Skip to content
This repository was archived by the owner on Sep 27, 2024. It is now read-only.

Commit 27e3cea

Browse files
parisnakitakejserparisnakitakejser
committed
first commit for aws-eks infra
1 parent 6042168 commit 27e3cea

File tree

9 files changed

+248
-0
lines changed

9 files changed

+248
-0
lines changed

‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,4 @@
33
venv
44
cdk.out
55
.DS_Store
6+
aws/AWS-CDK/Neptune/create-neptune-cluster-with-bastion-host/.env

‎aws/AWS-CDK/EKS/setup-readonly-user-role-in-aws-eks/.gitignore

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
cdk.out
2+
*.pyc

‎aws/AWS-CDK/EKS/setup-readonly-user-role-in-aws-eks/README.md

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Cluster connection
2+
Kubernetes cluster init by AWS CDK
3+
4+
Connection to Kubernetes cluster using AWS CLI as administrator
5+
6+
```
7+
aws eks update-kubeconfig --name {cluster-name} --region {region} --role-arn arn:aws:iam::{account-id}:role/aws-eks-admin
8+
```
9+
10+
Connection to Kubernetes cluster using AWS CLI as readonly member
11+
12+
```
13+
aws eks update-kubeconfig --name {cluster-name} --region {region} --role-arn arn:aws:iam::{account-id}:role/aws-eks-readonly
14+
```

‎aws/AWS-CDK/EKS/setup-readonly-user-role-in-aws-eks/app.py

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
from aws_cdk import App, Environment
2+
from infrastructure.kubernetesStack import KubernetesStack
3+
4+
app = App()
5+
6+
env = Environment()
7+
8+
rds_stack = KubernetesStack(app, "KubernetesStack", env=env)
9+
10+
app.synth()

‎aws/AWS-CDK/EKS/setup-readonly-user-role-in-aws-eks/cdk.json

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
{
2+
"app": "python3 app.py"
3+
}

‎aws/AWS-CDK/EKS/setup-readonly-user-role-in-aws-eks/infrastructure/kubernetesStack.py

+173
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
from aws_cdk import (
2+
Stack,
3+
aws_eks as eks,
4+
aws_ec2 as ec2,
5+
aws_iam as iam,
6+
)
7+
from constructs import Construct
8+
9+
from infrastructure.networkStack import NetworkStack
10+
11+
12+
class KubernetesStack(Stack):
13+
def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
14+
super().__init__(scope, construct_id, **kwargs)
15+
16+
self.network = NetworkStack(self, "NetworkStack")
17+
18+
masters_role = iam.Role(
19+
self,
20+
"eks-admin",
21+
role_name="aws-eks-admin",
22+
assumed_by=iam.CompositePrincipal(
23+
iam.ServicePrincipal(service="eks.amazonaws.com"),
24+
iam.AnyPrincipal(), # importent, else a SSO user can't assume
25+
),
26+
)
27+
masters_role.add_managed_policy(
28+
iam.ManagedPolicy.from_aws_managed_policy_name("AdministratorAccess")
29+
)
30+
readonly_role = iam.Role(
31+
self,
32+
"eks-readonly",
33+
role_name="aws-eks-readonly",
34+
assumed_by=iam.CompositePrincipal(
35+
iam.ServicePrincipal(service="eks.amazonaws.com"),
36+
iam.AnyPrincipal(), # importent, else a SSO user can't assume
37+
),
38+
)
39+
readonly_role.add_managed_policy(
40+
iam.ManagedPolicy.from_aws_managed_policy_name("AdministratorAccess")
41+
)
42+
43+
cluster = eks.Cluster(
44+
self,
45+
"aws-eks",
46+
version=eks.KubernetesVersion.V1_25,
47+
masters_role=masters_role,
48+
cluster_name="aws-eks-cluster",
49+
default_capacity=0,
50+
cluster_logging=[
51+
eks.ClusterLoggingTypes.API,
52+
eks.ClusterLoggingTypes.AUTHENTICATOR,
53+
eks.ClusterLoggingTypes.SCHEDULER,
54+
eks.ClusterLoggingTypes.AUDIT,
55+
eks.ClusterLoggingTypes.CONTROLLER_MANAGER,
56+
],
57+
vpc=self.network.vpc,
58+
)
59+
60+
masters_role.grant_assume_role(cluster.admin_role)
61+
62+
cluster.aws_auth.add_role_mapping(
63+
readonly_role, groups=["system:authenticated"]
64+
)
65+
66+
self.__add_nodegroup(cluster=cluster)
67+
self.__add_addon(cluster=cluster)
68+
self.__add_readonly_member(
69+
cluster=cluster, readonly_role_arn=readonly_role.role_arn
70+
)
71+
72+
def __add_nodegroup(self, cluster: eks.Cluster):
73+
instance_type_name = "m6i.large"
74+
75+
self.nodegroup = eks.Nodegroup(
76+
self,
77+
"all-ng",
78+
cluster=cluster,
79+
nodegroup_name="primary-node-group",
80+
instance_types=[ec2.InstanceType(instance_type_name)],
81+
min_size=3,
82+
max_size=10,
83+
disk_size=100,
84+
labels={
85+
"instance-type": instance_type_name,
86+
},
87+
)
88+
89+
def __add_addon(self, cluster: eks.Cluster):
90+
eks.CfnAddon(
91+
self,
92+
"vpc-cni-addon",
93+
addon_name="vpc-cni",
94+
cluster_name=cluster.cluster_name,
95+
)
96+
eks.CfnAddon(
97+
self,
98+
"coredns-addon",
99+
addon_name="coredns",
100+
cluster_name=cluster.cluster_name,
101+
)
102+
eks.CfnAddon(
103+
self,
104+
"kube-proxy-addon",
105+
addon_name="kube-proxy",
106+
cluster_name=cluster.cluster_name,
107+
)
108+
eks.CfnAddon(
109+
self,
110+
"aws-ebs-csi-driver-addon",
111+
addon_name="aws-ebs-csi-driver",
112+
cluster_name=cluster.cluster_name,
113+
)
114+
115+
def __add_readonly_member(self, cluster: eks.Cluster, readonly_role_arn: str):
116+
cluster.add_manifest(
117+
"cluster-role",
118+
{
119+
"apiVersion": "rbac.authorization.k8s.io/v1",
120+
"kind": "ClusterRole",
121+
"metadata": {
122+
"name": "eks-access-cluster-role",
123+
"namespace": "kube-system",
124+
},
125+
"rules": [
126+
{
127+
"apiGroups": [""],
128+
"resources": [
129+
"configmaps",
130+
"services",
131+
"pods",
132+
"persistentvolumes",
133+
"namespaces",
134+
],
135+
"verbs": ["get", "list", "watch"],
136+
},
137+
{
138+
"apiGroups": [""],
139+
"resources": ["pods/log"],
140+
"verbs": ["get", "list"],
141+
},
142+
{
143+
"apiGroups": [""],
144+
"resources": ["pods/portforward", "services/portforward"],
145+
"verbs": ["create"],
146+
},
147+
],
148+
},
149+
)
150+
151+
cluster.add_manifest(
152+
"cluster-role-binding",
153+
{
154+
"apiVersion": "rbac.authorization.k8s.io/v1",
155+
"kind": "ClusterRoleBinding",
156+
"metadata": {
157+
"name": "iam-cluster-role-binding",
158+
"namespace": "kube-system",
159+
},
160+
"roleRef": {
161+
"apiGroup": "rbac.authorization.k8s.io",
162+
"kind": "ClusterRole",
163+
"name": "eks-access-cluster-role",
164+
},
165+
"subjects": [
166+
{
167+
"kind": "User",
168+
"name": readonly_role_arn,
169+
"apiGroup": "rbac.authorization.k8s.io",
170+
}
171+
],
172+
},
173+
)

‎aws/AWS-CDK/EKS/setup-readonly-user-role-in-aws-eks/infrastructure/networkStack.py

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
from aws_cdk import (
2+
NestedStack,
3+
aws_ec2 as ec2,
4+
)
5+
from constructs import Construct
6+
7+
8+
class NetworkStack(NestedStack):
9+
def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
10+
super().__init__(scope, construct_id, **kwargs)
11+
12+
self.vpc = ec2.Vpc(
13+
self,
14+
"VPC",
15+
ip_addresses=ec2.IpAddresses.cidr("10.10.0.0/16"), # 65,536
16+
subnet_configuration=[
17+
ec2.SubnetConfiguration(
18+
subnet_type=ec2.SubnetType.PUBLIC,
19+
name="Public",
20+
cidr_mask=24, # 256
21+
),
22+
ec2.SubnetConfiguration(
23+
subnet_type=ec2.SubnetType.PRIVATE_WITH_EGRESS,
24+
name="Private",
25+
cidr_mask=18, # 16,384
26+
),
27+
],
28+
max_azs=3,
29+
nat_gateways=3,
30+
)

‎aws/AWS-CDK/EKS/setup-readonly-user-role-in-aws-eks/requirements.txt

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
aws-cdk-lib==2.75.0
2+
flake8
3+
boto3
4+
black
5+
pyyaml

‎aws/AWS-CDK/EKS/setup-readonly-user-role-in-aws-eks/setup.cfg

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
[flake8]
2+
ignore = E501,F401,W503,F841,W293,E902,E203
3+
count = True
4+
exclude =
5+
**/ebawsconnect**,
6+
**/node_modules**,
7+
**/lib/**,
8+
**/site-packages/**,
9+
**/bin/**,
10+
**/versions/**

0 commit comments

Comments
 (0)