diff --git a/CHANGELOG.md b/CHANGELOG.md index 46ee18a6..62a368a4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,14 @@ +# master + +* The update to the version of Terraform AWS VPC module will require the following manual edits to the state file: + +```bash +terraform state rm module.odc_eks.module.vpc[0].aws_vpc_endpoint_route_table_association.private_s3 +terraform state rm module.odc_eks.module.vpc[0].aws_vpc_endpoint_route_table_association.public_s3 +``` + +See Terraform AWS VPC module upgrade instructions at https://github.com/terraform-aws-modules/terraform-aws-vpc/blob/fbd4ff646b4caaa6fcc1fb71bc88d377cc8b3b48/UPGRADE-3.0.md?plain=1#L25. + # v1.10.0 odc_eks - Optional vpc creation update procedure Making VPC creation optional has added a `count` to the `module.odc_eks.module.vpc` resource path. @@ -50,4 +61,4 @@ terraform state mv module.odc_eks.module.vpc.aws_vpc_endpoint_route_table_associ terraform state mv module.odc_eks.module.vpc.aws_vpc_endpoint_route_table_association.private_s3[1] module.odc_eks.module.vpc[0].aws_vpc_endpoint_route_table_association.private_s3[1] terraform state mv module.odc_eks.module.vpc.aws_vpc_endpoint_route_table_association.private_s3[2] module.odc_eks.module.vpc[0].aws_vpc_endpoint_route_table_association.private_s3[2] terraform state mv module.odc_eks.module.vpc.aws_vpc_endpoint_route_table_association.public_s3[0] module.odc_eks.module.vpc[0].aws_vpc_endpoint_route_table_association.public_s3[0] -``` \ No newline at end of file +``` diff --git a/odc_eks/README.md b/odc_eks/README.md index 28b2db61..88088489 100644 --- a/odc_eks/README.md +++ b/odc_eks/README.md @@ -20,7 +20,7 @@ Terraform module designed to provision an Open Data Cube EKS cluster on AWS. The module provisions the following resources: -- Creates AWS EKS cluster in a VPC with subnets +- Creates AWS EKS cluster in a VPC with subnets, and optionally VPC Flow Logs (S3) - (Optionally) Creates VPC resources using [terraform-aws-vpc](https://github.com/terraform-aws-modules/terraform-aws-vpc) module with the default configuration and internet facing resources, _or_ - (Optionally) Use a supplied VPC and subnets configured and _tagged_ as required by AWS EKS - see [VPC considerations](https://docs.aws.amazon.com/eks/latest/userguide/network_reqs.html) and the requirements on subnet tagging for the [Application load balancing on Amazon EKS](https://docs.aws.amazon.com/eks/latest/userguide/alb-ingress.html) @@ -98,65 +98,86 @@ module "odc_eks" { waf_enable_url_whitelist_string_match_set = true waf_url_whitelist_uri_prefix = "/user" waf_url_whitelist_url_host = app.example.domain.com + + # VPC Flow Logs + create_flow_log = true + flow_log_max_aggregation_interval = 60 + flow_log_traffic_type = "ALL" + flow_log_file_format = "plain-text" + create_flow_log_s3_bucket = false + flow_log_s3_bucket_name = "dea-test-vpc-logs" + flow_log_s3_bucket_prefix = "a-prefix" } ``` ## Variables ### Inputs -| Name | Description | Type | Default | Required | -| ---------------------------- | ------------- | :----: | :-----: | :-----: | -| owner | The owner of the environment | string | | Yes | -| namespace | The unique namespace for the environment, which could be your organization name or abbreviation, e.g. 'odc' | string | | Yes | -| environment | The name of the environment - e.g. dev, stage | string | | Yes | -| region | The AWS region to provision resources | string | "ap-southeast-2" | No | -| cluster_id | The name of your cluster. Used for the resource naming as identifier | string | | Yes | -| cluster_version | EKS Cluster version to use | string | | Yes | -| admin_access_CIDRs | Locks ssh and api access to these IPs | map(string) | {} | No | -| user_custom_policy | The IAM custom policy to create and attach to EKS user role | string | "" | No | -| user_additional_policy_arn | The list of pre-defined IAM policy required to EKS user role | list(string) | [] | No | -| domain_name | The domain name to be used by applications deployed to the cluster and using ingress | string | | Yes | -| create_vpc | Create a default VPC and subnet configuration | bool | true | No | -| vpc_cidr | The network CIDR you wish to use for the VPC module subnets. Default is set to 10.0.0.0/16 for most use-cases. Requires create_vpc = true | string | "10.0.0.0/16" | No | -| secondary_cidr_blocks | Secondary VPC CIDRs, optional, default no secondary CIDRs | list(string) | [] | No | -| public_subnet_cidrs | List of public cidrs, for all available availability zones. Used by VPC module to set up public subnets. Requires create_vpc = true | list(string) | ["10.0.0.0/22", "10.0.4.0/22", "10.0.8.0/22"] | No | -| private_subnet_cidrs | List of private cidrs, for all available availability zones. Used by VPC module to set up private subnets. Requires create_vpc = true | list(string) | ["10.0.32.0/19", "10.0.64.0/19", "10.0.96.0/19"] | No | -| database_subnet_cidrs | List of database cidrs, for all available availability zones. Used by VPC module to set up database subnets. Requires create_vpc = true | list(string) | ["10.0.20.0/22", "10.0.24.0/22", "10.0.28.0/22"] | No | -| private_subnet_elb_role | ELB role for private subnets | string | "internal-elb" | No | -| public_subnet_elb_role | ELB role for public subnets | string | "elb" | No | -| vpc_id | Supplied VPC to use. Requires create_vpc = false | string | "" | No | -| private_subnets | Private subnet ids for supplied VPC. Requires create_vpc = false | list(string) | [] | No | -| public_subnets | Public subnet ids for supplied VPC. Requires create_vpc = false | list(string) | [] | No | -| database_subnets | Supplied VPC to use. Requires create_vpc = false | list(string) | [] | No | -| public_route_table_ids | List of public_route_table_ids for supplied VPC. Requires create_vpc = false | list(string) | [] | No | -| private_route_table_ids | List of private_route_table_ids for supplied VPC. Requires create_vpc = false | list(string) | [] | No | -| map_public_ip_on_launch | Should be false if you do not want to auto-assign public IP on launch | bool | true | No | -| enable_s3_endpoint | Whether to provision an S3 endpoint to the VPC. Default is set to 'true' | bool | true | No | -| enable_nat_gateway | Whether to provision a NAT Gateway in the VPC. Default is set to 'true' | bool | true | No | -| create_igw | Whether to provision an Internet Gateway in the VPC. Default is true (False for private routing) | bool | true | No | -| enable_ec2_ssm | Enables the IAM policy required for AWS EC2 System Manager in the EKS Node IAM role created | bool | true | No | -| ami_image_id | This variable can be used to deploy a patched / customised version of the Amazon EKS image | string | "" | No | -| node_group_name | Autoscaling node group name. This name is used to tag instances and ASGs | string | "eks" | No | -| default_worker_instance_type | The Worker instance type that the cluster nodes will run, for production we recommend something with a good network capability, as most of the Open Data Cube work is I/O bound, For example r4.4xlarge or c5n.4xlarge | string | | Yes | -| min_nodes | The minimum number of on-demand nodes to run | number | 0 | No | -| desired_nodes | Desired number of nodes only used when first launching the cluster afterwards you should scale with something like cluster-autoscaler | number | 0 | No | -| max_nodes | Max number of nodes you want to run, useful for controlling max cost of the cluster | number | 0 | No | -| spot_nodes_enabled | Creates a second set of Autoscaling groups (one per AZ) that are configured to run Spot instances, these instances are cheaper but can be removed any-time. Useful for fault tolerant processing work | bool | false | No | -| min_spot_nodes | The minimum number of spot nodes to run | bool | 0 | No | -| max_spot_nodes | Max number of spot you want to run, useful for controlling max cost of the cluster | number | 0 | No | -| max_spot_price | The max in USD you want to pay for each spot instance per hour. Check market price for your instance type to set its value | string | "0.40" | No | -| volume_size | The Disk size for your on-demand nodes. If you're getting pods evicted for ephemeral storage saving, you should increase this. | number | 20 | No | -| volume_type | Override EBS volume type for your root ebs volume e.g. gp2, gp3. If not provided, defaults to GP2 in all regions. | string | "" | No | -| volume_encrypted | Whether to encrypt the root EBS volume for nodes. Falls back on AWS EC2 default if not provided. | bool | null | No | -| spot_volume_size | The Disk size for your spot nodes. If you're getting pods evicted for ephemeral storage saving, you should increase this. | number | 20 | No | -| extra_kubelet_args | Additional kubelet command-line arguments | string | "--arg1=value --arg2" | No | -| extra_bootstrap_args | Additional bootstrap command-line arguments | string | "--arg1 value --arg2=value --arg3" | No | -| extra_userdata | Additional EC2 user data commands that will be passed to EKS nodes | string | <. Requires create_vpc = true | list(string) | ["public-subnet-a", "public-subnet-b", "public-subnet-c"] | No | +| private_subnet_names | List of names for each private subnet. For each subnet, creates the tag Name=. Requires create_vpc = true | list(string) | ["private-subnet-a", "private-subnet-b", "private-subnet-c"] | No | +| database_subnet_names | List of names for each database subnet. For each subnet, creates the tag Name=. Requires create_vpc = true | list(string) | ["database-subnet-a", "database-subnet-b", "database-subnet-c"] | No | +| private_subnet_elb_role | ELB role for private subnets | string | "internal-elb" | No | +| public_subnet_elb_role | ELB role for public subnets | string | "elb" | No | +| vpc_id | Supplied VPC to use. Requires create_vpc = false | string | "" | No | +| private_subnets | Private subnet ids for supplied VPC. Requires create_vpc = false | list(string) | [] | No | +| public_subnets | Public subnet ids for supplied VPC. Requires create_vpc = false | list(string) | [] | No | +| database_subnets | Supplied VPC to use. Requires create_vpc = false | list(string) | [] | No | +| public_route_table_ids | List of public_route_table_ids for supplied VPC. Requires create_vpc = false | list(string) | [] | No | +| private_route_table_ids | List of private_route_table_ids for supplied VPC. Requires create_vpc = false | list(string) | [] | No | +| map_public_ip_on_launch | Should be false if you do not want to auto-assign public IP on launch | bool | true | No | +| enable_s3_endpoint | Whether to provision an S3 endpoint to the VPC. Default is set to 'true' | bool | true | No | +| enable_nat_gateway | Whether to provision a NAT Gateway in the VPC. Default is set to 'true' | bool | true | No | +| single_nat_gateway | Should be true if you want to provision a single shared NAT Gateway across all of your private networks | bool | false | No | +| create_igw | Whether to provision an Internet Gateway in the VPC. Default is true (False for private routing) | bool | true | No | +| enable_ec2_ssm | Enables the IAM policy required for AWS EC2 System Manager in the EKS Node IAM role created | bool | true | No | +| ami_image_id | This variable can be used to deploy a patched / customised version of the Amazon EKS image | string | "" | No | +| node_group_name | Autoscaling node group name. This name is used to tag instances and ASGs | string | "eks" | No | +| default_worker_instance_type | The Worker instance type that the cluster nodes will run, for production we recommend something with a good network capability, as most of the Open Data Cube work is I/O bound, For example r4.4xlarge or c5n.4xlarge | string | | Yes | +| min_nodes | The minimum number of on-demand nodes to run | number | 0 | No | +| desired_nodes | Desired number of nodes only used when first launching the cluster afterwards you should scale with something like cluster-autoscaler | number | 0 | No | +| max_nodes | Max number of nodes you want to run, useful for controlling max cost of the cluster | number | 0 | No | +| spot_nodes_enabled | Creates a second set of Autoscaling groups (one per AZ) that are configured to run Spot instances, these instances are cheaper but can be removed any-time. Useful for fault tolerant processing work | bool | false | No | +| min_spot_nodes | The minimum number of spot nodes to run | bool | 0 | No | +| max_spot_nodes | Max number of spot you want to run, useful for controlling max cost of the cluster | number | 0 | No | +| max_spot_price | The max in USD you want to pay for each spot instance per hour. Check market price for your instance type to set its value | string | "0.40" | No | +| volume_size | The Disk size for your on-demand nodes. If you're getting pods evicted for ephemeral storage saving, you should increase this. | number | 20 | No | +| volume_type | Override EBS volume type for your root ebs volume e.g. gp2, gp3. If not provided, defaults to GP2 in all regions. | string | "" | No | +| volume_encrypted | Whether to encrypt the root EBS volume for nodes. Falls back on AWS EC2 default if not provided. | bool | null | No | +| spot_volume_size | The Disk size for your spot nodes. If you're getting pods evicted for ephemeral storage saving, you should increase this. | number | 20 | No | +| extra_kubelet_args | Additional kubelet command-line arguments | string | "--arg1=value --arg2" | No | +| extra_bootstrap_args | Additional bootstrap command-line arguments | string | "--arg1 value --arg2=value --arg3" | No | +| extra_userdata | Additional EC2 user data commands that will be passed to EKS nodes | string | <