-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathvpc.tf
110 lines (90 loc) · 3.62 KB
/
vpc.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
locals {
# Routable Private subnets only for Private NAT Gateway -> Transit Gateway -> Second VPC for overlapping CIDRs
# e.g., var.vpc_cidr = "10.1.0.0/21" => output: ["10.1.0.0/24", "10.1.1.0/24"] => 256-2 = 254 usable IPs per subnet/AZ
private_subnets = [for k, v in local.azs : cidrsubnet(var.vpc_cidr, 3, k)]
# Routable Public subnets with NAT Gateway and Internet Gateway
# e.g., var.vpc_cidr = "10.1.0.0/21" => output: ["10.1.2.0/26", "10.1.2.64/26"] => 64-2 = 62 usable IPs per subnet/AZ
public_subnets = [for k, v in local.azs : cidrsubnet(var.vpc_cidr, 5, k + 8)]
}
#---------------------------------------------------------------
# VPC
#---------------------------------------------------------------
# WARNING: This VPC module includes the creation of an Internet Gateway and NAT Gateway, which simplifies cluster deployment and testing, primarily intended for sandbox accounts.
# IMPORTANT: For preprod and prod use cases, it is crucial to consult with your security team and AWS architects to design a private infrastructure solution that aligns with your security requirements
module "vpc" {
source = "terraform-aws-modules/vpc/aws"
version = "~> 5.0"
name = local.name
cidr = var.vpc_cidr
azs = local.azs
# 1/ EKS Data Plane secondary CIDR blocks for two subnets across two AZs for EKS Control Plane ENI + Nodes + Pods
# 2/ Two private Subnets with RFC1918 private IPv4 address range for Private NAT + NLB + Airflow + EC2 Jumphost etc.
private_subnets = local.private_subnets
# ------------------------------
# Optional Public Subnets for NAT and IGW for PoC/Dev/Test environments
# Public Subnets can be disabled while deploying to Production and use Private NAT + TGW
public_subnets = local.public_subnets
enable_nat_gateway = true
single_nat_gateway = true
#-------------------------------
public_subnet_tags = {
"kubernetes.io/role/elb" = 1
}
private_subnet_tags = {
"kubernetes.io/role/internal-elb" = 1
# Tags subnets for Karpenter auto-discovery
"karpenter.sh/discovery" = local.name
"type" = "private"
}
tags = local.tags
}
module "vpc_endpoints_sg" {
source = "terraform-aws-modules/security-group/aws"
version = "~> 5.0"
create = var.enable_vpc_endpoints
name = "${local.name}-vpc-endpoints"
description = "Security group for VPC endpoint access"
vpc_id = module.vpc.vpc_id
ingress_with_cidr_blocks = [
{
rule = "https-443-tcp"
description = "VPC CIDR HTTPS"
cidr_blocks = join(",", module.vpc.private_subnets_cidr_blocks)
},
]
egress_with_cidr_blocks = [
{
rule = "https-443-tcp"
description = "All egress HTTPS"
cidr_blocks = "0.0.0.0/0"
},
]
tags = local.tags
}
module "vpc_endpoints" {
source = "terraform-aws-modules/vpc/aws//modules/vpc-endpoints"
version = "~> 5.0"
create = var.enable_vpc_endpoints
vpc_id = module.vpc.vpc_id
security_group_ids = [module.vpc_endpoints_sg.security_group_id]
endpoints = merge({
s3 = {
service = "s3"
service_type = "Gateway"
route_table_ids = module.vpc.private_route_table_ids
tags = {
Name = "${local.name}-s3"
}
}
},
{ for service in toset(["autoscaling", "ecr.api", "ecr.dkr", "ec2", "ec2messages", "elasticloadbalancing", "sts", "kms", "logs", "ssm", "ssmmessages"]) :
replace(service, ".", "_") =>
{
service = service
subnet_ids = module.vpc.private_subnets
private_dns_enabled = true
tags = { Name = "${local.name}-${service}" }
}
})
tags = local.tags
}