Main.tF

data "aws_availability_zones" "available" {

  filter {

    name   = "opt-in-status"

    values = ["opt-in-not-required"]

  }

}

 

locals {

  azs = slice(data.aws_availability_zones.available.names, 0, 3)

 

  tags = {

    Project   = var.cluster_name

    ManagedBy = "terraform"

  }

}

 

################################################################################

# VPC

################################################################################

 

module "vpc" {

  source  = "terraform-aws-modules/vpc/aws"

  version = "~> 5.0"

 

  name = "${var.cluster_name}-vpc"

  cidr = var.vpc_cidr

 

  azs             = local.azs

  private_subnets = [for k, v in local.azs : cidrsubnet(var.vpc_cidr, 4, k)]

  public_subnets  = [for k, v in local.azs : cidrsubnet(var.vpc_cidr, 8, k + 48)]

 

  enable_nat_gateway = true

  single_nat_gateway = true # one NAT = cheaper; use one per AZ for production

 

  # Tags EKS Auto Mode uses to place load balancers

  public_subnet_tags = {

    "kubernetes.io/role/elb" = 1

  }

  private_subnet_tags = {

    "kubernetes.io/role/internal-elb" = 1

  }

 

  tags = local.tags

}

 

################################################################################

# EKS cluster with Auto Mode

################################################################################

 

module "eks" {

  source  = "terraform-aws-modules/eks/aws"

  version = "~> 20.37"

 

  cluster_name    = var.cluster_name

  cluster_version = var.kubernetes_version

 

  # Public endpoint so you can reach it from your laptop; lock this down for production

  cluster_endpoint_public_access = true

 

  # Gives the identity running terraform admin access in the cluster

  enable_cluster_creator_admin_permissions = true

 

  # This block turns on EKS Auto Mode (compute + storage + load balancing managed by AWS)

  cluster_compute_config = {

    enabled    = true

    node_pools = ["general-purpose", "system"]

  }

 

  # Lets the IAM identity you use in the AWS console see pods/node pools in the EKS console

  access_entries = var.console_principal_arn == "" ? {} : {

    console_admin = {

      principal_arn = var.console_principal_arn

      policy_associations = {

        admin = {

          policy_arn   = "arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy"

          access_scope = { type = "cluster" }

        }

      }

    }

  }

 

  vpc_id     = module.vpc.vpc_id

  subnet_ids = module.vpc.private_subnets

 

  tags = local.tags

}