number or a percentage of the current capacity. Valid values are ChangeInCapacity, ExactCapacity and PercentChangeInCapacity	string	"ChangeInCapacity"	no
scale_down_cooldown_seconds	The amount of time, in seconds, after a scaling activity completes and before the next scaling activity can start	number	300	no
scale_down_policy_type	The scalling policy type, either SimpleScaling, StepScaling or TargetTrackingScaling	string	"SimpleScaling"	no
scale_down_scaling_adjustment	The number of instances by which to scale. scale_down_scaling_adjustment determines the interpretation of this number (e.g. as an absolute number or as a percentage of the existing Auto Scaling group size). A positive increment adds to the current capacity and a negative value removes from the current capacity	number	-1	no
scale_up_adjustment_type	Specifies whether the adjustment is an absolute number or a percentage of the current capacity. Valid values are ChangeInCapacity, ExactCapacity and PercentChangeInCapacity	string	"ChangeInCapacity"	no
scale_up_cooldown_seconds	The amount of time, in seconds, after a scaling activity completes and before the next scaling activity can start	number	300	no
scale_up_policy_type	The scalling policy type, either SimpleScaling, StepScaling or TargetTrackingScaling	string	"SimpleScaling"	no
scale_up_scaling_adjustment	The number of instances by which to scale. scale_up_adjustment_type determines the interpretation of this number (e.g. as an absolute number or as a percentage of the existing Auto Scaling group size). A positive increment adds to the current capacity and a negative value removes from the current capacity	number	1	no
service_linked_role_arn	The ARN of the service-linked role that the ASG will use to call other AWS services	string	""	no
stage	ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'	string	null	no
subnet_ids	A list of subnet IDs to launch resources in	list(string)	n/a	yes
suspended_processes	A list of processes to suspend for the AutoScaling Group. The allowed values are Launch, Terminate, HealthCheck, ReplaceUnhealthy, AZRebalance, AlarmNotification, ScheduledActions, AddToLoadBalancer. Note that if you suspend either the Launch or Terminate process types, it can prevent your autoscaling group from functioning properly.	list(string)	[]	no
tags	Additional tags (e.g. {'BusinessUnit': 'XYZ'}). Neither the tag keys nor the tag values will be modified by this module.	map(string)	{}	no
target_group_arns	A list of aws_alb_target_group ARNs, for use with Application Load Balancing	list(string)	[]	no
tenant	ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for	string	null	no
termination_policies	A list of policies to decide how the instances in the auto scale group should be terminated. The allowed values are OldestInstance, NewestInstance, OldestLaunchConfiguration, ClosestToNextInstanceHour, Default	list(string)	[ "Default" ]	no
use_custom_image_id	If set to true, will use variable image_id for the EKS workers inside autoscaling group	bool	false	no
use_existing_aws_iam_instance_profile	If set to true, will use variable aws_iam_instance_profile_name to run EKS workers using an existing AWS instance profile that was created outside of this module, workaround for error like count cannot be computed	bool	false	no
use_existing_security_group	If set to true, will use variable workers_security_group_id to run EKS workers using an existing security group that was created outside of this module, workaround for errors like count cannot be computed	bool	false	no
vpc_id	VPC ID for the EKS cluster	string	n/a	yes
wait_for_capacity_timeout	A maximum duration that Terraform should wait for ASG instances to be healthy before timing out. Setting this to '0' causes Terraform to skip all Capacity Waiting behavior	string	"10m"	no
wait_for_elb_capacity	Setting this will cause Terraform to wait for exactly this number of healthy instances in all attached load balancers on both create and update operations. Takes precedence over min_elb_capacity behavior	number	0	no
workers_role_policy_arns	List of policy ARNs that will be attached to the workers default role on creation	list(string)	[]	no
workers_role_policy_arns_count	Count of policy ARNs that will be attached to the workers default role on creation. Needed to prevent Terraform error count can't be computed	number	0	no
workers_security_group_id	The name of the existing security group that will be used in autoscaling group for EKS workers. If empty, a new security group will be created	string	""	no

Outputs

Name	Description
autoscaling_group_arn	ARN of the AutoScaling Group
autoscaling_group_default_cooldown	Time between a scaling activity and the succeeding scaling activity
autoscaling_group_desired_capacity	The number of Amazon EC2 instances that should be running in the group
autoscaling_group_health_check_grace_period	Time after instance comes into service before checking health
autoscaling_group_health_check_type	EC2 or ELB. Controls how health checking is done
autoscaling_group_id	The AutoScaling Group ID
autoscaling_group_max_size	The maximum size of the AutoScaling Group
autoscaling_group_min_size	The minimum size of the AutoScaling Group
autoscaling_group_name	The AutoScaling Group name
autoscaling_group_tags	A list of tag settings associated with the AutoScaling Group
launch_template_arn	ARN of the launch template
launch_template_id	The ID of the launch template
security_group_arn	ARN of the worker nodes Security Group
security_group_id	ID of the worker nodes Security Group
security_group_name	Name of the worker nodes Security Group
workers_role_arn	ARN of the worker nodes IAM role
workers_role_name	Name of the worker nodes IAM role

Related Projects

Check out these related projects.

• terraform-aws-ec2-autoscale-group - Terraform module to provision Auto Scaling Group and Launch Template on AWS
• terraform-aws-ecs-container-definition - Terraform module to generate well-formed JSON documents (container definitions) that are passed to the aws_ecs_task_definition Terraform resource
• terraform-aws-ecs-alb-service-task - Terraform module which implements an ECS service which exposes a web service via ALB
• terraform-aws-ecs-web-app - Terraform module that implements a web app on ECS and supports autoscaling, CI/CD, monitoring, ALB integration, and much more
• terraform-aws-ecs-codepipeline - Terraform module for CI/CD with AWS Code Pipeline and Code Build for ECS
• terraform-aws-ecs-cloudwatch-autoscaling - Terraform module to autoscale ECS Service based on CloudWatch metrics
• terraform-aws-ecs-cloudwatch-sns-alarms - Terraform module to create CloudWatch Alarms on ECS Service level metrics
• terraform-aws-ec2-instance - Terraform module for providing a general purpose EC2 instance
• terraform-aws-ec2-instance-group - Terraform module for provisioning multiple general purpose EC2 hosts for stateful applications

Tip

Use Terraform Reference Architectures for AWS

Use Cloud Posse's ready-to-go terraform architecture blueprints for AWS to get up and running quickly.

✅ We build it with you.
✅ You own everything.
✅ Your team wins.

📚 Learn More

Cloud Posse is the leading DevOps Accelerator for funded startups and enterprises.

Your team can operate like a pro today.

Ensure that your team succeeds by using Cloud Posse's proven process and turnkey blueprints. Plus, we stick around until you succeed.

Day-0: Your Foundation for Success

• Reference Architecture. You'll get everything you need from the ground up built using 100% infrastructure as code.
• Deployment Strategy. Adopt a proven deployment strategy with GitHub Actions, enabling automated, repeatable, and reliable software releases.
• Site Reliability Engineering. Gain total visibility into your applications and services with Datadog, ensuring high availability and performance.
• Security Baseline. Establish a secure environment from the start, with built-in governance, accountability, and comprehensive audit logs, safeguarding your operations.
• GitOps. Empower your team to manage infrastructure changes confidently and efficiently through Pull Requests, leveraging the full power of GitHub Actions.

Day-2: Your Operational Mastery

• Training. Equip your team with the knowledge and skills to confidently manage the infrastructure, ensuring long-term success and self-sufficiency.
• Support. Benefit from a seamless communication over Slack with our experts, ensuring you have the support you need, whenever you need it.
• Troubleshooting. Access expert assistance to quickly resolve any operational challenges, minimizing downtime and maintaining business continuity.
• Code Reviews. Enhance your team’s code quality with our expert feedback, fostering continuous improvement and collaboration.
• Bug Fixes. Rely on our team to troubleshoot and resolve any issues, ensuring your systems run smoothly.
• Migration Assistance. Accelerate your migration process with our dedicated support, minimizing disruption and speeding up time-to-value.
• Customer Workshops. Engage with our team in weekly workshops, gaining insights and strategies to continuously improve and innovate.

✨ Contributing

This project is under active development, and we encourage contributions from our community.

Many thanks to our outstanding contributors:

For 🐛 bug reports & feature requests, please use the issue tracker.

In general, PRs are welcome. We follow the typical "fork-and-pull" Git workflow.

1. Review our Code of Conduct and Contributor Guidelines.
2. Fork the repo on GitHub
3. Clone the project to your own machine
4. Commit changes to your own branch
5. Push your work back up to your fork
6. Submit a Pull Request so that we can review your changes

NOTE: Be sure to merge the latest changes from "upstream" before making a pull request!

🌎 Slack Community

Join our Open Source Community on Slack. It's FREE for everyone! Our "SweetOps" community is where you get to talk with others who share a similar vision for how to rollout and manage infrastructure. This is the best place to talk shop, ask questions, solicit feedback, and work together as a community to build totally sweet infrastructure.

📰 Newsletter

Sign up for our newsletter and join 3,000+ DevOps engineers, CTOs, and founders who get insider access to the latest DevOps trends, so you can always stay in the know. Dropped straight into your Inbox every week — and usually a 5-minute read.

📆 Office Hours

Join us every Wednesday via Zoom for your weekly dose of insider DevOps trends, AWS news and Terraform insights, all sourced from our SweetOps community, plus a live Q&A that you can’t find anywhere else. It's FREE for everyone!

License

Preamble to the Apache License, Version 2.0

Complete license is available in the LICENSE file.

Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements.  See the NOTICE file
distributed with this work for additional information
regarding copyright ownership.  The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License.  You may obtain a copy of the License at

  https://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied.  See the License for the
specific language governing permissions and limitations
under the License.

Trademarks

All other trademarks referenced herein are the property of their respective owners.

---

Copyright © 2017-2024 Cloud Posse, LLC

terraform-aws-eks-workers's Issues

Add ability to configure host node volume size.

By default the host volume size is 20gb which can be a bit lacking especially with larger machines.

I can make a pr if you'd like

default `eks_worker_ami_name_regex` should be updated to handle 1.20

Hey, I just found a simple bug when you want to use EKS with kubernetes 1.20 the AMI is not found.

Describe the Bug

Set kubernetes_version to 1.20

╷
│ Error: "name_regex": error parsing regexp: missing argument to repetition operator: `*`
│ 
│   with module.eks_workers.data.aws_ami.eks_worker[0],
│   on .terraform/modules/eks_workers/main.tf line 139, in data "aws_ami" "eks_worker":
│  139:   name_regex  = var.eks_worker_ami_name_regex
│ 
╵

Solution

Just need to change eks_worker_ami_name_regex = "^amazon-eks-node-[0-9,.]+-v[0-9]{8}$" as the default regexp.

Workaround

We can pass the parameters eks_worker_ami_name_regex = "^amazon-eks-node-[0-9,.]+-v[0-9]{8}$" to the module directly.

Custom userdata template/file input

Should there be an entirely custom userdata file/template input that can be injected on the launch group?

There is something I should optimize on the launch group according to this article
https://kubedex.com/90-days-of-aws-eks-in-production/

Terraform 0.12 warnings

I got the following warning with Terraform 0.12

Warning: Quoted references are deprecated

  on .terraform/modules/subnets/private.tf line 45, in resource "aws_subnet" "private":
  45:     ignore_changes = ["tags.kubernetes", "tags.SubnetType"]

In this context, references are expected literally rather than in quotes.
Terraform 0.11 and earlier required quotes, but quoted references are now
deprecated and will be removed in a future version of Terraform. Remove the
quotes surrounding this reference to silence this warning.

(and 3 more similar warnings elsewhere)

aws_iam_role tags not defined

I need to define tags linked to aws_iam_role resources. Could you add tags to aws_iam_role default please?
In main.tf

I opened the same issue on the cluster repository:
Issue on cluster repo

Support other AWS partitions

Have a question? Please checkout our Slack Community or visit our Slack Archive.

Describe the Feature

Other partitions use different ARN designations. Hard coding ARNs means the module only works in AWS Commercial.

Expected Behavior

I'm able to use the module in AWS GovCloud

Use Case

Since the ARNs are hard coded, the module doesn't work in govcloud

Describe Ideal Solution

Change this:

resource "aws_iam_role_policy_attachment" "amazon_eks_worker_node_policy" {
  count      = local.enabled && var.use_existing_aws_iam_instance_profile == false ? 1 : 0
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
  role       = join("", aws_iam_role.default.*.name)

to this:

data "aws_partition" "current" {}

resource "aws_iam_role_policy_attachment" "amazon_eks_worker_node_policy" {
  count      = local.enabled && var.use_existing_aws_iam_instance_profile == false ? 1 : 0
  policy_arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/AmazonEKSWorkerNodePolicy"
  role       = join("", aws_iam_role.default.*.name)
}

(plus 2 other instances where ARNs are hard coded)

Alternatives Considered

None

Additional Context

PR incoming

launch spot instances?

I don't see how to pass "instance_market_options" to the launch template? Is it correct that you can't launch spot instances using this module? Would you accept a pull request here (and in https://github.com/cloudposse/terraform-aws-ec2-autoscale-group) for instance_market_options?

Deployment commands

First thanks for your terraform modules. They are really useful and make devops life easier.
If you can add full deployment commands into each repo, it might be better for newcomers.
like

$ git clone to specific tag
$ cd samples/directory
$ vi fixtures.us-east-2.tfvars
$ export AWS_ACCESS_KEY_ID="xyz"
$ export AWS_SECRET_ACCESS_KEY="abc"
$ export AWS_DEFAULT_REGION="us-west-2"
$ terraform plan

Thanks

Add Example Usage

what

• Add example invocation

why

• We need this so we can soon enable automated continuous integration testing of module

Expose metadata_options {instance_metadata_tags}

Describe the Feature

This is a follow up on cloudposse/terraform-aws-ec2-autoscale-group#87

For some time AWS allows to enable instance tags in metadata through:

  metadata_options {
    instance_metadata_tags = "enabled"
  }

See: https://aws.amazon.com/about-aws/whats-new/2022/01/instance-tags-amazon-ec2-instance-metadata-service/

Expected Behavior

Ability to enable instance_metadata_tags

Use Case

Please see original issue in terraform-aws-ec2-autoscale-group/

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Repository problems

These problems occurred while renovating this repository. View logs.

• WARN: Base branch does not exist - skipping

Ignored or Blocked

These are blocked by an existing closed PR and will not be recreated unless you click a checkbox below.

• chore(deps): update terraform cloudposse/ec2-autoscale-group/aws to v0.39.0 (release/v0)

Detected dependencies

Branch main

terraform

main.tf

• cloudposse/ec2-autoscale-group/aws 0.39.0
• cloudposse/label/null 0.25.0

versions.tf

• aws >= 5.16.0
• hashicorp/terraform >= 1.0

Branch release/v0

terraform

main.tf

• cloudposse/ec2-autoscale-group/aws 0.30.0
• cloudposse/label/null 0.25.0

versions.tf

• aws >= 2.0
• hashicorp/terraform >= 0.13.0

---

• Check this box to trigger a request for Renovate to run again on this repository

Latest image regex doesn't seem to be working

I have found that the regex match doesn't seem to be working for finding the latest image and as a result the nodes that come up are for 1.13 despite my building a cluster using 1.16.

Playing around with the regex search I found this should work instead:
amazon-eks-node-[1-9]\.[1-9]{2}-v\d{8}

Has anyone else been having this issue?

worker node disk_space feature

hello team, could you please add worker node "disk_space" variable in this tag..
This is already in https://registry.terraform.io/modules/cloudposse/eks-node-group/aws/0.1.0
Can we have it in this tag also? or please include this feature in new releases..

Error initializing module

Hi! I'm receiving some errors when initializing the module using terraform init:

There are some problems with the configuration, described below.

The Terraform configuration must be valid before initialization so that
Terraform can determine which modules and providers need to be installed.

Error: Attribute redefined

  on .terraform/modules/eks_workers/main.tf line 135, in data "aws_ami" "eks_worker":
 135:   most_recent = true

The argument "most_recent" was already set at
.terraform/modules/eks_workers/main.tf:127,3-14. Each argument may be set only
once.

Removing the second most_recent does indeed fix the error.

"list" function was deprecated in Terraform v0.12 and is no longer available

Hello,

thanks for all your Terraform modules 👌

Describe the Bug

Seems there is a change in come function Terraform handles. It was a warning but now if you upgrade to tf 0.15.0 it will throw an error.

╷
│ Error: Error in function call
│ 
│   on .terraform/modules/eks_workers.autoscale_group/main.tf line 14, in resource "aws_launch_template" "default":
│   14:         for_each = flatten(list(lookup(block_device_mappings.value, "ebs", [])))
│     ├────────────────
│     │ block_device_mappings.value will be known only after apply
│ 
│ Call to function "list" failed: the "list" function was deprecated in Terraform v0.12 and is no longer available; use tolist([ ... ]) syntax to write a literal list.

Expected Behavior

We should handle properly new terraform function such as tolist instead of legacy list function:

https://www.terraform.io/docs/language/functions/list.html

Steps to Reproduce

Steps to reproduce the behavior:

1. Go to '...'
2. Run '....'
3. Enter '....'
4. See error

Screenshots

Environment (please complete the following information):

• OS: Linux Mint (ubuntu base)
• Version terraform v0.15.0

Additional Context

Here my fix:
for_each = flatten(tolist([lookup(block_device_mappings.value, "ebs", [])]))

Seems to work so far.

Related cloudposse/terraform-aws-ec2-autoscale-group#64

Feel free to ask me anything to help tackle this 👌

Conflicting AWS Provider versions between modules

Describe the Bug

If I happen to use this module with cloudposse/terraform-aws-eks-node-group I get a conflicting provider error for aws.

When running terraform init -backend=false . on the related terraform:

Initializing provider plugins...
- Using previously-installed hashicorp/null v2.1.2
- Using previously-installed hashicorp/local v1.4.0
- Using previously-installed hashicorp/kubernetes v1.12.0
- Using previously-installed hashicorp/template v2.1.2
- Finding hashicorp/aws versions matching ">= 2.0.*, < 4.0.*, ~> 3.0, >= 2.0.*, < 4.0.*, >= 2.0.*, < 4.0.*, ~> 2.0, ~> 2.0"...

Error: Failed to query available provider packages

Could not retrieve the list of available versions for provider hashicorp/aws:
no available releases match the given constraints >= 2.0.*, < 4.0.*, ~> 3.0,
>= 2.0.*, < 4.0.*, >= 2.0.*, < 4.0.*, ~> 2.0, ~> 2.0

FWIW, this output includes module boundaries from a few other cloudposse modules (like terraform-aws-dynamic-subnets, terraform-aws-vpc, etc)

Expected Behavior

I should be able to get all providers

Steps to Reproduce:

Steps to reproduce the behavior:

1. Create .tf with module usage of both cloudposse/terraform-aws-eks-node-group and this module using the latest versions of both as of writing this (0.10.0 and 0.15.2 respectively)
2. Run terraform init -backend=false .
3. See error output

Environment:

• OS: OSX
• Version 10.15.6

Output of terraform -version within terraform dir:

Terraform v0.13.1
+ provider registry.terraform.io/hashicorp/kubernetes v1.12.0
+ provider registry.terraform.io/hashicorp/local v1.4.0
+ provider registry.terraform.io/hashicorp/null v2.1.2
+ provider registry.terraform.io/hashicorp/template v2.1.2

Deprecated template provider should be removed from module

Describe the Bug

Template provider used in this module is long deprecated, it should be removed. It does not exist for Mac M1 machines, so you either need to use workarounds or it would not work.

hashicorp/terraform-provider-template#85

Expected Behavior

Module should work on all platforms supported on TF.

Steps to Reproduce

Do whatever

Screenshots

Initializing modules...
Downloading registry.terraform.io/cloudposse/ec2-autoscale-group/aws 0.27.0 for autoscale_group...
- autoscale_group in .terraform/modules/autoscale_group
Downloading registry.terraform.io/cloudposse/label/null 0.24.1 for autoscale_group.this...
- autoscale_group.this in .terraform/modules/autoscale_group.this
Downloading registry.terraform.io/cloudposse/label/null 0.25.0 for label...
- label in .terraform/modules/label
Downloading registry.terraform.io/cloudposse/security-group/aws 0.3.3 for security_group...
- security_group in .terraform/modules/security_group
Downloading registry.terraform.io/cloudposse/label/null 0.25.0 for security_group.this...
- security_group.this in .terraform/modules/security_group.this
Downloading registry.terraform.io/cloudposse/label/null 0.25.0 for this...
- this in .terraform/modules/this

Initializing the backend...

Successfully configured the backend "s3"! Terraform will automatically
use this backend unless the backend configuration changes.

Initializing provider plugins...
- Finding hashicorp/null versions matching ">= 2.0.0"...
- Finding integrations/github versions matching "~> 4.0"...
- Finding hashicorp/aws versions matching ">= 2.0.0, >= 3.63.0, < 4.0.0"...
- Finding hashicorp/template versions matching ">= 2.0.0"...
- Installing hashicorp/null v3.1.1...
- Installed hashicorp/null v3.1.1 (signed by HashiCorp)
- Using integrations/github v4.24.1 from the shared cache directory
- Using hashicorp/aws v3.75.1 from the shared cache directory
╷
│ Error: Incompatible provider version
│
│ Provider registry.terraform.io/hashicorp/template v2.2.0 does not have a
│ package available for your current platform, darwin_arm64.
│
│ Provider releases are separate from Terraform CLI releases, so not all
│ providers are available for all platforms. Other versions of this provider
│ may have different platforms supported.
╵

ERRO[0033] 1 error occurred:
	* exit status 1

Environment (please complete the following information):

Anything that will help us triage the bug will help. Here are some ideas:

• OS: Mac Os, Apple Silicon M1
• Version: Monterey 12.3.1

Full end-to-end example

Have a question? Please checkout our Slack Community or visit our Slack Archive.

Describe the Feature

Would like the ability to look at a working end-to-end example, so that I can start from a baseline of something that works as I build.

Expected Behavior

I expected that the examples in the "examples/complete" folder would include creation of an EKS cluster as well as worker nodes using this module. In actuality it creates a VPC, subnets, and the worker nodes, but no cluster.

I'm currently struggling to get this module working in my environment, and don't have a working example to refer to.

Use Case

I'm trying to stand up an eks cluster using the cloudposse module, with workers using this module. I can't use the managed node group module since I need to configure the worker nodes as dedicated tenancy.

I'm currently struggling to get it working. The cluster comes up fine, and the instances start fine, but they never show up as nodes in the cluster (e.g. kubectl get nodes returns nothing)

Describe Ideal Solution

A working example exists that I can use as a working baseline to build from

Alternatives Considered

Continue troubleshooting my setup without being able to refer to a working example

Feature request: ability to pass in aws-auth roles/users

I would like the ability to pass in extra roles and/or users to be templated in the aws-auth template.

See https://github.com/terraform-aws-modules/terraform-aws-eks/blob/master/aws_auth.tf for an example.

Initial Implementation

what

• Implement module to provision EKS worker nodes using terraform-aws-ec2-autoscale-group

why

• Terraform managed kubernetes clusters

references

• https://www.terraform.io/docs/providers/aws/guides/eks-getting-started.html
• https://github.com/cloudposse/terraform-aws-ec2-autoscale-group

depends on

• cloudposse/terraform-aws-ec2-autoscale-group#1

AutoScaling Group launch template fails validation

I've copied your instructions from terraform-aws-eks-cluster ("Module usage on Terraform Cloud") but when running this on Terraform Cloud I get this error:

Error: Error creating AutoScaling Group: ValidationError: You must use a valid fully-formed launch template. The requested configuration is currently not supported. Please check the documentation for supported configurations.
status code: 400, request id: 6a08240a-3095-11ea-8715-5592e51a1563

on .terraform/modules/eks_workers.autoscale_group/main.tf line 127, in resource "aws_autoscaling_group" "default":
127: resource "aws_autoscaling_group" "default" {

Here are my files:

main.tf

provider "aws" {
  region = "eu-north-1"

  #   assume_role {
  #     role_arn = "arn:aws:iam::xxxxxxxxxxx:role/OrganizationAccountAccessRole"
  #   }
}

module "label" {
  source     = "git::https://github.com/cloudposse/terraform-null-label.git?ref=tags/0.16.0"
  namespace  = var.namespace
  name       = var.name
  stage      = var.stage
  delimiter  = var.delimiter
  attributes = compact(concat(var.attributes, list("cluster")))
  tags       = var.tags
}

locals {
  # The usage of the specific kubernetes.io/cluster/* resource tags below are required
  # for EKS and Kubernetes to discover and manage networking resources
  # https://www.terraform.io/docs/providers/aws/guides/eks-getting-started.html#base-vpc-networking
  tags = merge(var.tags, map("kubernetes.io/cluster/${module.label.id}", "shared"))

  # Unfortunately, most_recent (https://github.com/cloudposse/terraform-aws-eks-workers/blob/34a43c25624a6efb3ba5d2770a601d7cb3c0d391/main.tf#L141)
  # variable does not work as expected, if you are not going to use custom AMI you should
  # enforce usage of eks_worker_ami_name_filter variable to set the right kubernetes version for EKS workers,
  # otherwise the first version of Kubernetes supported by AWS (v1.11) for EKS workers will be used, but
  # EKS control plane will use the version specified by kubernetes_version variable.
  eks_worker_ami_name_filter = "amazon-eks-node-${var.kubernetes_version}*"
}

module "vpc" {
  source     = "git::https://github.com/cloudposse/terraform-aws-vpc.git?ref=tags/0.8.0"
  namespace  = var.namespace
  stage      = var.stage
  name       = var.name
  attributes = var.attributes
  cidr_block = "172.16.0.0/16"
  tags       = local.tags
}

module "subnets" {
  source               = "git::https://github.com/cloudposse/terraform-aws-dynamic-subnets.git?ref=tags/0.16.0"
  availability_zones   = var.availability_zones
  namespace            = var.namespace
  stage                = var.stage
  name                 = var.name
  attributes           = var.attributes
  vpc_id               = module.vpc.vpc_id
  igw_id               = module.vpc.igw_id
  cidr_block           = module.vpc.vpc_cidr_block
  nat_gateway_enabled  = false
  nat_instance_enabled = false
  tags                 = local.tags
}

module "eks_workers" {
  source                             = "git::https://github.com/cloudposse/terraform-aws-eks-workers.git?ref=tags/0.11.0"
  namespace                          = var.namespace
  stage                              = var.stage
  name                               = var.name
  attributes                         = var.attributes
  tags                               = var.tags
  instance_type                      = var.instance_type
  eks_worker_ami_name_filter         = local.eks_worker_ami_name_filter
  vpc_id                             = module.vpc.vpc_id
  subnet_ids                         = module.subnets.public_subnet_ids
  health_check_type                  = var.health_check_type
  min_size                           = var.min_size
  max_size                           = var.max_size
  wait_for_capacity_timeout          = var.wait_for_capacity_timeout
  cluster_name                       = module.label.id
  cluster_endpoint                   = module.eks_cluster.eks_cluster_endpoint
  cluster_certificate_authority_data = module.eks_cluster.eks_cluster_certificate_authority_data
  cluster_security_group_id          = module.eks_cluster.security_group_id

  # Auto-scaling policies and CloudWatch metric alarms
  autoscaling_policies_enabled           = var.autoscaling_policies_enabled
  cpu_utilization_high_threshold_percent = var.cpu_utilization_high_threshold_percent
  cpu_utilization_low_threshold_percent  = var.cpu_utilization_low_threshold_percent
}

module "eks_cluster" {
  source     = "git::https://github.com/cloudposse/terraform-aws-eks-cluster.git?ref=tags/0.15.0"
  namespace  = var.namespace
  stage      = var.stage
  name       = var.name
  attributes = var.attributes
  tags       = var.tags
  region     = "eu-north-1"
  vpc_id     = module.vpc.vpc_id
  subnet_ids = module.subnets.public_subnet_ids

  local_exec_interpreter = "/bin/bash"
  kubernetes_version     = "1.14"

  workers_role_arns          = [module.eks_workers.workers_role_arn]
  workers_security_group_ids = [module.eks_workers.security_group_id]

  # Terraform Cloud configurations
  kubeconfig_path                                = "~/.kube/config"
  configmap_auth_file                            = "/home/terraform/.terraform/configmap-auth.yaml"
  install_aws_cli                                = true
  install_kubectl                                = true
  external_packages_install_path                 = "~/.terraform/bin"
  aws_eks_update_kubeconfig_additional_arguments = "--verbose"
  aws_cli_assume_role_arn                        = "arn:aws:iam::xxxxxxxxxxx:role/OrganizationAccountAccessRole"
  aws_cli_assume_role_session_name               = "eks_cluster_example_session"
}

eks.auto.tfvars

region = "eu-north-1"
// region = "eu-west-1"

availability_zones = ["eu-north-1a", "eu-north-1b"]

namespace = "mynamespace"

stage = "test"
// ???

name = "eks3"

instance_type = "t2.small"

health_check_type = "EC2"

wait_for_capacity_timeout = "10m"

max_size = 3

min_size = 2

autoscaling_policies_enabled = true

cpu_utilization_high_threshold_percent = 80

cpu_utilization_low_threshold_percent = 20

associate_public_ip_address = true

kubernetes_version = "1.14"

kubeconfig_path = "/.kube/config"

oidc_provider_enabled = true

variables.tf

variable "region" {
  type        = string
  description = "AWS Region"
}

variable "availability_zones" {
  type        = list(string)
  description = "List of availability zones"
}

variable "namespace" {
  type        = string
  description = "Namespace, which could be your organization name, e.g. 'eg' or 'cp'"
}

variable "stage" {
  type        = string
  description = "Stage, e.g. 'prod', 'staging', 'dev' or 'testing'"
}

variable "name" {
  type        = string
  description = "Solution name, e.g. 'app' or 'cluster'"
}

variable "delimiter" {
  type        = string
  default     = "-"
  description = "Delimiter to be used between `name`, `namespace`, `stage`, etc."
}

variable "attributes" {
  type        = list(string)
  default     = []
  description = "Additional attributes (e.g. `1`)"
}

variable "tags" {
  type        = map(string)
  default     = {}
  description = "Additional tags (e.g. `map('BusinessUnit`,`XYZ`)"
}

variable "instance_type" {
  type        = string
  description = "Instance type to launch"
}

variable "kubernetes_version" {
  type        = string
  default     = ""
  description = "Desired Kubernetes master version. If you do not specify a value, the latest available version is used"
}

variable "health_check_type" {
  type        = "string"
  description = "Controls how health checking is done. Valid values are `EC2` or `ELB`"
}

variable "associate_public_ip_address" {
  type        = bool
  description = "Associate a public IP address with an instance in a VPC"
}

variable "max_size" {
  type        = number
  description = "The maximum size of the AutoScaling Group"
}

variable "min_size" {
  type        = number
  description = "The minimum size of the AutoScaling Group"
}

variable "wait_for_capacity_timeout" {
  type        = string
  description = "A maximum duration that Terraform should wait for ASG instances to be healthy before timing out. Setting this to '0' causes Terraform to skip all Capacity Waiting behavior"
}

variable "autoscaling_policies_enabled" {
  type        = bool
  description = "Whether to create `aws_autoscaling_policy` and `aws_cloudwatch_metric_alarm` resources to control Auto Scaling"
}

variable "cpu_utilization_high_threshold_percent" {
  type        = number
  description = "Worker nodes AutoScaling Group CPU utilization high threshold percent"
}

variable "cpu_utilization_low_threshold_percent" {
  type        = number
  description = "Worker nodes AutoScaling Group CPU utilization low threshold percent"
}

variable "map_additional_aws_accounts" {
  description = "Additional AWS account numbers to add to `config-map-aws-auth` ConfigMap"
  type        = list(string)
  default     = []
}

variable "map_additional_iam_roles" {
  description = "Additional IAM roles to add to `config-map-aws-auth` ConfigMap"

  type = list(object({
    rolearn  = string
    username = string
    groups   = list(string)
  }))

  default = []
}

variable "map_additional_iam_users" {
  description = "Additional IAM users to add to `config-map-aws-auth` ConfigMap"

  type = list(object({
    userarn  = string
    username = string
    groups   = list(string)
  }))

  default = []
}

variable "oidc_provider_enabled" {
  type        = bool
  default     = false
  description = "Create an IAM OIDC identity provider for the cluster, then you can create IAM roles to associate with a service account in the cluster, instead of using kiam or kube2iam. For more information, see https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html"
}

variable "kubeconfig_path" {
  type        = string
  description = "The path to `kubeconfig` file"
}

variable "local_exec_interpreter" {
  type        = string
  default     = "/bin/bash"
  description = "shell to use for local exec"
}

variable "configmap_auth_template_file" {
  type        = string
  default     = ""
  description = "Path to `config_auth_template_file`"
}

variable "configmap_auth_file" {
  type        = string
  default     = ""
  description = "Path to `configmap_auth_file`"
}

variable "install_aws_cli" {
  type        = bool
  default     = false
  description = "Set to `true` to install AWS CLI if the module is provisioned on workstations where AWS CLI is not installed by default, e.g. Terraform Cloud workers"
}

variable "install_kubectl" {
  type        = bool
  default     = false
  description = "Set to `true` to install `kubectl` if the module is provisioned on workstations where `kubectl` is not installed by default, e.g. Terraform Cloud workers"
}

variable "kubectl_version" {
  type        = string
  default     = ""
  description = "`kubectl` version to install. If not specified, the latest version will be used"
}

variable "external_packages_install_path" {
  type        = string
  default     = ""
  description = "Path to install external packages, e.g. AWS CLI and `kubectl`. Used when the module is provisioned on workstations where the external packages are not installed by default, e.g. Terraform Cloud workers"
}

variable "aws_eks_update_kubeconfig_additional_arguments" {
  type        = string
  default     = ""
  description = "Additional arguments for `aws eks update-kubeconfig` command, e.g. `--role-arn xxxxxxxxx`. For more info, see https://docs.aws.amazon.com/cli/latest/reference/eks/update-kubeconfig.html"
}

variable "aws_cli_assume_role_arn" {
  type        = string
  default     = ""
  description = "IAM Role ARN for AWS CLI to assume before calling `aws eks` to update kubeconfig"
}

variable "aws_cli_assume_role_session_name" {
  type        = string
  default     = ""
  description = "An identifier for the assumed role session when assuming the IAM Role for AWS CLI before calling `aws eks` to update `kubeconfig`"
}

variable "jq_version" {
  type        = string
  default     = "1.6"
  description = "Version of `jq` to download to extract temporaly credentials after running `aws sts assume-role` if AWS CLI needs to assume role to access the cluster (if variable `aws_cli_assume_role_arn` is set)"
}

do we plan to add node groups ?

kubernetes.io/cluster tag not set on autoscaling group

Found a bug? Maybe our Slack Community can help.

Describe the Bug

The ASG is not properly tagged with kubernetes.io/cluster/${var.cluster_name}" = "owned" and the workers fail to join the cluster.

The bug was introduced in #52 , since then the tag lists are not merged as they used to be.
54cffae#diff-dc46acf24afd63ef8c556b77c126ccc6e578bc87e3aa09a931f33d9bf2532fbbL179

Expected Behavior

The ASG should be tagged with kubernetes.io/cluster/${var.cluster_name}" = "owned"

Steps to Reproduce

Screenshots

Environment (please complete the following information):

TF 0.14.9

Additional Context

Add any other context about the problem here.

Expose option for max_instance_lifetime

Describe the Feature

max_instance_lifetime as an option has been added to the dependency terraform-aws-ec2-autoscale-group, but is not yet available to use in terraform-aws-eks-workers

Expected Behavior

Variable exposed to be passed through to the ASG options

Use Case

Having this would be helpful as a backstop for the in-cluster node replacement options with cluster-autoscaler / node-problem-detector / Draino to ensure that a node is replaced even if all else fails.

Thank you for your consideration!

Error destroying ASG providing instance profile

Hi,
I've got this error when I am trying to destroy the AWS ASG using this module:

Error: Error getting instance profiles: NoSuchEntity: Instance Profile fs-test-eks-cluster-workers-profile cannot be found.
	status code: 404, request id: b5020704-2009-4d4e-97f1-099e49aa4aa6

  on .terraform/modules/ng-mix-2/main.tf line 166, in data "aws_iam_instance_profile" "default":
 166: data "aws_iam_instance_profile" "default" {

Here is my config for this module:

module "ng-mix-2" {
  source     = "git::https://github.com/cloudposse/terraform-aws-eks-workers.git?ref=tags/0.13.0"
  namespace  = var.namespace
  stage      = var.stage
  name       = var.name
  attributes = var.attributes

  vpc_id     = module.vpc.vpc_id
  subnet_ids = module.subnets.private_subnet_ids

  use_custom_image_id        = var.use_custom_image_id
  eks_worker_ami_name_filter = var.eks_worker_ami_name_filter
  health_check_type          = "EC2"

  cluster_name                       = module.eks.eks_cluster_id 
  cluster_endpoint                   = module.eks.eks_cluster_endpoint
  cluster_certificate_authority_data = module.eks.eks_cluster_certificate_authority_data
  cluster_security_group_id          = module.eks.eks_cluster_managed_security_group_id
  use_existing_security_group        = true
  workers_security_group_id          = module.eks.eks_cluster_managed_security_group_id

  use_existing_aws_iam_instance_profile = true
  aws_iam_instance_profile_name         = aws_iam_instance_profile.eks_worker_profile.name

  associate_public_ip_address = false
  enable_monitoring           = true


  instance_type = "t3.medium" 
  min_size      = 1
  max_size      = 5

  mixed_instances_policy = {
    override = [
      {
        instance_type     = "t3.medium"
        weighted_capacity = 2
      }
    ]

    instances_distribution = {
      on_demand_allocation_strategy            = "prioritized"
      on_demand_base_capacity                  = 1
      on_demand_percentage_above_base_capacity = 10
      spot_allocation_strategy                 = "lowest-price"
      spot_instance_pools                      = 2       
      spot_max_price                           = "0.015" 
    }
  }

Thank you very much in advance

Proposition to add encryption of volumes for EKS Worker Nodes

I have code to add to this module that will create kms key with needed policies and creation of new ami with encryption of volumes, i can create PR to add this possibility to this module but not sure if its necessary because this can be done outside of module. @aknysh will this need for future use or useless for now?