aws-k3s.yaml

{{- $createVpcCIDR := "10.8.0.0/18" -}}
{{- $azs_count := len .variables.azs -}}
_: &getKubeconfig "export KUBECONFIG=./kubeconfig_{{ .variables.cluster_name }} && aws s3 cp s3://{{ .variables.bucket }}/{{ .variables.cluster_name }}/kubeconfig ./kubeconfig_{{ .variables.cluster_name }}"
_p: &provider_aws
- aws:
    region: {{ .variables.region }}


name: aws-k3s
kind: StackTemplate
cliVersion: ">=0.6.1" 
units:
  - 
    name: aws_key_pair
    type: tfmodule
    source: github.com/terraform-aws-modules/terraform-aws-key-pair?ref=v0.6.0
    providers: *provider_aws
    inputs:
      create_key_pair: true
      public_key: {{ .variables.public_key }}
      key_name: {{ .variables.public_key_name }}
  - 
    name: route53
    type: tfmodule
    source: github.com/shalb/cluster.dev-domain?ref=0.1.0
    inputs:
      region: {{ .variables.region }}
      cluster_name: {{ .variables.cluster_name }}
      cluster_domain: {{ .variables.domain }}
      zone_delegation: {{ if eq .variables.domain "cluster.dev" }}true{{ else }}false{{ end }}
  {{- if not .variables.vpc_id }}
  - 
    name: vpc
    type: tfmodule
    providers: *provider_aws
    source: terraform-aws-modules/vpc/aws
    version: "2.70.0"
    inputs:
      name: {{ .variables.cluster_name }}
      cidr: {{ $createVpcCIDR }}
      public_subnets:
      {{- range $index, $_ := .variables.azs }}
       - {{ cidrSubnet $createVpcCIDR 4 $index }}
      {{- end }}
      private_subnets:
      {{- range $index, $_ := .variables.azs }}
       - {{ cidrSubnet $createVpcCIDR 4 (add $index $azs_count ) }}
      {{- end }}
      azs: {{ insertYAML .variables.azs }}
  {{- end }}
  - 
    name: ext-dns-iam
    type: tfmodule
    source: ./ext-dns-iam
    providers: *provider_aws
    inputs:
      name: {{ .variables.cluster_name }}-test
      domain: {{ remoteState "this.route53.zone_id" }}
  - 
    name: k3s
    type: tfmodule
    source: github.com/shalb/terraform-aws-k3s?ref=removed_csi_addon
    pre_hook:
      command: *getKubeconfig
      on_apply: false
      on_destroy: true
    inputs:
      cluster_name: {{ .variables.cluster_name }}
      extra_args:
        - "--disable traefik"
      domain: {{ remoteState "this.route53.domain" }}
      k3s_version: {{ .variables.k3s_version }}
      {{- if .variables.vpc_id }}
      public_subnets: {{ insertYAML .variables.public_subnets }}
      {{- else }}
      public_subnets: {{ remoteState "this.vpc.public_subnets" }}
      {{- end }}
      key_name: {{ remoteState "this.aws_key_pair.this_key_pair_key_name" }}
      region: {{ .variables.region }}
      s3_bucket: {{ .variables.bucket }}
      master_node_count: {{ .variables.master_node_count }}
      worker_node_groups: {{ insertYAML .variables.worker_node_groups  }}
      master_iam_policies: 
        - {{ remoteState "this.ext-dns-iam.arn" }}
      worker_iam_policies: 
        - {{ remoteState "this.ext-dns-iam.arn" }}
      enable_asg_rolling_auto_update: true
  - 
    name: kubeconfig
    type: shell
    force_apply: true
    depends_on: this.k3s
    apply:
      commands:
        - aws s3 cp s3://{{ .variables.bucket }}/{{ .variables.cluster_name }}/kubeconfig /tmp/kubeconfig_{{ .variables.cluster_name }}
        - echo "kubeconfig_base64=$(cat /tmp/kubeconfig_{{ .variables.cluster_name }} | base64 -w 0)"
        - echo "kubeconfig_path=/tmp/kubeconfig_{{ .variables.cluster_name }}"
    outputs:
      type: separator
      separator: "="
  - 
    name: cert-manager
    type: helm
    source:
      repository: "https://charts.jetstack.io"
      chart: "cert-manager"
      version: "v1.2.0"
    kubeconfig: {{ output "this.kubeconfig.kubeconfig_path" }}
    additional_options:
      namespace: "cert-manager"
      create_namespace: true
    inputs:
      installCRDs: true
      webhook.enabled: false
      ingressShim.defaultIssuerName: letsencrypt-prod
      ingressShim.defaultIssuerKind: ClusterIssuer
      ingressShim.defaultACMEChallengeType: dns01
      securityContext.enabled: false
      serviceAccount.create: true
  - 
    name: cert-manager-issuer
    type: k8s-manifest
    path: ./cert-manager/issuer.yaml
    kubeconfig: {{ output "this.kubeconfig.kubeconfig_path" }}
    depends_on: this.cert-manager
  - 
    name: ingress-nginx
    type: helm
    source:
      repository: "https://kubernetes.github.io/ingress-nginx"
      chart: "ingress-nginx"
      version: "3.21.0"
    kubeconfig: {{ output "this.kubeconfig.kubeconfig_path" }}
    additional_options:
      namespace: "ingress-nginx"
      create_namespace: true
    inputs:
        service.type: LoadBalancer
        controller.admissionWebhooks.enabled: false
        service.externalTrafficPolicy: Local
  - 
    name: csi
    type: helm
    source:
      repository: "https://kubernetes-sigs.github.io/aws-ebs-csi-driver"
      chart: "aws-ebs-csi-driver"
      version: "0.9.14"
    kubeconfig: {{ output "this.kubeconfig.kubeconfig_path" }}
    additional_options:
      namespace: "kube-system"
    values:
      - file: ./csi/values.yaml
        apply_template: false
  - 
    name: argocd
    type: helm
    source:
      repository: "https://argoproj.github.io/argo-helm"
      chart: "argo-cd"
      version: "4.5.7"
    kubeconfig: {{ output "this.kubeconfig.kubeconfig_path" }}
    depends_on: this.cert-manager-issuer
    additional_options:
      namespace: "argocd"
      create_namespace: true
    inputs:
      service.type: LoadBalancer
      server.certificate.domain: argocd.{{ .variables.cluster_name }}.{{ .variables.domain }}
      server.certificate.enabled: true
      server.certificate.issuer.name: letsencrypt-prod
      server.certificate.issuer.kind: ClusterIssuer
      server.ingress.enabled: true
      server.ingress.tls[0].secretName: argocd-secret
      server.ingress.hosts[0]: argocd.{{ .variables.cluster_name }}.{{ .variables.domain }}
      server.ingress.tls[0].hosts[0]: argocd.{{ .variables.cluster_name }}.{{ .variables.domain }}
      server.ingress.annotations.cert-manager\.io/cluster-issuer: letsencrypt-prod
      server.ingress.annotations.kubernetes\.io/ingress.class: nginx
      server.ingress.annotations.kubernetes\.io/tls-acme: "true"
      server.ingress.annotations.nginx\.ingress\.kubernetes\.io/ssl-passthrough: "true"
      server.ingress.annotations.nginx\.ingress\.kubernetes\.io/backend-protocol: "HTTPS"
      server.config.url: https://argocd.{{ .variables.cluster_name }}.{{ .variables.domain }}
      configs.secret.argocdServerAdminPassword: {{ .variables.argocdServerAdminPassword }}
      configs.secret.argocdServerAdminPasswordMtime: "2021-01-01T00:00:00Z"
  - 
    name: argocd_apps
    type: k8s-manifest
    path: ./argocd-apps/
    kubeconfig: {{ output "this.kubeconfig.kubeconfig_path" }}
    depends_on: this.argocd
  - 
    name: print_outputs
    type: printer
    depends_on: this.argocd_apps
    inputs:
      cluster_name: {{ .variables.cluster_name }}
      region: {{ .variables.region }}
      kubeconfig: *getKubeconfig
      k3s_version: {{ .variables.k3s_version }}
      argocd_url: https://argocd.{{ .variables.cluster_name }}.{{ .variables.domain }}
      grafana_url: https://grafana.{{ .variables.cluster_name }}.{{ .variables.domain }}