EKS

Terraform module to create Amazon Elastic Kubernetes (EKS) resources

Version

v21.25.0

Repository

terrablox-aws-eks

Submodules

_user_datacapabilityeks-managed-node-groupfargate-profilehybrid-node-rolekarpenterself-managed-node-group

Inputs

40 / 105

access_entriesoptionalmap(object({ # Access entry kubernetes_groups = optional(list(string)) principal…

Map of access entries to add to the cluster

Default{}

additional_security_group_idsoptionallist(string)

List of additional, externally created security group IDs to attach to the cluster control plane

Default[]

addonsoptionalmap(object({ name = optional(string) # will fall back to map key before_compute …

Map of cluster addon configurations to enable for the cluster. Addon name can be the map keys or set with `name`

Defaultnull

addons_timeoutsoptionalobject({ create = optional(string) update = optional(string) delete = optional(s…

Create, update, and delete timeout configurations for the cluster addons

Default{}

attach_encryption_policyoptionalbool

Indicates whether or not to attach an additional policy for the cluster IAM role to utilize the encryption key provided

Defaulttrue

authentication_modeoptionalstring

The authentication mode for the cluster. Valid values are `CONFIG_MAP`, `API` or `API_AND_CONFIG_MAP`

DefaultAPI_AND_CONFIG_MAP

cloudwatch_log_group_classoptionalstring

Specified the log class of the log group. Possible values are: `STANDARD` or `INFREQUENT_ACCESS`

Defaultnull

cloudwatch_log_group_kms_key_idoptionalstring

If a KMS Key ARN is set, this key will be used to encrypt the corresponding log group. Please be sure that the KMS Key has an appropriate key policy (https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html)

Defaultnull

cloudwatch_log_group_retention_in_daysoptionalnumber

Number of days to retain log events. Default retention - 90 days

Default90

cloudwatch_log_group_tagsoptionalmap(string)

A map of additional tags to add to the cloudwatch log group created

Default{}

cluster_tagsoptionalmap(string)

A map of additional tags to add to the cluster

Default{}

compute_configoptionalobject({ enabled = optional(bool, false) node_pools = optional(list(string)) nod…

Configuration block for the cluster compute configuration

Defaultnull

control_plane_egress_modeoptionalstring

Egress mode for the EKS control plane. Valid values are `AWS_MANAGED` and `CUSTOMER_ROUTED`

Defaultnull

control_plane_scaling_configoptionalobject({ tier = string })

Configuration block for the EKS Provisioned Control Plane scaling tier. Valid values for tier are `standard`, `tier-xl`, `tier-2xl`, `tier-4xl` and `tier-8xl`

Defaultnull

control_plane_subnet_idsoptionallist(string)

A list of subnet IDs where the EKS cluster control plane (ENIs) will be provisioned. Used for expanding the pool of subnets used by nodes/node groups without replacing the EKS control plane

Default[]

createoptionalbool

Controls if resources should be created (affects nearly all resources)

Defaulttrue

create_auto_mode_iam_resourcesoptionalbool

Determines whether to create/attach IAM resources for EKS Auto Mode. Useful for when using only custom node pools and not built-in EKS Auto Mode node pools

Defaultfalse

create_cloudwatch_log_groupoptionalbool

Determines whether a log group is created by this module for the cluster logs. If not, AWS will automatically create one if logging is enabled

Defaulttrue

create_cni_ipv6_iam_policyoptionalbool

Determines whether to create an [`AmazonEKS_CNI_IPv6_Policy`](https://docs.aws.amazon.com/eks/latest/userguide/cni-iam-role.html#cni-iam-role-create-ipv6-policy)

Defaultfalse

create_iam_roleoptionalbool

Determines whether an IAM role is created for the cluster

Defaulttrue

create_kms_keyoptionalbool

Controls if a KMS key for cluster encryption should be created

Defaulttrue

create_node_iam_roleoptionalbool

Determines whether an EKS Auto node IAM role is created

Defaulttrue

create_node_security_groupoptionalbool

Determines whether to create a security group for the node groups or use the existing `node_security_group_id`

Defaulttrue

create_primary_security_group_tagsoptionalbool

Indicates whether or not to tag the cluster's primary security group. This security group is created by the EKS service, not the module, and therefore tagging is handled after cluster creation

Defaulttrue

create_security_groupoptionalbool

Determines if a security group is created for the cluster. Note: the EKS service creates a primary security group for the cluster by default

Defaulttrue

custom_oidc_thumbprintsoptionallist(string)

Additional list of server certificate thumbprints for the OpenID Connect (OIDC) identity provider's server certificate(s)

Default[]

dataplane_wait_durationoptionalstring

Duration to wait after the EKS cluster has become active before creating the dataplane components (EKS managed node group(s), self-managed node group(s), Fargate profile(s))

Default30s

deletion_protectionoptionalbool

Whether to enable deletion protection for the cluster. When enabled, the cluster cannot be deleted unless deletion protection is first disabled

Defaultnull

eks_managed_node_groupsoptionalmap(object({ create = optional(bool) kubernetes_version = optional(string) # EKS…

Map of EKS managed node group definitions to create

Defaultnull

enable_auto_mode_custom_tagsoptionalbool

Determines whether to enable permissions for custom tags resources created by EKS Auto Mode

Defaulttrue

enable_cluster_creator_admin_permissionsoptionalbool

Indicates whether or not to add the cluster creator (the identity used by Terraform) as an administrator via access entry

Defaultfalse

enable_irsaoptionalbool

Determines whether to create an OpenID Connect Provider for EKS to enable IRSA

Defaulttrue

enable_kms_key_rotationoptionalbool

Specifies whether key rotation is enabled

Defaulttrue

enabled_log_typesoptionallist(string)

A list of the desired control plane logs to enable. For more information, see Amazon EKS Control Plane Logging documentation (https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html)

Default[…]

encryption_configoptionalobject({ provider_key_arn = optional(string) resources = optional(list(string), …

Configuration block with encryption configuration for the cluster

Default{}

encryption_policy_descriptionoptionalstring

Description of the cluster encryption policy created

DefaultCluster encryption policy to allow cluster role to utilize CMK provided

encryption_policy_nameoptionalstring

Name to use on cluster encryption policy created

Defaultnull

encryption_policy_pathoptionalstring

Cluster encryption policy path

Defaultnull

encryption_policy_tagsoptionalmap(string)

A map of additional tags to add to the cluster encryption policy created

Default{}

encryption_policy_use_name_prefixoptionalbool

Determines whether cluster encryption policy name (`cluster_encryption_policy_name`) is used as a prefix

Defaulttrue

All 105 are optional — the module deploys with none of them set. Showing 40, so the site stays a static download — the remaining 65 are in the source.

Outputs

40 / 41

access_entries

Map of access entries created and their attributes

access_policy_associations

Map of eks cluster access policy associations created and their attributes

cloudwatch_log_group_arn

Arn of cloudwatch log group created

cloudwatch_log_group_name

Name of cloudwatch log group created

cluster_addons

Map of attribute maps for all EKS cluster addons enabled

cluster_arn

The Amazon Resource Name (ARN) of the cluster

cluster_certificate_authority_data

Base64 encoded certificate data required to communicate with the cluster

cluster_control_plane_scaling_tier

The EKS Provisioned Control Plane scaling tier for the cluster

cluster_dualstack_oidc_issuer_url

Dual-stack compatible URL on the EKS cluster for the OpenID Connect identity provider

cluster_endpoint

Endpoint for your Kubernetes API server

cluster_iam_role_arn

Cluster IAM role ARN

cluster_iam_role_name

Cluster IAM role name

cluster_iam_role_unique_id

Stable and unique string identifying the IAM role

cluster_id

The ID of the EKS cluster. Note: currently a value is returned only for local EKS clusters created on Outposts

cluster_identity_providers

Map of attribute maps for all EKS identity providers enabled

cluster_ip_family

The IP family used by the cluster (e.g. `ipv4` or `ipv6`)

cluster_name

The name of the EKS cluster

cluster_oidc_issuer_url

The URL on the EKS cluster for the OpenID Connect identity provider

cluster_platform_version

Platform version for the cluster

cluster_primary_security_group_id

Cluster security group that was created by Amazon EKS for the cluster. Managed node groups use this security group for control-plane-to-data-plane communication. Referred to as 'Cluster security group' in the EKS console

cluster_security_group_arn

Amazon Resource Name (ARN) of the cluster security group

cluster_security_group_id

ID of the cluster security group

cluster_service_cidr

The CIDR block where Kubernetes pod and service IP addresses are assigned from

cluster_status

Status of the EKS cluster. One of `CREATING`, `ACTIVE`, `DELETING`, `FAILED`

cluster_tls_certificate_sha1_fingerprint

The SHA1 fingerprint of the public key of the cluster's certificate

cluster_version

The Kubernetes version for the cluster

eks_managed_node_groups

Map of attribute maps for all EKS managed node groups created

eks_managed_node_groups_autoscaling_group_names

List of the autoscaling group names created by EKS managed node groups

fargate_profiles

Map of attribute maps for all EKS Fargate Profiles created

kms_key_arn

The Amazon Resource Name (ARN) of the key

kms_key_id

The globally unique identifier for the key

kms_key_policy

The IAM resource policy set on the key

node_iam_role_arn

EKS Auto node IAM role ARN

node_iam_role_name

EKS Auto node IAM role name

node_iam_role_unique_id

Stable and unique string identifying the IAM role

node_security_group_arn

Amazon Resource Name (ARN) of the node shared security group

node_security_group_id

ID of the node shared security group

oidc_provider

The OpenID Connect identity provider (issuer URL without leading `https://`)

oidc_provider_arn

The ARN of the OIDC Provider if `enable_irsa = true`

self_managed_node_groups

Map of attribute maps for all self managed node groups created

What the agent wires into the next module. An edge on the architecture diagram is one of these consumed by something else. Showing 40 of 41 — the rest are in the source.