Skip to main content
Latest Documentation
This is the latest documentation for the Cloud Posse Reference Architecture. To determine which version you're currently using, please see Version Identification.
Version: Latest
Sponsor @cloudposse

cluster

This component is responsible for provisioning an end-to-end EKS Cluster, including managed node groups and Fargate profiles.

note

Windows not supported​

This component has not been tested with Windows worker nodes of any launch type. Although upstream modules support Windows nodes, there are likely issues around incorrect or insufficient IAM permissions or other configuration that would need to be resolved for this component to properly configure the upstream modules for Windows nodes. If you need Windows nodes, please experiment and be on the lookout for issues, and then report any issues to Cloud Posse.

Usage​

Stack Level: Regional

Here's an example snippet for how to use this component.

This example expects the Cloud Posse Reference Architecture Identity and Network designs deployed for mapping users to EKS service roles and granting access in a private network. In addition, this example has the GitHub OIDC integration added and makes use of Karpenter to dynamically scale cluster nodes.

For more on these requirements, see Identity Reference Architecture, Network Reference Architecture, the GitHub OIDC component, and the Karpenter component.

Mixin pattern for Kubernetes version​

We recommend separating out the Kubernetes and related addons versions into a separate mixin (one per Kubernetes minor version), to make it easier to run different versions in different environments, for example while testing a new version.

We also recommend leaving "resolve conflicts" settings unset and therefore using the default "OVERWRITE" setting because any custom configuration that you would want to preserve should be managed by Terraform configuring the add-ons directly.

For example, create catalog/eks/cluster/mixins/k8s-1-29.yaml with the following content:

components:
  terraform:
    eks/cluster:
      vars:
        cluster_kubernetes_version: "1.29"

        # You can set all the add-on versions to `null` to use the latest version,
        # but that introduces drift as new versions are released. As usual, we recommend
        # pinning the versions to a specific version and upgrading when convenient.

        # Determine the latest version of the EKS add-ons for the specified Kubernetes version
        #  EKS_K8S_VERSION=1.29 # replace with your cluster version
        #  ADD_ON=vpc-cni # replace with the add-on name
        #  echo "${ADD_ON}:" && aws eks describe-addon-versions --kubernetes-version $EKS_K8S_VERSION --addon-name $ADD_ON \
        #  --query 'addons[].addonVersions[].{Version: addonVersion, Defaultversion: compatibilities[0].defaultVersion}' --output table

        # To see versions for all the add-ons, wrap the above command in a for loop:
        #   for ADD_ON in vpc-cni kube-proxy coredns aws-ebs-csi-driver aws-efs-csi-driver; do
        #     echo "${ADD_ON}:" && aws eks describe-addon-versions --kubernetes-version $EKS_K8S_VERSION --addon-name $ADD_ON \
        #     --query 'addons[].addonVersions[].{Version: addonVersion, Defaultversion: compatibilities[0].defaultVersion}' --output table
        #   done

        # To see the custom configuration schema for an add-on, run the following command:
        #   aws eks describe-addon-configuration --addon-name aws-ebs-csi-driver \
        #   --addon-version v1.20.0-eksbuild.1 | jq '.configurationSchema | fromjson'
        # See the `coredns` configuration below for an example of how to set a custom configuration.

        # https://docs.aws.amazon.com/eks/latest/userguide/eks-add-ons.html
        # https://docs.aws.amazon.com/eks/latest/userguide/managing-add-ons.html#creating-an-add-on
        addons:
          # https://docs.aws.amazon.com/eks/latest/userguide/cni-iam-role.html
          # https://docs.aws.amazon.com/eks/latest/userguide/managing-vpc-cni.html
          # https://docs.aws.amazon.com/eks/latest/userguide/cni-iam-role.html#cni-iam-role-create-role
          # https://aws.github.io/aws-eks-best-practices/networking/vpc-cni/#deploy-vpc-cni-managed-add-on
          vpc-cni:
            addon_version: "v1.16.0-eksbuild.1" # set `addon_version` to `null` to use the latest version
          # https://docs.aws.amazon.com/eks/latest/userguide/managing-kube-proxy.html
          kube-proxy:
            addon_version: "v1.29.0-eksbuild.1" # set `addon_version` to `null` to use the latest version
          # https://docs.aws.amazon.com/eks/latest/userguide/managing-coredns.html
          coredns:
            addon_version: "v1.11.1-eksbuild.4" # set `addon_version` to `null` to use the latest version
            ## override default replica count of 2. In very large clusters, you may want to increase this.
            configuration_values: '{"replicaCount": 3}'

          # https://docs.aws.amazon.com/eks/latest/userguide/csi-iam-role.html
          # https://aws.amazon.com/blogs/containers/amazon-ebs-csi-driver-is-now-generally-available-in-amazon-eks-add-ons
          # https://docs.aws.amazon.com/eks/latest/userguide/managing-ebs-csi.html#csi-iam-role
          # https://github.com/kubernetes-sigs/aws-ebs-csi-driver
          aws-ebs-csi-driver:
            addon_version: "v1.27.0-eksbuild.1" # set `addon_version` to `null` to use the latest version
            # If you are not using [volume snapshots](https://kubernetes.io/blog/2020/12/10/kubernetes-1.20-volume-snapshot-moves-to-ga/#how-to-use-volume-snapshots)
            # (and you probably are not), disable the EBS Snapshotter
            # See https://github.com/aws/containers-roadmap/issues/1919
            configuration_values: '{"sidecars":{"snapshotter":{"forceEnable":false}}}'

          aws-efs-csi-driver:
            addon_version: "v1.7.7-eksbuild.1" # set `addon_version` to `null` to use the latest version
            # Set a short timeout in case of conflict with an existing efs-controller deployment
            create_timeout: "7m"

Common settings for all Kubernetes versions​

In your main stack configuration, you can then set the Kubernetes version by importing the appropriate mixin:

#
import:
  - catalog/eks/cluster/mixins/k8s-1-29

components:
  terraform:
    eks/cluster:
      vars:
        enabled: true
        name: eks
        vpc_component_name: "vpc"
        eks_component_name: "eks/cluster"

        # Your choice of availability zones or availability zone ids
        # availability_zones: ["us-east-1a", "us-east-1b", "us-east-1c"]
        aws_ssm_agent_enabled: true
        allow_ingress_from_vpc_accounts:
          - tenant: core
            stage: auto
          - tenant: core
            stage: corp
          - tenant: core
            stage: network

        public_access_cidrs: []
        allowed_cidr_blocks: []
        allowed_security_groups: []

        enabled_cluster_log_types:
          # Caution: enabling `api` log events may lead to a substantial increase in Cloudwatch Logs expenses.
          - api
          - audit
          - authenticator
          - controllerManager
          - scheduler

        oidc_provider_enabled: true

        # Allows GitHub OIDC role
        github_actions_iam_role_enabled: true
        github_actions_iam_role_attributes: ["eks"]
        github_actions_allowed_repos:
          - acme/infra

        # We recommend, at a minimum, deploying 1 managed node group,
        # with the same number of instances as availability zones (typically 3).
        managed_node_groups_enabled: true
        node_groups: # for most attributes, setting null here means use setting from node_group_defaults
          main:
            # availability_zones = null will create one autoscaling group
            # in every private subnet in the VPC
            availability_zones: null

            # Tune the desired and minimum group size according to your baseload requirements.
            # We recommend no autoscaling for the main node group, so it will
            # stay at the specified desired group size, with additional
            # capacity provided by Karpenter. Nevertheless, we recommend
            # deploying enough capacity in the node group to handle your
            # baseload requirements, and in production, we recommend you
            # have a large enough node group to handle 3/2 (1.5) times your
            # baseload requirements, to handle the loss of a single AZ.
            desired_group_size: 3 # number of instances to start with, should be >= number of AZs
            min_group_size: 3 # must be  >= number of AZs
            max_group_size: 3

            # Can only set one of ami_release_version or kubernetes_version
            # Leave both null to use latest AMI for Cluster Kubernetes version
            kubernetes_version: null # use cluster Kubernetes version
            ami_release_version: null # use latest AMI for Kubernetes version

            attributes: []
            create_before_destroy: true
            cluster_autoscaler_enabled: true
            instance_types:
              # Tune the instance type according to your baseload requirements.
              - c7a.medium
            ami_type: AL2_x86_64 # use "AL2_x86_64" for standard instances, "AL2_x86_64_GPU" for GPU instances
            node_userdata:
              # WARNING: node_userdata is alpha status and will likely change in the future.
              #          Also, it is only supported for AL2 and some Windows AMIs, not BottleRocket or AL2023.
              # Kubernetes docs: https://kubernetes.io/docs/tasks/administer-cluster/reserve-compute-resources/
              kubelet_extra_args: >-
                --kube-reserved cpu=100m,memory=0.6Gi,ephemeral-storage=1Gi --system-reserved
                cpu=100m,memory=0.2Gi,ephemeral-storage=1Gi --eviction-hard
                memory.available<200Mi,nodefs.available<10%,imagefs.available<15%
            block_device_map:
              # EBS volume for local ephemeral storage
              # IGNORED if legacy `disk_encryption_enabled` or `disk_size` are set!
              # Use "/dev/xvda" for most of the instances (without local NVMe)
              # using most of the Linuxes, "/dev/xvdb" for BottleRocket
              "/dev/xvda":
                ebs:
                  volume_size: 100 # number of GB
                  volume_type: gp3

            kubernetes_labels: {}
            kubernetes_taints: {}
            resources_to_tag:
              - instance
              - volume
            tags: null

        # The abbreviation method used for Availability Zones in your project.
        # Used for naming resources in managed node groups.
        # Either "short" or "fixed".
        availability_zone_abbreviation_type: fixed

        cluster_private_subnets_only: true
        cluster_encryption_config_enabled: true
        cluster_endpoint_private_access: true
        cluster_endpoint_public_access: false
        cluster_log_retention_period: 90

        # List of `aws-team-roles` (in the account where the EKS cluster is deployed) to map to Kubernetes RBAC groups
        # You cannot set `system:*` groups here, except for `system:masters`.
        # The `idp:*` roles referenced here are created by the `eks/idp-roles` component.
        # While set here, the `idp:*` roles will have no effect until after
        # the `eks/idp-roles` component is applied, which must be after the
        # `eks/cluster` component is deployed.
        aws_team_roles_rbac:
          - aws_team_role: admin
            groups:
              - system:masters
          - aws_team_role: poweruser
            groups:
              - idp:poweruser
          - aws_team_role: observer
            groups:
              - idp:observer
          - aws_team_role: planner
            groups:
              - idp:observer
          - aws_team_role: terraform
            groups:
              - system:masters

        # Permission sets from AWS SSO allowing cluster access
        # See `aws-sso` component.
        aws_sso_permission_sets_rbac:
          - aws_sso_permission_set: PowerUserAccess
            groups:
              - idp:poweruser

        # Set to false if you are not using Karpenter
        karpenter_iam_role_enabled: true

        # All Fargate Profiles will use the same IAM Role when `legacy_fargate_1_role_per_profile_enabled` is set to false.
        # Recommended for all new clusters, but will damage existing clusters provisioned with the legacy component.
        legacy_fargate_1_role_per_profile_enabled: false
        # While it is possible to deploy add-ons to Fargate Profiles, it is not recommended. Use a managed node group instead.
        deploy_addons_to_fargate: false

EKS Auto Mode​

EKS Auto Mode (GA December 2024) delegates compute, networking, and storage management to AWS. When enabled, AWS manages:

  • Compute -- Node provisioning via managed Karpenter (replaces self-managed Karpenter and managed node groups)
  • Networking -- Elastic load balancing for Services and Ingress (replaces self-managed ALB controller)
  • Storage -- EBS block storage via ebs.csi.eks.amazonaws.com provisioner (replaces self-managed EBS CSI driver)

Auto Mode also manages the vpc-cni, kube-proxy, coredns, and aws-ebs-csi-driver add-ons automatically.

Greenfield (new cluster) with Auto Mode​

Create a mixin at catalog/eks/cluster/mixins/auto-mode.yaml:

components:
  terraform:
    eks/cluster:
      vars:
        # Enable EKS Auto Mode
        auto_mode_enabled: true
        auto_mode_node_pools:
          - general-purpose
          - system

        # Disable self-managed compute -- Auto Mode handles it
        managed_node_groups_enabled: false
        node_groups: {}
        karpenter_iam_role_enabled: false
        fargate_profiles: {}

        # Remove addons managed by Auto Mode.
        # Only aws-efs-csi-driver remains (not managed by Auto Mode).
        addons:
          aws-efs-csi-driver:
            addon_version: null # use latest compatible

        addons_depends_on: false

Import it in your stack configuration after your Kubernetes version mixin:

import:
  - catalog/eks/cluster/mixins/k8s-1-31
  - catalog/eks/cluster/mixins/auto-mode

When using Auto Mode, do not deploy the following components:

  • eks/karpenter -- Auto Mode includes managed Karpenter
  • eks/alb-controller -- Auto Mode includes elastic load balancing
  • eks/karpenter-node-pool -- Use Auto Mode's built-in general-purpose and system node pools (custom NodePools can still be created, but use the eks.amazonaws.com/v1 NodeClass API)

Cluster version upgrades with Auto Mode​

Auto Mode significantly simplifies Kubernetes version upgrades:

  1. Bump cluster_kubernetes_version in your version mixin (e.g., "1.31" to "1.32")
  2. Apply -- the control plane upgrades in place (~10-15 minutes)
  3. Nodes auto-update -- Auto Mode's managed Karpenter detects version drift and automatically replaces nodes with the new kubelet version. No manual intervention required.
  4. Add-ons auto-update -- vpc-cni, kube-proxy, coredns, and aws-ebs-csi-driver are automatically upgraded to compatible versions as part of the control plane upgrade.
  5. Non-Auto-Mode add-ons (e.g., aws-efs-csi-driver) still need manual version bumps.

Ensure workloads have PodDisruptionBudgets for graceful node replacement during the rolling update.

For brownfield migration from an existing cluster, see UPGRADING.md.

Important Auto Mode limitations​

  • Bottlerocket only -- Auto Mode nodes run Bottlerocket. Custom AMIs (AL2, Ubuntu, Windows) are not supported.
  • No SSH/IMDS -- Auto Mode nodes are immutable with no SSH or instance metadata access.
  • 21-day max node lifetime -- Nodes are automatically replaced within 21 days. Workloads must tolerate rotation.
  • EBS provisioner change -- Auto Mode uses ebs.csi.eks.amazonaws.com (not ebs.csi.aws.com). PVCs created by one provisioner cannot mount on nodes managed by the other.
  • CoreDNS runs as a systemd service -- Custom CoreDNS ConfigMaps will not work on Auto Mode nodes.

EKS Capabilities​

EKS Capabilities allow you to enable AWS-managed operational software directly on your cluster. Supported capability types:

  • ARGOCD -- Managed Argo CD for GitOps continuous delivery
  • ACK -- AWS Controllers for Kubernetes, enabling management of AWS resources via Kubernetes custom resources
  • KRO -- Kube Resource Orchestrator for composing Kubernetes resources

Each capability requires an IAM role. You can either provide your own via role_arn or let the component create one automatically. Auto-created roles use a trust policy for capabilities.eks.amazonaws.com and can have additional IAM policies attached via iam_policy_arns.

Argo CD capability​

note

The managed Argo CD capability requires aws-sso (IAM Identity Center) v3.0.2 or later for RBAC role mapping and the group_map output used in the Atmos !terraform.state example below.

components:
  terraform:
    eks/cluster:
      vars:
        capabilities:
          argocd:
            type: ARGOCD
            configuration:
              argo_cd:
                namespace: argocd
                aws_idc:
                  idc_instance_arn: "arn:aws:sso:::instance/ssoins-1234567890abcdef"
                  # idc_region: null  # defaults to cluster region
                rbac_role_mapping:
                  - role: ADMIN
                    identity:
                      - id: "12345678-1234-1234-1234-123456789012" # SSO group ID
                        type: SSO_GROUP
                  - role: VIEWER
                    identity:
                      - id: "87654321-4321-4321-4321-210987654321"
                        type: SSO_GROUP

When using Atmos, you can use !terraform.state lookups to resolve the SSO instance ARN and group IDs dynamically from the aws-sso component outputs instead of hardcoding them:

components:
  terraform:
    eks/cluster:
      vars:
        capabilities:
          argocd:
            type: ARGOCD
            configuration:
              argo_cd:
                namespace: argocd
                aws_idc:
                  idc_instance_arn: !terraform.state aws-sso core-gbl-root ssoadmin_instance_arn
                rbac_role_mapping:
                  - role: ADMIN
                    identity:
                      - id: !terraform.state aws-sso core-gbl-root group_map["Managers"]
                        type: SSO_GROUP

ACK capability​

components:
  terraform:
    eks/cluster:
      vars:
        capabilities:
          ack-s3:
            type: ACK
            iam_policy_arns:
              - "arn:aws:iam::aws:policy/AmazonS3FullAccess"

KRO capability​

components:
  terraform:
    eks/cluster:
      vars:
        capabilities:
          kro:
            type: KRO

Combining multiple capabilities​

Multiple capabilities can be enabled simultaneously:

components:
  terraform:
    eks/cluster:
      vars:
        capabilities:
          argocd:
            type: ARGOCD
            configuration:
              argo_cd:
                namespace: argocd
                aws_idc:
                  idc_instance_arn: "arn:aws:sso:::instance/ssoins-1234567890abcdef"
                rbac_role_mapping:
                  - role: ADMIN
                    identity:
                      - id: "12345678-1234-1234-1234-123456789012"
                        type: SSO_GROUP
          ack-s3:
            type: ACK
            iam_policy_arns:
              - "arn:aws:iam::aws:policy/AmazonS3FullAccess"
          kro:
            type: KRO

The component outputs capabilities (map of enabled capabilities with ARNs and types) and capability_role_arns (map of auto-created IAM role ARNs) for use by downstream components.

Amazon EKS End-of-Life Dates​

When picking a Kubernetes version, be sure to review the end-of-life dates for Amazon EKS. Refer to the chart below:

cyclereleaselatestlatest releaseeolextended support
1.292024-01-231.29-eks-62024-04-182025-03-232026-03-23
1.282023-09-261.28-eks-122024-04-182024-11-262025-11-26
1.272023-05-241.27-eks-162024-04-182024-07-242025-07-24
1.262023-04-111.26-eks-172024-04-182024-06-112025-06-11
1.252023-02-211.25-eks-182024-04-182024-05-012025-05-01
1.242022-11-151.24-eks-212024-04-182024-01-312025-01-31
1.232022-08-111.23-eks-232024-04-182023-10-112024-10-11
1.222022-04-041.22-eks-142023-06-302023-06-042024-09-01
1.212021-07-191.21-eks-182023-06-092023-02-162024-07-15
1.202021-05-181.20-eks-142023-05-052022-11-01False
1.192021-02-161.19-eks-112022-08-152022-08-01False
1.182020-10-131.18-eks-132022-08-152022-08-15False

* This Chart was generated 2024-05-12 with the eol tool. Install it with python3 -m pip install --upgrade norwegianblue and create a new table by running eol --md amazon-eks locally, or view the information by visiting the endoflife website.

You can also view the release and support timeline for the Kubernetes project itself.

Using Addons​

EKS clusters support “Addons” that can be automatically installed on a cluster. Install these addons with the var.addons input.

tip

Run the following command to see all available addons, their type, and their publisher. You can also see the URL for addons that are available through the AWS Marketplace. Replace 1.27 with the version of your cluster. See Creating an addon for more details.

EKS_K8S_VERSION=1.29 # replace with your cluster version
aws eks describe-addon-versions --kubernetes-version $EKS_K8S_VERSION \
  --query 'addons[].{MarketplaceProductUrl: marketplaceInformation.productUrl, Name: addonName, Owner: owner Publisher: publisher, Type: type}' --output table
tip

You can see which versions are available for each addon by executing the following commands. Replace 1.29 with the version of your cluster.

EKS_K8S_VERSION=1.29 # replace with your cluster version
echo "vpc-cni:" && aws eks describe-addon-versions --kubernetes-version $EKS_K8S_VERSION --addon-name vpc-cni \
  --query 'addons[].addonVersions[].{Version: addonVersion, Defaultversion: compatibilities[0].defaultVersion}' --output table

echo "kube-proxy:" && aws eks describe-addon-versions --kubernetes-version $EKS_K8S_VERSION --addon-name kube-proxy \
  --query 'addons[].addonVersions[].{Version: addonVersion, Defaultversion: compatibilities[0].defaultVersion}' --output table

echo "coredns:" && aws eks describe-addon-versions --kubernetes-version $EKS_K8S_VERSION --addon-name coredns \
  --query 'addons[].addonVersions[].{Version: addonVersion, Defaultversion: compatibilities[0].defaultVersion}' --output table

echo "aws-ebs-csi-driver:" && aws eks describe-addon-versions --kubernetes-version $EKS_K8S_VERSION --addon-name aws-ebs-csi-driver \
  --query 'addons[].addonVersions[].{Version: addonVersion, Defaultversion: compatibilities[0].defaultVersion}' --output table

echo "aws-efs-csi-driver:" && aws eks describe-addon-versions --kubernetes-version $EKS_K8S_VERSION --addon-name aws-efs-csi-driver \
  --query 'addons[].addonVersions[].{Version: addonVersion, Defaultversion: compatibilities[0].defaultVersion}' --output table

Some add-ons accept additional configuration. For example, the vpc-cni addon accepts a disableNetworking parameter. View the available configuration options (as JSON Schema) via the aws eks describe-addon-configuration command. For example:

aws eks describe-addon-configuration \
  --addon-name aws-ebs-csi-driver \
  --addon-version v1.20.0-eksbuild.1 | jq '.configurationSchema | fromjson'

You can then configure the add-on via the configuration_values input. For example:

aws-ebs-csi-driver:
  configuration_values: '{"node": {"loggingFormat": "json"}}'

Configure the addons like the following example:

# https://docs.aws.amazon.com/eks/latest/userguide/eks-add-ons.html
# https://docs.aws.amazon.com/eks/latest/userguide/managing-add-ons.html#creating-an-add-on
# https://aws.amazon.com/blogs/containers/amazon-eks-add-ons-advanced-configuration/
addons:
  # https://docs.aws.amazon.com/eks/latest/userguide/cni-iam-role.html
  # https://docs.aws.amazon.com/eks/latest/userguide/managing-vpc-cni.html
  # https://docs.aws.amazon.com/eks/latest/userguide/cni-iam-role.html#cni-iam-role-create-role
  # https://aws.github.io/aws-eks-best-practices/networking/vpc-cni/#deploy-vpc-cni-managed-add-on
  vpc-cni:
    addon_version: "v1.12.2-eksbuild.1" # set `addon_version` to `null` to use the latest version
  # https://docs.aws.amazon.com/eks/latest/userguide/managing-kube-proxy.html
  kube-proxy:
    addon_version: "v1.25.6-eksbuild.1" # set `addon_version` to `null` to use the latest version
  # https://docs.aws.amazon.com/eks/latest/userguide/managing-coredns.html
  coredns:
    addon_version: "v1.9.3-eksbuild.2" # set `addon_version` to `null` to use the latest version
    # Override default replica count of 2, to have one in each AZ
    configuration_values: '{"replicaCount": 3}'
  # https://docs.aws.amazon.com/eks/latest/userguide/csi-iam-role.html
  # https://aws.amazon.com/blogs/containers/amazon-ebs-csi-driver-is-now-generally-available-in-amazon-eks-add-ons
  # https://docs.aws.amazon.com/eks/latest/userguide/managing-ebs-csi.html#csi-iam-role
  # https://github.com/kubernetes-sigs/aws-ebs-csi-driver
  aws-ebs-csi-driver:
    addon_version: "v1.19.0-eksbuild.2" # set `addon_version` to `null` to use the latest version
    # If you are not using [volume snapshots](https://kubernetes.io/blog/2020/12/10/kubernetes-1.20-volume-snapshot-moves-to-ga/#how-to-use-volume-snapshots)
    # (and you probably are not), disable the EBS Snapshotter with:
    configuration_values: '{"sidecars":{"snapshotter":{"forceEnable":false}}}'

Some addons, such as CoreDNS, require at least one node to be fully provisioned first. See issue #170 for more details. Set var.addons_depends_on to true to require the Node Groups to be provisioned before addons.

addons_depends_on: true
addons:
  coredns:
    addon_version: "v1.8.7-eksbuild.1"
warning

Addons may not be suitable for all use-cases! For example, if you are deploying Karpenter to Fargate and using Karpenter to provision all nodes, these nodes will never be available before the cluster component is deployed if you are using the CoreDNS addon (for example).

This is one of the reasons we recommend deploying a managed node group: to ensure that the addons will become fully functional during deployment of the cluster.

For more information on upgrading EKS Addons, see "How to Upgrade EKS Cluster Addons"

Adding and Configuring a new EKS Addon​

The component already supports all the EKS addons shown in the configurations above. To add a new EKS addon, not supported by the cluster, add it to the addons map (addons variable):

addons:
  my-addon:
    addon_version: "..."

If the new addon requires an EKS IAM Role for Kubernetes Service Account, perform the following steps:

  • Add a file addons-custom.tf to the eks/cluster folder if not already present

  • In the file, add an IAM policy document with the permissions required for the addon, and use the eks-iam-role module to provision an IAM Role for Kubernetes Service Account for the addon:

      data "aws_iam_policy_document" "my_addon" {
        statement {
          sid       = "..."
          effect    = "Allow"
          resources = ["..."]

          actions = [
            "...",
            "..."
          ]
        }
      }

      module "my_addon_eks_iam_role" {
        source  = "cloudposse/eks-iam-role/aws"
        version = "2.1.0"

        eks_cluster_oidc_issuer_url = local.eks_cluster_oidc_issuer_url

        service_account_name      = "..."
        service_account_namespace = "..."

        aws_iam_policy_document = [one(data.aws_iam_policy_document.my_addon[*].json)]

        context = module.this.context
      }

    For examples of how to configure the IAM role and IAM permissions for EKS addons, see addons.tf.

  • Add a file additional-addon-support_override.tf to the eks/cluster folder if not already present

  • In the file, add the IAM Role for Kubernetes Service Account for the addon to the overridable_additional_addon_service_account_role_arn_map map:

      locals {
        overridable_additional_addon_service_account_role_arn_map = {
          my-addon = module.my_addon_eks_iam_role.service_account_role_arn
        }
      }

  • This map will override the default map in the additional-addon-support.tf file, and will be merged into the final map together with the default EKS addons vpc-cni and aws-ebs-csi-driver (which this component configures and creates IAM Roles for Kubernetes Service Accounts)

  • Follow the instructions in the additional-addon-support.tf file if the addon may need to be deployed to Fargate, or has dependencies that Terraform cannot detect automatically.

Variables​

Required Variables​

region (string) required

AWS Region

Optional Variables​

access_config optional

Access configuration for the EKS cluster


Type:

object({
authentication_mode                         = optional(string, "API")
bootstrap_cluster_creator_admin_permissions = optional(bool, false)
})

Default value: { }

addons optional

Manages EKS addons resources


Type:

map(object({
enabled       = optional(bool, true)
addon_version = optional(string, null)
# configuration_values is a JSON string, such as '{"computeType": "Fargate"}'.
configuration_values = optional(string, null)
# Set default resolve_conflicts to OVERWRITE because it is required on initial installation of
# add-ons that have self-managed versions installed by default (e.g. vpc-cni, coredns), and
# because any custom configuration that you would want to preserve should be managed by Terraform.
resolve_conflicts_on_create = optional(string, "OVERWRITE")
resolve_conflicts_on_update = optional(string, "OVERWRITE")
service_account_role_arn    = optional(string, null)
create_timeout              = optional(string, null)
update_timeout              = optional(string, null)
delete_timeout              = optional(string, null)
}))

Default value: { }

addons_depends_on (bool) optional

If set true (recommended), all addons will depend on managed node groups provisioned by this component and therefore not be installed until nodes are provisioned.
See issue #170 for more details.



Default value: true

allow_ingress_from_vpc_accounts (any) optional

List of account contexts whose VPC CIDRs should be allowed ingress to the cluster security group.
Each entry identifies an account by tenant/stage/environment and triggers a remote state lookup
to retrieve that account's VPC CIDR.


The optional vpc_cidr field bypasses the remote state lookup for that entry when set,
using the provided value directly instead. This allows deployments that do not have
cross-account remote state access to resolve CIDRs ahead of time (e.g. via Atmos
!terraform.state functions in stack YAML). Entries without vpc_cidr continue using
remote state lookups unchanged, so migration can be done one entry at a time.


e.g.


allow_ingress_from_vpc_accounts:

  • tenant: core
    stage: auto
    environment: use2
    vpc_cidr: "10.8.0.0/16" # optional: bypasses remote state when set
  • tenant: core
    stage: network
    environment: use2


Default value: [ ]

allowed_cidr_blocks (list(string)) optional

List of CIDR blocks to be allowed to connect to the EKS cluster


Default value: [ ]

allowed_security_groups (list(string)) optional

List of Security Group IDs to be allowed to connect to the EKS cluster


Default value: [ ]

auto_mode_enabled (bool) optional

Enable EKS Auto Mode. When enabled, AWS manages compute (via managed Karpenter),
networking (elastic load balancing), and storage (EBS block storage) for the cluster.
Requires Kubernetes 1.29+ and AWS provider >= 5.79.0.
Cannot be used with karpenter_iam_role_enabled = true (Auto Mode includes managed Karpenter).
When enabled, the addons vpc-cni, kube-proxy, coredns, and aws-ebs-csi-driver are
managed by Auto Mode and should be removed from the addons variable (or use auto_mode_upgrade
for brownfield migration).



Default value: false

auto_mode_node_pools (list(string)) optional

Built-in node pools for EKS Auto Mode. Valid values are "general-purpose" and "system".
Only used when auto_mode_enabled is true.



Default value:

[
  "general-purpose",
  "system"
]
auto_mode_node_role_arn (string) optional

ARN of an existing IAM role for Auto Mode nodes. If not provided and auto_mode_enabled
is true, a role will be created automatically with AmazonEKSWorkerNodeMinimalPolicy
and AmazonEC2ContainerRegistryPullOnly policies.



Default value: null

auto_mode_upgrade (bool) optional

Brownfield migration flag for Auto Mode. When true and auto_mode_enabled is true,
the addons managed by Auto Mode (vpc-cni, kube-proxy, coredns, aws-ebs-csi-driver)
are silently filtered from the addons map so they are removed in the same apply that enables
Auto Mode. When false (default), an error is raised if those addons are still present,
enforcing a clean configuration for greenfield deployments and post-migration steady state.



Default value: false

availability_zone_abbreviation_type (string) optional

Type of Availability Zone abbreviation (either fixed or short) to use in names. See https://github.com/cloudposse/terraform-aws-utils for details.


Default value: "fixed"

availability_zone_ids (list(string)) optional

List of Availability Zones IDs where subnets will be created. Overrides availability_zones.
Can be the full name, e.g. use1-az1, or just the part after the AZ ID region code, e.g. -az1,
to allow reusable values across regions. Consider contention for resources and spot pricing in each AZ when selecting.
Useful in some regions when using only some AZs and you want to use the same ones across multiple accounts.



Default value: [ ]

availability_zones (list(string)) optional

AWS Availability Zones in which to deploy multi-AZ resources.
Ignored if availability_zone_ids is set.
Can be the full name, e.g. us-east-1a, or just the part after the region, e.g. a to allow reusable values across regions.
If not provided, resources will be provisioned in every zone with a private subnet in the VPC.



Default value: [ ]

aws_ssm_agent_enabled (bool) optional

Set true to attach the required IAM policy for AWS SSM agent to each EC2 instance's IAM Role


Default value: false

aws_sso_permission_sets_rbac optional

(Not Recommended): AWS SSO (IAM Identity Center) permission sets in the EKS deployment account to add to aws-auth ConfigMap.
Unfortunately, aws-auth ConfigMap does not support SSO permission sets, so we map the generated
IAM Role ARN corresponding to the permission set at the time Terraform runs. This is subject to change
when any changes are made to the AWS SSO configuration, invalidating the mapping, and requiring a
terraform apply in this project to update the aws-auth ConfigMap and restore access.



Type:

list(object({
aws_sso_permission_set = string
groups                 = list(string)
}))

Default value: [ ]

aws_team_roles_rbac optional

List of aws-team-roles (in the target AWS account) to map to Kubernetes RBAC groups.


Type:

list(object({
aws_team_role = string
groups        = list(string)
}))

Default value: [ ]

capabilities optional

Map of EKS Capabilities to enable on the cluster. Each key is the capability
name (must be unique within the cluster). Supported types: ACK, ARGOCD, KRO.


When role_arn is null, an IAM role is automatically created with a trust
policy for capabilities.eks.amazonaws.com. Use iam_policy_arns to attach
additional IAM policies to the auto-created role (e.g., ACK service permissions).



Type:

map(object({
enabled                   = optional(bool, true)
type                      = string # ACK, ARGOCD, KRO
role_arn                  = optional(string, null)
iam_policy_arns           = optional(list(string), [])
delete_propagation_policy = optional(string, "RETAIN")
configuration = optional(object({
  argo_cd = optional(object({
    namespace = optional(string, "argocd")
    aws_idc = optional(object({
      idc_instance_arn = string
      idc_region       = optional(string, null)
    }), null)
    network_access = optional(object({
      vpce_ids = optional(list(string), [])
    }), null)
    rbac_role_mapping = optional(list(object({
      role = string # ADMIN, EDITOR, VIEWER
      identity = list(object({
        id   = string
        type = string # SSO_USER, SSO_GROUP
      }))
    })), [])
  }), null)
}), null)
create_timeout = optional(string, null)
update_timeout = optional(string, null)
delete_timeout = optional(string, null)
}))

Default value: { }

cluster_encryption_config_enabled (bool) optional

Set to true to enable Cluster Encryption Configuration


Default value: true

cluster_encryption_config_kms_key_deletion_window_in_days (number) optional

Cluster Encryption Config KMS Key Resource argument - key deletion windows in days post destruction


Default value: 10

cluster_encryption_config_kms_key_enable_key_rotation (bool) optional

Cluster Encryption Config KMS Key Resource argument - enable kms key rotation


Default value: true

cluster_encryption_config_kms_key_id (string) optional

KMS Key ID to use for cluster encryption config


Default value: ""

cluster_encryption_config_kms_key_policy (string) optional

Cluster Encryption Config KMS Key Resource argument - key policy


Default value: null

cluster_encryption_config_resources (list(string)) optional

Cluster Encryption Config Resources to encrypt, e.g. [&#34;secrets&#34;]


Default value:

[
  "secrets"
]
cluster_endpoint_private_access (bool) optional

Indicates whether or not the Amazon EKS private API server endpoint is enabled. Default to AWS EKS resource and it is false


Default value: false

cluster_endpoint_public_access (bool) optional

Indicates whether or not the Amazon EKS public API server endpoint is enabled. Default to AWS EKS resource and it is true


Default value: true

cluster_kubernetes_version (string) optional

Desired Kubernetes master version. If you do not specify a value, the latest available version is used


Default value: null

cluster_log_retention_period (number) optional

Number of days to retain cluster logs. Requires enabled_cluster_log_types to be set. See https://docs.aws.amazon.com/en_us/eks/latest/userguide/control-plane-logs.html.


Default value: 0

cluster_private_subnets_only (bool) optional

Whether or not to enable private subnets or both public and private subnets


Default value: false

color (string) optional

The cluster stage represented by a color; e.g. blue, green


Default value: ""

deploy_addons_to_fargate (bool) optional

Set to true (not recommended) to deploy addons to Fargate instead of initial node pool


Default value: false

enabled_cluster_log_types (list(string)) optional

A list of the desired control plane logging to enable. For more information, see https://docs.aws.amazon.com/en_us/eks/latest/userguide/control-plane-logs.html. Possible values [api, audit, authenticator, controllerManager, scheduler]


Default value: [ ]

fargate_profile_iam_role_kubernetes_namespace_delimiter (string) optional

Delimiter for the Kubernetes namespace in the IAM Role name for Fargate Profiles


Default value: "-"

fargate_profile_iam_role_permissions_boundary (string) optional

If provided, all Fargate Profiles IAM roles will be created with this permissions boundary attached


Default value: null

fargate_profiles optional

Fargate Profiles config


Type:

map(object({
kubernetes_namespace = string
kubernetes_labels    = map(string)
}))

Default value: { }

karpenter_ecr_public_enabled (bool) optional

Flag to enable/disable ECR Public read-only access for the Karpenter node role. When enabled, attaches a policy granting ecr-public and sts:GetServiceBearerToken permissions to allow authenticated pulls from public.ecr.aws


Default value: false

karpenter_ecr_public_resources (list(string)) optional

List of ECR Public resource ARNs to scope the read-only policy. Use [&#34;*&#34;] for all repositories or specify ARNs to restrict access.


Default value:

[
  "*"
]
karpenter_iam_role_enabled (bool) optional

Flag to enable/disable creation of IAM role for EC2 Instance Profile that is attached to the nodes launched by Karpenter


Default value: false

legacy_do_not_create_karpenter_instance_profile (bool) optional

Obsolete: The issues this was meant to mitigate were fixed in AWS Terraform Provider v5.43.0
and Karpenter v0.33.0. This variable will be removed in a future release.
Remove this input from your configuration and leave it at default.
Old description: When true (the default), suppresses creation of the IAM Instance Profile
for nodes launched by Karpenter, to preserve the legacy behavior of
the eks/karpenter component creating it.
Set to false to enable creation of the IAM Instance Profile, which
ensures that both the role and the instance profile have the same lifecycle,
and avoids AWS Provider issue #32671.
Use in conjunction with eks/karpenter component legacy_create_karpenter_instance_profile.



Default value: true

legacy_fargate_1_role_per_profile_enabled (bool) optional

Set to false for new clusters to create a single Fargate Pod Execution role for the cluster.
Set to true for existing clusters to preserve the old behavior of creating
a Fargate Pod Execution role for each Fargate Profile.



Default value: true

managed_node_groups_enabled (bool) optional

Set false to prevent the creation of EKS managed node groups.


Default value: true

map_additional_iam_roles optional

Additional IAM roles to grant access to the cluster.
WARNING: Full Role ARN, including path, is required for rolearn.
In earlier versions (with aws-auth ConfigMap), only the path
had to be removed from the Role ARN. The path is now required.
username is now ignored. This input is planned to be replaced
in a future release with a more flexible input structure that consolidates
map_additional_iam_roles and map_additional_iam_users.



Type:

list(object({
rolearn  = string
username = optional(string)
groups   = list(string)
}))

Default value: [ ]

map_additional_iam_users optional

Additional IAM roles to grant access to the cluster.
username is now ignored. This input is planned to be replaced
in a future release with a more flexible input structure that consolidates
map_additional_iam_roles and map_additional_iam_users.



Type:

list(object({
userarn  = string
username = optional(string)
groups   = list(string)
}))

Default value: [ ]

map_additional_worker_roles (list(string)) optional

(Deprecated) AWS IAM Role ARNs of unmanaged Linux worker nodes to grant access to the EKS cluster.
In earlier versions, this could be used to grant access to worker nodes of any type
that were not managed by the EKS cluster. Now EKS requires that unmanaged worker nodes
be classified as Linux or Windows servers, in this input is temporarily retained
with the assumption that all worker nodes are Linux servers. (It is likely that
earlier versions did not work properly with Windows worker nodes anyway.)
This input is deprecated and will be removed in a future release.
In the future, this component will either have a way to separate Linux and Windows worker nodes,
or drop support for unmanaged worker nodes entirely.



Default value: [ ]

node_group_defaults optional

Defaults for node groups in the cluster


Type:

object({
ami_release_version        = optional(string, null)
ami_type                   = optional(string, null)
attributes                 = optional(list(string), null)
availability_zones         = optional(list(string)) # set to null to use var.availability_zones
cluster_autoscaler_enabled = optional(bool, null)
create_before_destroy      = optional(bool, null)
desired_group_size         = optional(number, null)
instance_types             = optional(list(string), null)
kubernetes_labels          = optional(map(string), {})
kubernetes_taints = optional(list(object({
  key    = string
  value  = string
  effect = string
})), [])
node_userdata = optional(object({
  before_cluster_joining_userdata = optional(string)
  bootstrap_extra_args            = optional(string)
  kubelet_extra_args              = optional(string)
  after_cluster_joining_userdata  = optional(string)
}), {})
kubernetes_version = optional(string, null) # set to null to use cluster_kubernetes_version
max_group_size     = optional(number, null)
min_group_size     = optional(number, null)
resources_to_tag   = optional(list(string), null)
tags               = optional(map(string), null)

# block_device_map copied from cloudposse/terraform-aws-eks-node-group
# Keep in sync via copy and paste, but make optional
# Most of the time you want "/dev/xvda". For BottleRocket, use "/dev/xvdb".
block_device_map = optional(map(object({
  no_device    = optional(bool, null)
  virtual_name = optional(string, null)
  ebs = optional(object({
    delete_on_termination = optional(bool, true)
    encrypted             = optional(bool, true)
    iops                  = optional(number, null)
    kms_key_id            = optional(string, null)
    snapshot_id           = optional(string, null)
    throughput            = optional(number, null) # for gp3, MiB/s, up to 1000
    volume_size           = optional(number, 50)   # disk  size in GB
    volume_type           = optional(string, "gp3")

    # Catch common camel case typos. These have no effect, they just generate better errors.
    # It would be nice to actually use these, but volumeSize in particular is a number here
    # and in most places it is a string with a unit suffix (e.g. 20Gi)
    # Without these defined, they would be silently ignored and the default values would be used instead,
    # which is difficult to debug.
    deleteOnTermination = optional(any, null)
    kmsKeyId            = optional(any, null)
    snapshotId          = optional(any, null)
    volumeSize          = optional(any, null)
    volumeType          = optional(any, null)
  }))
})), null)

# DEPRECATED: disk_encryption_enabled is DEPRECATED, use `block_device_map` instead.
disk_encryption_enabled = optional(bool, null)
# DEPRECATED: disk_size is DEPRECATED, use `block_device_map` instead.
disk_size = optional(number, null)
})

Default value:

{
  "block_device_map": {
    "/dev/xvda": {
      "ebs": {
        "encrypted": true,
        "volume_size": 20,
        "volume_type": "gp2"
      }
    }
  },
  "desired_group_size": 1,
  "instance_types": [
    "t3.medium"
  ],
  "kubernetes_version": null,
  "max_group_size": 100
}
node_groups optional

List of objects defining a node group for the cluster


Type:

map(object({
# EKS AMI version to use, e.g. "1.16.13-20200821" (no "v").
ami_release_version = optional(string, null)
# Type of Amazon Machine Image (AMI) associated with the EKS Node Group
ami_type = optional(string, null)
# Additional attributes (e.g. `1`) for the node group
attributes = optional(list(string), null)
# will create 1 auto scaling group in each specified availability zone
# or all AZs with subnets if none are specified anywhere
availability_zones = optional(list(string), null)
# Whether to enable Node Group to scale its AutoScaling Group
cluster_autoscaler_enabled = optional(bool, null)
# True to create new node_groups before deleting old ones, avoiding a temporary outage
create_before_destroy = optional(bool, null)
# Desired number of worker nodes when initially provisioned
desired_group_size = optional(number, null)
# Set of instance types associated with the EKS Node Group. Terraform will only perform drift detection if a configuration value is provided.
instance_types = optional(list(string), null)
# Key-value mapping of Kubernetes labels. Only labels that are applied with the EKS API are managed by this argument. Other Kubernetes labels applied to the EKS Node Group will not be managed
kubernetes_labels = optional(map(string), null)
# List of objects describing Kubernetes taints.
kubernetes_taints = optional(list(object({
  key    = string
  value  = string
  effect = string
})), null)
node_userdata = optional(object({
  before_cluster_joining_userdata = optional(string)
  bootstrap_extra_args            = optional(string)
  kubelet_extra_args              = optional(string)
  after_cluster_joining_userdata  = optional(string)
}), {})
# Desired Kubernetes master version. If you do not specify a value, the latest available version is used
kubernetes_version = optional(string, null)
# The maximum size of the AutoScaling Group
max_group_size = optional(number, null)
# The minimum size of the AutoScaling Group
min_group_size = optional(number, null)
# List of auto-launched resource types to tag
resources_to_tag = optional(list(string), null)
tags             = optional(map(string), null)

# block_device_map copied from cloudposse/terraform-aws-eks-node-group
# Keep in sync via copy and paste, but make optional.
# Most of the time you want "/dev/xvda". For BottleRocket, use "/dev/xvdb".
block_device_map = optional(map(object({
  no_device    = optional(bool, null)
  virtual_name = optional(string, null)
  ebs = optional(object({
    delete_on_termination = optional(bool, true)
    encrypted             = optional(bool, true)
    iops                  = optional(number, null)
    kms_key_id            = optional(string, null)
    snapshot_id           = optional(string, null)
    throughput            = optional(number, null) # for gp3, MiB/s, up to 1000
    volume_size           = optional(number, 20)   # Disk size in GB
    volume_type           = optional(string, "gp3")

    # Catch common camel case typos. These have no effect, they just generate better errors.
    # It would be nice to actually use these, but volumeSize in particular is a number here
    # and in most places it is a string with a unit suffix (e.g. 20Gi)
    # Without these defined, they would be silently ignored and the default values would be used instead,
    # which is difficult to debug.
    deleteOnTermination = optional(any, null)
    kmsKeyId            = optional(any, null)
    snapshotId          = optional(any, null)
    volumeSize          = optional(any, null)
    volumeType          = optional(any, null)
  }))
})), null)

# DEPRECATED:
# Enable disk encryption for the created launch template (if we aren't provided with an existing launch template)
# DEPRECATED: disk_encryption_enabled is DEPRECATED, use `block_device_map` instead.
disk_encryption_enabled = optional(bool, null)
# Disk size in GiB for worker nodes. Terraform will only perform drift detection if a configuration value is provided.
# DEPRECATED: disk_size is DEPRECATED, use `block_device_map` instead.
disk_size = optional(number, null)

}))

Default value: { }

oidc_provider_enabled (bool) optional

Create an IAM OIDC identity provider for the cluster, then you can create IAM roles to associate with a service account in the cluster, instead of using kiam or kube2iam. For more information, see https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html


Default value: true

public_access_cidrs (list(string)) optional

Indicates which CIDR blocks can access the Amazon EKS public API server endpoint when enabled. EKS defaults this to a list with 0.0.0.0/0.


Default value:

[
  "0.0.0.0/0"
]
subnet_type_tag_key (string) optional

The tag used to find the private subnets to find by availability zone. If null, will be looked up in vpc outputs.


Default value: null

vpc_component_name (string) optional

The name of the vpc component


Default value: "vpc"

Context Variables​

The following variables are defined in the context.tf file of this module and part of the terraform-null-label pattern.

additional_tag_map (map(string)) optional

Additional key-value pairs to add to each map in tags_as_list_of_maps. Not added to tags or id.
This is for some rare cases where resources want additional configuration of tags
and therefore take a list of maps with tag key, value, and additional configuration.


Required: No

Default value: { }

attributes (list(string)) optional

ID element. Additional attributes (e.g. workers or cluster) to add to id,
in the order they appear in the list. New attributes are appended to the
end of the list. The elements of the list are joined by the delimiter
and treated as a single ID element.


Required: No

Default value: [ ]

context (any) optional

Single object for setting entire context at once.
See description of individual variables for details.
Leave string and numeric variables as null to use default value.
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional_tag_map, which are merged.


Required: No

Default value:

{
  "additional_tag_map": {},
  "attributes": [],
  "delimiter": null,
  "descriptor_formats": {},
  "enabled": true,
  "environment": null,
  "id_length_limit": null,
  "label_key_case": null,
  "label_order": [],
  "label_value_case": null,
  "labels_as_tags": [
    "unset"
  ],
  "name": null,
  "namespace": null,
  "regex_replace_chars": null,
  "stage": null,
  "tags": {},
  "tenant": null
}
delimiter (string) optional

Delimiter to be used between ID elements.
Defaults to - (hyphen). Set to &#34;&#34; to use no delimiter at all.


Required: No

Default value: null

descriptor_formats (any) optional

Describe additional descriptors to be output in the descriptors output map.
Map of maps. Keys are names of descriptors. Values are maps of the form
\{<br/> format = string<br/> labels = list(string)<br/> \}
(Type is any so the map values can later be enhanced to provide additional options.)
format is a Terraform format string to be passed to the format() function.
labels is a list of labels, in order, to pass to format() function.
Label values will be normalized before being passed to format() so they will be
identical to how they appear in id.
Default is {} (descriptors output will be empty).


Required: No

Default value: { }

enabled (bool) optional

Set to false to prevent the module from creating any resources
Required: No

Default value: null

environment (string) optional

ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'
Required: No

Default value: null

id_length_limit (number) optional

Limit id to this many characters (minimum 6).
Set to 0 for unlimited length.
Set to null for keep the existing setting, which defaults to 0.
Does not affect id_full.


Required: No

Default value: null

label_key_case (string) optional

Controls the letter case of the tags keys (label names) for tags generated by this module.
Does not affect keys of tags passed in via the tags input.
Possible values: lower, title, upper.
Default value: title.


Required: No

Default value: null

label_order (list(string)) optional

The order in which the labels (ID elements) appear in the id.
Defaults to ["namespace", "environment", "stage", "name", "attributes"].
You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present.


Required: No

Default value: null

label_value_case (string) optional

Controls the letter case of ID elements (labels) as included in id,
set as tag values, and output by this module individually.
Does not affect values of tags passed in via the tags input.
Possible values: lower, title, upper and none (no transformation).
Set this to title and set delimiter to &#34;&#34; to yield Pascal Case IDs.
Default value: lower.


Required: No

Default value: null

labels_as_tags (set(string)) optional

Set of labels (ID elements) to include as tags in the tags output.
Default is to include all labels.
Tags with empty values will not be included in the tags output.
Set to [] to suppress all generated tags.
Notes:
The value of the name tag, if included, will be the id, not the name.
Unlike other null-label inputs, the initial setting of labels_as_tags cannot be
changed in later chained modules. Attempts to change it will be silently ignored.


Required: No

Default value:

[
  "default"
]
name (string) optional

ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.
This is the only ID element not also included as a tag.
The "name" tag is set to the full id string. There is no tag with the value of the name input.


Required: No

Default value: null

namespace (string) optional

ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique
Required: No

Default value: null

regex_replace_chars (string) optional

Terraform regular expression (regex) string.
Characters matching the regex will be removed from the ID elements.
If not set, &#34;/[^a-zA-Z0-9-]/&#34; is used to remove all characters other than hyphens, letters and digits.


Required: No

Default value: null

stage (string) optional

ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'
Required: No

Default value: null

tags (map(string)) optional

Additional tags (e.g. {&#39;BusinessUnit&#39;: &#39;XYZ&#39;}).
Neither the tag keys nor the tag values will be modified by this module.


Required: No

Default value: { }

tenant (string) optional

ID element (Rarely used, not included by default). A customer identifier, indicating who this instance of a resource is for
Required: No

Default value: null

Outputs​

auto_mode_enabled

Whether EKS Auto Mode is enabled on the cluster

auto_mode_node_role_arn

ARN of the IAM role used by Auto Mode nodes

auto_mode_node_role_name

Name of the IAM role used by Auto Mode nodes

availability_zones

Availability Zones in which the cluster is provisioned

capabilities

Map of enabled EKS Capabilities with their ARNs and types

capability_role_arns

Map of capability IAM role ARNs (auto-created by this component)

eks_addons_versions

Map of enabled EKS Addons names and versions

eks_auth_worker_roles

List of worker IAM roles that were included in the auth-map ConfigMap.

eks_cluster_arn

The Amazon Resource Name (ARN) of the cluster

eks_cluster_certificate_authority_data

The Kubernetes cluster certificate authority data

eks_cluster_endpoint

The endpoint for the Kubernetes API server

eks_cluster_id

The name of the cluster

eks_cluster_identity_oidc_issuer

The OIDC Identity issuer for the cluster

eks_cluster_managed_security_group_id

Security Group ID that was created by EKS for the cluster. EKS creates a Security Group and applies it to ENI that is attached to EKS Control Plane master nodes and to any managed workloads

eks_cluster_version

The Kubernetes server version of the cluster

eks_managed_node_workers_role_arns

List of ARNs for workers in managed node groups

eks_node_group_arns

List of all the node group ARNs in the cluster

eks_node_group_count

Count of the worker nodes

eks_node_group_ids

EKS Cluster name and EKS Node Group name separated by a colon

eks_node_group_role_names

List of worker nodes IAM role names

eks_node_group_statuses

Status of the EKS Node Group

fargate_profile_role_arns

Fargate Profile Role ARNs

fargate_profile_role_names

Fargate Profile Role names

fargate_profiles

Fargate Profiles

karpenter_iam_role_arn

Karpenter IAM Role ARN

karpenter_iam_role_name

Karpenter IAM Role name

vpc_cidr

The CIDR of the VPC where this cluster is deployed.

Dependencies​

Requirements​

  • terraform, version: >= 1.3.0
  • aws, version: >= 6.25.0
  • random, version: >= 3.0
  • utils, version: >= 1.7.1, != 1.4.0, < 3.0.0

Providers​

  • aws, version: >= 6.25.0
  • random, version: >= 3.0

Modules​

NameVersionSourceDescription
auto_mode_node_label0.25.0cloudposse/label/nulln/a
aws_ebs_csi_driver_eks_iam_role2.2.1cloudposse/eks-iam-role/awsn/a
aws_ebs_csi_driver_fargate_profile1.3.1cloudposse/eks-fargate-profile/awsn/a
aws_efs_csi_driver_eks_iam_role2.2.1cloudposse/eks-iam-role/awsn/a
capability_label0.25.0cloudposse/label/nulln/a
coredns_fargate_profile1.3.1cloudposse/eks-fargate-profile/awsn/a
eks_cluster4.9.0cloudposse/eks-cluster/awsn/a
fargate_pod_execution_role1.3.1cloudposse/eks-fargate-profile/awsn/a
fargate_profile1.3.1cloudposse/eks-fargate-profile/aws############################################################################## ## Both New and Legacy behavior, use caution when modifying ##############################################################################
iam_arnslatest../../account-map/modules/roles-to-principalsn/a
iam_roleslatest../../account-map/modules/iam-rolesn/a
karpenter_label0.25.0cloudposse/label/nulln/a
region_node_grouplatest./modules/node_group_by_regionn/a
this0.25.0cloudposse/label/nulln/a
utils1.4.0cloudposse/utils/awsn/a
vpc2.0.0cloudposse/stack-config/yaml//modules/remote-staten/a
vpc_cni_eks_iam_role2.2.1cloudposse/eks-iam-role/awsn/a
vpc_ingress2.0.0cloudposse/stack-config/yaml//modules/remote-staten/a

Resources​

The following resources are used by this module:

Data Sources​

The following data sources are used by this module: