From 9d680bd0649fcfb865dd1f070e22f6c66d0baeef Mon Sep 17 00:00:00 2001 From: Vladislav Khvorov Date: Wed, 30 Apr 2025 09:32:11 +0300 Subject: [PATCH 1/3] feature/M0-1150-khvorov-up-tg-stack deploy infra via boilerplate --- terraform/modules/aws-eks/main.tf | 7 + .../eks-aws-loadbalancer-controller.tf | 3 +- .../modules/k8s-addons/helm-releases.yaml | 4 +- terraform/modules/k8s-karpenter/main.tf | 21 +- .../.terraform.lock.hcl | 25 ++ .../demo/common/aws-acm/.terraform.lock.hcl | 34 +-- .../demo/common/aws-eks/.terraform.lock.hcl | 174 +++++++------ .../demo/common/aws-eks/terragrunt.hcl | 18 ++ .../demo/common/aws-r53/.terraform.lock.hcl | 34 +-- .../demo/common/aws-vpc/.terraform.lock.hcl | 35 ++- terragrunt/ACCOUNT_ID/us-east-1/demo/env.yaml | 8 +- .../demo/k8s-addons/.terraform.lock.hcl | 231 +++++++++--------- .../us-east-1/demo/k8s-addons/terragrunt.hcl | 1 + .../demo/karpenter/.terraform.lock.hcl | 153 ++++++------ .../us-east-1/demo/karpenter/terragrunt.hcl | 8 +- .../ebs-encryption/.terraform.lock.hcl | 36 +-- terragrunt/ACCOUNT_ID/us-east-1/region.yaml | 8 +- terragrunt/terragrunt.hcl | 12 +- 18 files changed, 435 insertions(+), 377 deletions(-) create mode 100644 terragrunt/ACCOUNT_ID/aws-users-password-policy/.terraform.lock.hcl diff --git a/terraform/modules/aws-eks/main.tf b/terraform/modules/aws-eks/main.tf index 42f5ebb..f36ba11 100644 --- a/terraform/modules/aws-eks/main.tf +++ b/terraform/modules/aws-eks/main.tf @@ -25,6 +25,12 @@ module "eks" { service_account_role_arn = module.vpc_cni_irsa.iam_role_arn configuration_values = jsonencode({ enableNetworkPolicy = "true" + env = { + ENABLE_PREFIX_DELEGATION = "true" + WARM_PREFIX_TARGET = "1" + WARM_IP_TARGET = "5" + MINIMUM_IP_TARGET = "2" + } }) } aws-ebs-csi-driver = { @@ -96,6 +102,7 @@ module "eks" { spec: kubelet: config: + maxPods: 110 shutdownGracePeriod: 30s featureGates: DisableKubeletCloudCredentialProviders: true diff --git a/terraform/modules/k8s-addons/eks-aws-loadbalancer-controller.tf b/terraform/modules/k8s-addons/eks-aws-loadbalancer-controller.tf index 395451b..ae46c81 100644 --- a/terraform/modules/k8s-addons/eks-aws-loadbalancer-controller.tf +++ b/terraform/modules/k8s-addons/eks-aws-loadbalancer-controller.tf @@ -99,7 +99,7 @@ module "aws_iam_aws_loadbalancer_controller" { count = local.aws_load_balancer_controller.enabled ? 1 : 0 source = "../aws-iam-eks-trusted" - name = "${local.name}-aws-lb-controller" + name = "${local.name}-aws-lb-control" region = local.region oidc_provider_arn = local.eks_oidc_provider_arn policy = jsonencode({ @@ -450,6 +450,7 @@ resource "kubernetes_ingress_v1" "default" { namespace = module.ingress_nginx_namespace[count.index].name } spec { + # ingress_class_name = "nginx" rule { http { path { diff --git a/terraform/modules/k8s-addons/helm-releases.yaml b/terraform/modules/k8s-addons/helm-releases.yaml index 16710c9..f8b5196 100644 --- a/terraform/modules/k8s-addons/helm-releases.yaml +++ b/terraform/modules/k8s-addons/helm-releases.yaml @@ -36,7 +36,7 @@ releases: chart_version: 1.14.4 namespace: external-dns - id: external-secrets - enabled: true + enabled: false chart: external-secrets repository: https://charts.external-secrets.io chart_version: 0.10.0 @@ -84,7 +84,7 @@ releases: chart_version: 2.10.2 namespace: loki - id: reloader - enabled: true + enabled: false chart: reloader repository: https://stakater.github.io/stakater-charts chart_version: 1.0.97 diff --git a/terraform/modules/k8s-karpenter/main.tf b/terraform/modules/k8s-karpenter/main.tf index cf2d459..7462211 100644 --- a/terraform/modules/k8s-karpenter/main.tf +++ b/terraform/modules/k8s-karpenter/main.tf @@ -1,12 +1,13 @@ locals { eks_cluster_endpoint = data.aws_eks_cluster.main.endpoint karpenter = { - name = try(var.helm.release_name, "karpenter") - enabled = true - chart = try(var.helm.chart_name, "karpenter") - repository = try(var.helm.repository, "oci://public.ecr.aws/karpenter") - chart_version = try(var.helm.chart_version, "1.0.6") - namespace = try(var.helm.namespace, "karpenter") + name = try(var.helm.release_name, "karpenter") + enabled = true + chart = try(var.helm.chart_name, "karpenter") + repository = try(var.helm.repository, "oci://public.ecr.aws/karpenter") + chart_version = try(var.helm.chart_version, "1.0.6") + namespace = try(var.helm.namespace, "karpenter") + allocatable_pod_ips = try(var.helm.allocatable_pod_ips, 110) } karpenter_values = < Date: Thu, 8 May 2025 21:42:14 +0300 Subject: [PATCH 2/3] add istio egress gateway to helm release;add sec group for cluster api -> node;add rules to netpol istio ns --- terraform/modules/aws-eks/main.tf | 8 ++ terraform/modules/k8s-addons/eks-istio.tf | 106 ++++++++++++++++-- .../k8s-addons/eks-kube-prometheus-stack.tf | 10 +- .../modules/k8s-addons/eks-loki-stack.tf | 11 +- .../modules/k8s-addons/helm-releases.yaml | 5 +- .../demo/k8s-addons/.terraform.lock.hcl | 45 +++++--- 6 files changed, 159 insertions(+), 26 deletions(-) diff --git a/terraform/modules/aws-eks/main.tf b/terraform/modules/aws-eks/main.tf index f36ba11..a21f960 100644 --- a/terraform/modules/aws-eks/main.tf +++ b/terraform/modules/aws-eks/main.tf @@ -57,6 +57,14 @@ module "eks" { type = "ingress" self = true } + ingress_allow_all_traffic_cluster_api = { + description = "Allow all traffic from Cluster API" + protocol = "all" + from_port = 0 + to_port = 0 + type = "ingress" + source_security_group_id = module.eks.cluster_security_group_id + } } self_managed_node_group_defaults = { diff --git a/terraform/modules/k8s-addons/eks-istio.tf b/terraform/modules/k8s-addons/eks-istio.tf index ce1d966..d8a5c5c 100644 --- a/terraform/modules/k8s-addons/eks-istio.tf +++ b/terraform/modules/k8s-addons/eks-istio.tf @@ -1,11 +1,12 @@ locals { istio = { - name = local.helm_releases[index(local.helm_releases.*.id, "istio")].id - enabled = local.helm_releases[index(local.helm_releases.*.id, "istio")].enabled - chart = local.helm_releases[index(local.helm_releases.*.id, "istio")].chart - repository = local.helm_releases[index(local.helm_releases.*.id, "istio")].repository - chart_version = local.helm_releases[index(local.helm_releases.*.id, "istio")].chart_version - namespace = local.helm_releases[index(local.helm_releases.*.id, "istio")].namespace + name = local.helm_releases[index(local.helm_releases.*.id, "istio")].id + enabled = local.helm_releases[index(local.helm_releases.*.id, "istio")].enabled + chart = local.helm_releases[index(local.helm_releases.*.id, "istio")].chart + repository = local.helm_releases[index(local.helm_releases.*.id, "istio")].repository + chart_version = local.helm_releases[index(local.helm_releases.*.id, "istio")].chart_version + namespace = local.helm_releases[index(local.helm_releases.*.id, "istio")].namespace + egress_gateway_enabled = local.helm_releases[index(local.helm_releases.*.id, "istio")].egress_gateway_enabled } kiali_server = { name = local.helm_releases[index(local.helm_releases.*.id, "kiali")].id @@ -19,8 +20,8 @@ locals { pilot: resources: requests: - cpu: "500m" - memory: "2Gi" + cpu: "100m" + memory: "500Mi" limits: cpu: "500m" memory: "2Gi" @@ -32,6 +33,10 @@ global: autoInject: enabled excludeIPRanges: "169.254.169.254/32" holdApplicationUntilProxyStarts: true +meshConfig: + outboundTrafficPolicy: + mode: REGISTRY_ONLY # Deny traffic to outside hosts by default(Only hosts defined by Istio crds) + accessLogFile: /dev/stdout # Add trace logs to istiod components(istiod pod, sidecar) VALUES kiali_server_prometheus_endpoint = local.victoria_metrics_k8s_stack.enabled ? "http://vmsingle-${local.victoria_metrics_k8s_stack.name}.${local.victoria_metrics_k8s_stack.namespace}:8429" : "http://${local.kube_prometheus_stack.name}-prometheus.${local.kube_prometheus_stack.namespace}:9090" kiali_server_grafana_endpoint = local.victoria_metrics_k8s_stack.enabled ? "http://${local.victoria_metrics_k8s_stack.name}-grafana.${local.victoria_metrics_k8s_stack.namespace}" : "http://${local.kube_prometheus_stack.name}-grafana.${local.kube_prometheus_stack.namespace}" @@ -93,6 +98,37 @@ spec: - path: /stats/prometheus targetPort: http-envoy-prom interval: 15s +VALUES + istio_egress_gateway_values = < Date: Thu, 15 May 2025 16:05:03 +0300 Subject: [PATCH 3/3] change namespace for istio-egressgateway --- terragrunt/.terragrunt-version | 2 +- .../demo/k8s-addons/.terraform.lock.hcl | 19 ------------------- 2 files changed, 1 insertion(+), 20 deletions(-) diff --git a/terragrunt/.terragrunt-version b/terragrunt/.terragrunt-version index 0d816f8..534b316 100644 --- a/terragrunt/.terragrunt-version +++ b/terragrunt/.terragrunt-version @@ -1 +1 @@ -0.58.5 +0.70.0 diff --git a/terragrunt/ACCOUNT_ID/us-east-1/demo/k8s-addons/.terraform.lock.hcl b/terragrunt/ACCOUNT_ID/us-east-1/demo/k8s-addons/.terraform.lock.hcl index bfb7646..010cee0 100644 --- a/terragrunt/ACCOUNT_ID/us-east-1/demo/k8s-addons/.terraform.lock.hcl +++ b/terragrunt/ACCOUNT_ID/us-east-1/demo/k8s-addons/.terraform.lock.hcl @@ -126,25 +126,6 @@ provider "registry.terraform.io/hashicorp/kubernetes" { ] } -provider "registry.terraform.io/hashicorp/null" { - version = "3.2.4" - hashes = [ - "h1:hkf5w5B6q8e2A42ND2CjAvgvSN3puAosDmOJb3zCVQM=", - "zh:59f6b52ab4ff35739647f9509ee6d93d7c032985d9f8c6237d1f8a59471bbbe2", - "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", - "zh:795c897119ff082133150121d39ff26cb5f89a730a2c8c26f3a9c1abf81a9c43", - "zh:7b9c7b16f118fbc2b05a983817b8ce2f86df125857966ad356353baf4bff5c0a", - "zh:85e33ab43e0e1726e5f97a874b8e24820b6565ff8076523cc2922ba671492991", - "zh:9d32ac3619cfc93eb3c4f423492a8e0f79db05fec58e449dee9b2d5873d5f69f", - "zh:9e15c3c9dd8e0d1e3731841d44c34571b6c97f5b95e8296a45318b94e5287a6e", - "zh:b4c2ab35d1b7696c30b64bf2c0f3a62329107bd1a9121ce70683dec58af19615", - "zh:c43723e8cc65bcdf5e0c92581dcbbdcbdcf18b8d2037406a5f2033b1e22de442", - "zh:ceb5495d9c31bfb299d246ab333f08c7fb0d67a4f82681fbf47f2a21c3e11ab5", - "zh:e171026b3659305c558d9804062762d168f50ba02b88b231d20ec99578a6233f", - "zh:ed0fe2acdb61330b01841fa790be00ec6beaac91d41f311fb8254f74eb6a711f", - ] -} - provider "registry.terraform.io/hashicorp/random" { version = "3.7.2" hashes = [