diff --git a/terraform/modules/aws-eks/main.tf b/terraform/modules/aws-eks/main.tf index 42f5ebb..a21f960 100644 --- a/terraform/modules/aws-eks/main.tf +++ b/terraform/modules/aws-eks/main.tf @@ -25,6 +25,12 @@ module "eks" { service_account_role_arn = module.vpc_cni_irsa.iam_role_arn configuration_values = jsonencode({ enableNetworkPolicy = "true" + env = { + ENABLE_PREFIX_DELEGATION = "true" + WARM_PREFIX_TARGET = "1" + WARM_IP_TARGET = "5" + MINIMUM_IP_TARGET = "2" + } }) } aws-ebs-csi-driver = { @@ -51,6 +57,14 @@ module "eks" { type = "ingress" self = true } + ingress_allow_all_traffic_cluster_api = { + description = "Allow all traffic from Cluster API" + protocol = "all" + from_port = 0 + to_port = 0 + type = "ingress" + source_security_group_id = module.eks.cluster_security_group_id + } } self_managed_node_group_defaults = { @@ -96,6 +110,7 @@ module "eks" { spec: kubelet: config: + maxPods: 110 shutdownGracePeriod: 30s featureGates: DisableKubeletCloudCredentialProviders: true diff --git a/terraform/modules/k8s-addons/eks-aws-loadbalancer-controller.tf b/terraform/modules/k8s-addons/eks-aws-loadbalancer-controller.tf index 395451b..ae46c81 100644 --- a/terraform/modules/k8s-addons/eks-aws-loadbalancer-controller.tf +++ b/terraform/modules/k8s-addons/eks-aws-loadbalancer-controller.tf @@ -99,7 +99,7 @@ module "aws_iam_aws_loadbalancer_controller" { count = local.aws_load_balancer_controller.enabled ? 1 : 0 source = "../aws-iam-eks-trusted" - name = "${local.name}-aws-lb-controller" + name = "${local.name}-aws-lb-control" region = local.region oidc_provider_arn = local.eks_oidc_provider_arn policy = jsonencode({ @@ -450,6 +450,7 @@ resource "kubernetes_ingress_v1" "default" { namespace = module.ingress_nginx_namespace[count.index].name } spec { + # ingress_class_name = "nginx" rule { http { path { diff --git a/terraform/modules/k8s-addons/eks-istio.tf b/terraform/modules/k8s-addons/eks-istio.tf index ce1d966..d8a5c5c 100644 --- a/terraform/modules/k8s-addons/eks-istio.tf +++ b/terraform/modules/k8s-addons/eks-istio.tf @@ -1,11 +1,12 @@ locals { istio = { - name = local.helm_releases[index(local.helm_releases.*.id, "istio")].id - enabled = local.helm_releases[index(local.helm_releases.*.id, "istio")].enabled - chart = local.helm_releases[index(local.helm_releases.*.id, "istio")].chart - repository = local.helm_releases[index(local.helm_releases.*.id, "istio")].repository - chart_version = local.helm_releases[index(local.helm_releases.*.id, "istio")].chart_version - namespace = local.helm_releases[index(local.helm_releases.*.id, "istio")].namespace + name = local.helm_releases[index(local.helm_releases.*.id, "istio")].id + enabled = local.helm_releases[index(local.helm_releases.*.id, "istio")].enabled + chart = local.helm_releases[index(local.helm_releases.*.id, "istio")].chart + repository = local.helm_releases[index(local.helm_releases.*.id, "istio")].repository + chart_version = local.helm_releases[index(local.helm_releases.*.id, "istio")].chart_version + namespace = local.helm_releases[index(local.helm_releases.*.id, "istio")].namespace + egress_gateway_enabled = local.helm_releases[index(local.helm_releases.*.id, "istio")].egress_gateway_enabled } kiali_server = { name = local.helm_releases[index(local.helm_releases.*.id, "kiali")].id @@ -19,8 +20,8 @@ locals { pilot: resources: requests: - cpu: "500m" - memory: "2Gi" + cpu: "100m" + memory: "500Mi" limits: cpu: "500m" memory: "2Gi" @@ -32,6 +33,10 @@ global: autoInject: enabled excludeIPRanges: "169.254.169.254/32" holdApplicationUntilProxyStarts: true +meshConfig: + outboundTrafficPolicy: + mode: REGISTRY_ONLY # Deny traffic to outside hosts by default(Only hosts defined by Istio crds) + accessLogFile: /dev/stdout # Add trace logs to istiod components(istiod pod, sidecar) VALUES kiali_server_prometheus_endpoint = local.victoria_metrics_k8s_stack.enabled ? "http://vmsingle-${local.victoria_metrics_k8s_stack.name}.${local.victoria_metrics_k8s_stack.namespace}:8429" : "http://${local.kube_prometheus_stack.name}-prometheus.${local.kube_prometheus_stack.namespace}:9090" kiali_server_grafana_endpoint = local.victoria_metrics_k8s_stack.enabled ? "http://${local.victoria_metrics_k8s_stack.name}-grafana.${local.victoria_metrics_k8s_stack.namespace}" : "http://${local.kube_prometheus_stack.name}-grafana.${local.kube_prometheus_stack.namespace}" @@ -93,6 +98,37 @@ spec: - path: /stats/prometheus targetPort: http-envoy-prom interval: 15s +VALUES + istio_egress_gateway_values = <