SlideShare a Scribd company logo

Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx

•Download as PPTX, PDF•
•
V
vanitakirdak

ththrhtrthhhhhhhrttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttddddddddhhrhtrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk

Data & Analytics
1 of 457
StackSimplify Terraform on AWS EKS Kubernetes - 50 Real-World Demos Kalyan Reddy Daida
StackSimplify © Kalyan Reddy Daida AWS EKS Kubernetes Azure AKS Kubernetes Google GKE Kubernetes AWS CloudFormation DevOps on AWS & Azure AWS ECS Docker on AWS Kubernetes Certifications CKAD, CKA, CKS HashiCorp Certified Terraform Associate on AWS with 50 Practical Demos HashiCorp Certified Vault & Consul Terraform on AWS with SRE and IaC DevOps with 20 Real-World Demos HashiCorp Certified Terraform Associate on Azure with 60+ Practical Demos Terraform on Azure with IaC DevOps SRE with 20+ Real-World Demos Jenkins Ansible Azure Certs AZ-900, 104, 204, 400 DevOps & SRE Roadmap AWS Lambda Google Cloud Associate & Professional Certs Azure AKS Part-2 Python Terraform on AWS EKS Elastic Kubernetes Service with 50+ Real-World Demos
StackSimplify Terraform on AWS EKS Kubernetes - 50 Real-World Demos Kalyan Reddy Daida
StackSimplify © Kalyan Reddy Daida Terraform Fundamentals (4.5 Hours) Kubernetes Fundamentals (3 Hours) AWS VPC 3-Tier Network EC2 Bastion Host in Public Subnets EKS Cluster (Public and Private Node Group) Kubernetes Deployment & Services using TF k8s Provider Terraform Remote State Storage (Key Concept for Real-World Implementation) EKS Cluster EKS IRSA (AWS IAM Roles for k8s Service Accounts) Kubernetes Storage: EBS CSI (5 Demos) EKS IAM (7 Demos) EKS Load Balancer Controller Ingress (17 Demos) EKS Fargate (3 Demos) Autoscaling (Cluster Autoscaler, HPA, VPA) EKS Monitoring and Logging (CloudWatch Agent + FluentBit) 50 Real-World Demos Kubernetes Storage: EFS CSI (4 Demos)
StackSimplify © Kalyan Reddy Daida GitHub Step-by-Step Documentation
StackSimplify © Kalyan Reddy Daida How are Terraform Projects organized ? 4 Terraform Projects 1 YAML Project EKS Cluster Terraform Project
StackSimplify © Kalyan Reddy Daida How are Terraform Projects organized ? AWS Load Balancer Controller Terraform Project AWS External DNS Terraform Project Ingress + External DNS YAML Project
StackSimplify © Kalyan Reddy Daida How are Terraform Projects organized ? Ingress + External DNS Terraform Project In short, every AWS EKS demo is automated with Terraform Every Terraform Project is organized in GitHub and contains step by step documentation
StackSimplify © Kalyan Reddy Daida AWS EKS Kubernetes Storage AWS EBS Volume Volume Volume Volume Volume AWS EBS CSI Install on EKS Kubernetes Sample App with EBS Volumes (YAML Manifests) Kubernetes Sample App with EBS Volumes (Terraform Manifests) D1 D2 D3 AWS EFS CSI Install on EKS AWS EFS Static Provisioning AWS EFS Dynamic Provisioning D1 D2 D3 Elastic File System (AWS EFS) File system File system File system File system AWS EFS Mounts for Fargate Workloads D4 EBS CSI Controller EFS CSI Controller EBS Volumes Resizing D4 EBS CSI Install using EKS Add-On D5
StackSimplify © Kalyan Reddy Daida AWS EKS Autoscaling, Monitoring & Logging Kubernetes Cluster Autoscaler Install Cluster Autoscaler Testing using Sample App Horizontal Pod Autoscaler with Sample App D1 D2 D3 EKS Monitoring & Logging (Implement using kubectl) EKS Monitoring & Logging (Automate with Terraform) D1 D2 Autoscaling Monitoring & Logging Vertical Pod Autoscaler Install D4 Vertical Pod Autoscaler Testing with Sample App D5 CloudWatch Agent FluentBit CloudWatch Agent FluentBit
StackSimplify © Kalyan Reddy Daida A Developer requesting full access to a namespace (dev) in EKS Cluster and in addition, also asking for read- only access to EKS Cluster 1. Kubernetes Role 2. Kubernetes Role Binding 3. Kubernetes Cluster Role 4. Kubernetes Cluster Role Binding Section-19 Section-20 Section-21 Section-22 Section-23 Section-24 Section-25 IAM IAM Policy IAM Role Kubernetes Config Map IAM User IAM Group Role Binding Role Cluster Role Binding Cluster Role AWS EKS IAM Demos Provision AWS IAM Admins as EKS Admins Provision AWS IAM Basic User as EKS Admin Automate Section-19,20 with Terraform Provision EKS Admins with AWS IAM Roles & IAM Groups Automate Section-22 with Terraform Provision EKS Read-Only Users with IAM Roles, IAM Groups, Kubernetes Cluster Role and Cluster Role Binding
StackSimplify © Kalyan Reddy Daida AWS Load Balancer Controller Install Ingress Basics Ingress Context Path Routing Ingress SSL & SSL Redirect Ingress Cross Namespaces External DNS Install Ingress + External DNS k8s Service + External DNS Ingress Name based Virtual Host Routing SSL Discovery - Host SSL Discovery - TLS Ingress Groups Ingress Target Type - IP Ingress Internal ALB D1 D2 D3 D4 D5 D6 D7 D8 D9 D10 D11 D12 D13 D14 AWS Load Balancer Controller AWS Application Load Balancer Kubernetes Ingress Service Terraform Kubernetes Provider AWS EKS Load Balancer Demos
StackSimplify © Kalyan Reddy Daida Network Load Balancer Basics Network Load Balancer TLS + External DNS Network Load Balancer Internal LB AWS Load Balancer Controller AWS Network Load Balancer Kubernetes Service Terraform Kubernetes Provider D15 D16 D17 AWS EKS Load Balancer Controller Demos AWS Fargate EKS Fargate Profiles Run k8s Workloads on Fargate Fargate Only EKS Cluster (VERY IMPORTANT) D1 D2 D3 EKS Cluster Fargate Elastic Load Balancing Application Load Balancer Network Load Balancer
StackSimplify © Kalyan Reddy Daida Terraform Providers AWS Kubernetes Kubectl HELM NULL HTTP Terraform Providers
StackSimplify © Kalyan Reddy Daida GitHub Repository Repository Used For Repository URL Course Main Repository with step-by-step documentation https://github.com/stacksimplify/terraform-on-aws-eks
StackSimplify © Kalyan Reddy Daida END OF INTRODUCTION
StackSimplify © Kalyan Reddy Daida Terraform Infrastructure as Code IaC
StackSimplify © Kalyan Reddy Daida What is Infrastructure as Code ?
StackSimplify © Kalyan Reddy Daida Traditional Way of Managing Infrastructure Dev QA Staging Production Disaster Recovery Admin-1 Admin-1 Documentation Admin-2 Admin-2 Admin-2 5 Days 5 Days 5 Days 5 Days 5 Days Total Time: 25 Days
StackSimplify © Kalyan Reddy Daida Traditional Way of Managing Infrastructure Dev QA Staging Production Disaster Recovery Admin-1 Admin-1 Documentation (Steps Missing) Admin-2 Admin-2 Admin-2 No CI Delays Issues Outages Not-in- Sync Many Problems at many places in manual process
StackSimplify © Kalyan Reddy Daida Traditional Way of Managing Infrastructure Dev QA Staging Production Disaster Recovery Admin-1 Admin-1 Documentation Admin-2 Admin-2 Admin-2 Infrastructure scalability – Workforce need to be increased to meet the timelines Dev QA Staging Production Disaster Recovery Documentation Admin-3 Admin-3 Admin-4 Admin-4 Admin-4
StackSimplify © Kalyan Reddy Daida Traditional Way of Managing Infrastructure Prod-1 Prod-2 Prod-3 Prod-4 On-Demand Scale-Up and Scale-Down is not an option Prod-1 Prod-2 Scale Up Scale Down
StackSimplify © Kalyan Reddy Daida Manage using IaC with Terraform Dev QA Staging Production Disaster Recovery Admin-1 5 Days Total Time: 25 Days reduced to 5 days, Provisioning environments will be in minutes or seconds Check-In TF Code Triggers TF Runs Creates Infra Terraform Cloud One-Time Work Re-Use Template s Quick & Fast Reliable Tracked for Audit DevOps / CI CD for IaC Scale-Up and Scale-Down On-Demand Github
StackSimplify © Kalyan Reddy Daida Manage using IaC with Terraform Visibility IaC serves as a very clear reference of what resources we created, and what their settings are. We don’t have to navigate to the web console to check the parameters. Stability If you accidentally change the wrong setting or delete the wrong resource in the web console you can break things. IaC helps solve this, especially when it is combined with version control, such as Git. Scalability With IaC we can write it once and then reuse it many times. This means that one well written template can be used as the basis for multiple services, in multiple regions around the world, making it much easier to horizontally scale. Security Once again IaC gives you a unified template for how to deploy our architecture. If we create one well secured architecture we can reuse it multiple times, and know that each deployed version is following the same settings. Audit Terraform not only creates resources it also maintains the record of what is created in real world cloud environments using its State files.
StackSimplify © Kalyan Reddy Daida Google Trends – Past 5 Years
StackSimplify © Kalyan Reddy Daida Google Trends – Past 1 Year
StackSimplify © Kalyan Reddy Daida Terraform Site Reliability Engineering SRE
StackSimplify © Kalyan Reddy Daida What is SRE?
StackSimplify © Kalyan Reddy Daida 50% Infrastructure Automation 50% Operations Site Reliability Engineering - SRE Our course primarily focuses on Infrastructure Automation which will be a key role for an SRE even though weightage is 50%
StackSimplify © Kalyan Reddy Daida Terraform Installation
StackSimplify © Kalyan Reddy Daida Terraform Installation Terraform CLI AWS CLI VS Code Editor Terraform plugin for VS Code Mac OS Linux OS Windows OS
StackSimplify © Kalyan Reddy Daida Terraform Command Basics
StackSimplify © Kalyan Reddy Daida init validate plan apply destroy 1 2 3 4 5 terraform init terraform validate terraform plan terraform apply terraform destroy Terraform Workflow
StackSimplify © Kalyan Reddy Daida init validate plan apply destroy 1 2 3 4 5 • Used to Initialize a working directory containing terraform config files • This is the first command that should be run after writing a new Terraform configuration • Downloads Providers • Validates the terraform configurations files in that respective directory to ensure they are syntactically valid and internally consistent. • Creates an execution plan • Terraform performs a refresh and determines what actions are necessary to achieve the desired state specified in configuration files • Used to apply the changes required to reach the desired state of the configuration. • By default, apply scan s the current directory for the configuration and applies the changes appropriately. • Used to destroy the Terraform- managed infrastructure • This will ask for confirmation before destroying. Terraform Workflow
StackSimplify © Kalyan Reddy Daida Terraform Language Basics
StackSimplify © Kalyan Reddy Daida • Code in the Terraform language is stored in plain text files with the .tf file extension. • There is also a JSON-based variant of the language that is named with the .tf.json file extension. • We can call the files containing terraform code as Terraform Configuration Files or Terraform Manifests Terraform Language Basics – Files Terraform Working Directory Terraform Configuration Files ending with .tf as extension
StackSimplify © Kalyan Reddy Daida Terraform Language Basics – Configuration Syntax Blocks Arguments Identifiers Comments HCL – HashiCorp Language Terraform
StackSimplify © Kalyan Reddy Daida Terraform Language Basics – Configuration Syntax Block Type Block Labels Arguments Based on Block Type block labels will be 1 or 2 Example: Resource – 2 labels Variables – 1 label Top Level & Block inside Blocks Top Level Blocks: resource, provider Block Inside Block: provisioners, resource specific blocks like tags
StackSimplify © Kalyan Reddy Daida Terraform Language Basics – Configuration Syntax Argument Name [or] Identifier Argument Value [or] Expression
StackSimplify © Kalyan Reddy Daida Terraform Language Basics – Configuration Syntax Single Line Comments with # or // Multi-line comment
StackSimplify © Kalyan Reddy Daida Terraform Block Providers Block Resources Block Input Variables Block Output Values Block Data Sources Block Modules Block Local Values Block Terraform Top-Level Blocks Fundamental Blocks Variable Blocks Calling / Referencing Blocks Terraform language uses a limited number of top-level block types, which are blocks that can appear outside of any other block in a TF configuration file. Most of Terraform's features are implemented as top-level blocks.
StackSimplify © Kalyan Reddy Daida Terraform Fundamental Blocks
StackSimplify © Kalyan Reddy Daida Terraform Basic Blocks Terraform Block Provider Block Resource Block Special block used to configure some behaviors Required Terraform Version List Required Providers Terraform Backend HEART of Terraform Terraform relies on providers to interact with Remote Systems Declare providers for Terraform to install providers & use them Provider configurations belong to Root Module Each Resource Block describes one or more Infrastructure Objects Resource Syntax: How to declare Resources? Resource Behavior: How Terraform handles resource declarations? Provisioners: We can configure Resource post-creation actions c1-versions.tf c2-resource-name.tf
StackSimplify © Kalyan Reddy Daida Terraform Block
StackSimplify © Kalyan Reddy Daida • This block can be called in 3 ways. All means the same. • Terraform Block • Terraform Settings Block • Terraform Configuration Block • Each terraform block can contain a number of settings related to Terraform's behavior. • VERY VERY IMPORTANT TO MEMORIZE • Within a terraform block, only constant values can be used; arguments may not refer to named objects such as resources, input variables, etc, and may not use any of the Terraform language built-in functions. Terraform Block
StackSimplify © Kalyan Reddy Daida Terraform Block from 0.13 onwards
StackSimplify © Kalyan Reddy Daida Terraform Block Terraform Block Required Terraform Version Provider Requirements Terraform Backend Experimental Language Features Passing Metadata to Providers
StackSimplify © Kalyan Reddy Daida Terraform Providers
StackSimplify © Kalyan Reddy Daida Terraform Providers AWS Cloud VPC Public subnet EC2 Instance AWS APIs Terraform Admin Local Desktop Terraform CLI Terraform AWS Provider Terraform Registry terraform init terraform plan terraform destroy terraform apply Providers are HEART of Terraform Without Providers Terraform cannot manage any infrastructure. Providers are distributed separately from Terraform and each provider has its own release cycles and Version Numbers Terraform Registry is publicly available which contains many Terraform Providers for most major Infra Platforms Every Resource Type (example: EC2 Instance), is implemented by a Provider 1 2 terraform validate 3 4 5
StackSimplify © Kalyan Reddy Daida Provider Requirements Provider Configuration Dependency Lock File Terraform Providers
StackSimplify © Kalyan Reddy Daida Dependency Lock File
StackSimplify © Kalyan Reddy Daida Required Providers Local Names Local Names are Module specific and should be unique per-module Terraform configurations always refer to local name of provider outside required_provider block Users of a provider can choose any local name for it (myaws, aws1, aws2). Recommended way of choosing local name is to use preferred local name of that provider (For AWS Provider: hashicorp/aws, preferred local name is aws) Source It is the primary location where we can download the Terraform Provider Source addresses consist of three parts delimited by slashes (/) [<HOSTNAME>/]<NAMESPACE>/<TYPE> registry.terraform.io/hashicorp/aws Registry Name is optional as default is going to be Terraform Public Registry
StackSimplify © Kalyan Reddy Daida Terraform Provider Registry Providers Modules Provider Badges Provider Documentation These are owned and maintained by HashiCorp These are owned and maintained by third-party technology partners. HashiCorp has verified the authenticity of the Provider’s publisher Community providers are published to the Terraform Registry by individual maintainers, groups of maintainers, or other members of the Terraform community. Archived Providers are Official or Verified Providers that are no longer maintained by HashiCorp or the community. registry.terraform.io Terraform Registry
StackSimplify © Kalyan Reddy Daida Terraform Resources Introduction
StackSimplify © Kalyan Reddy Daida Terraform Language Basics – Configuration Syntax Block Type Block Labels Arguments Based on Block Type block labels will be 1 or 2 Example: Resource – 2 labels Variables – 1 label Top Level & Block inside Blocks Top Level Blocks: resource, provider Block Inside Block: provisioners, resource specific blocks like tags
StackSimplify © Kalyan Reddy Daida Resource Syntax Resource Type: It determines the kind of infrastructure object it manages and what arguments and other attributes the resource supports. Resource Local Name: It is used to refer to this resource from elsewhere in the same Terraform module, but has no significance outside that module's scope. The resource type and name together serve as an identifier for a given resource and so must be unique within a module Meta-Arguments: Can be used with any resource to change the behavior of resources Resource Arguments: Will be specific to resource type. Argument Values can make use of Expressions or other Terraform Dynamic Language Features
StackSimplify © Kalyan Reddy Daida Terraform State
StackSimplify © Kalyan Reddy Daida Resource Behavior Terraform Resource Create Resource Destroy Resource Update in-place Resources Destroy and re- create Create resources that exist in the configuration but are not associated with a real infrastructure object in the state. Destroy resources that exist in the state but no longer exist in the configuration. Update in-place resources whose arguments have changed. Destroy and re-create resources whose arguments have changed but which cannot be updated in-place due to remote API limitations. Terraform State
StackSimplify © Kalyan Reddy Daida Terraform State AWS Cloud VPC Public subnet EC2 Instance AWS APIs Terraform Admin Local Desktop Terraform CLI Terraform AWS Provider Terraform Registry terraform init terraform plan terraform destroy terraform apply This state is stored by default in a local file named "terraform.tfstate", but it can also be stored remotely, which works better in a team environment. The primary purpose of Terraform state is to store bindings between objects in a remote system and resource instances declared in your configuration. 1 2 terraform validate 3 4 5 Terraform State File terraform.tfstate Terraform must store state about your managed infrastructure and configuration This state is used by Terraform to map real world resources to your configuration (.tf files), keep track of metadata, and to improve performance for large infrastructures. When Terraform creates a remote object in response to a change of configuration, it will record the identity of that remote object against a particular resource instance, and then potentially update or delete that object in response to future configuration changes.
StackSimplify © Kalyan Reddy Daida Desired & Current Terraform States terraform.tfstate Terraform Configuration Files Real World Resource – EC2 Instance Desired State Current State
StackSimplify © Kalyan Reddy Daida Terraform Input Variables Datasources Outputs
StackSimplify © Kalyan Reddy Daida What are we going to learn ? Default VPC AWS Cloud Public subnet EC2 Instance Security group VPC-SSH Security group VPC-Web EC2 Key Pair Terraform Input Variables Terraform Output Values Terraform Datasources Terraform Concepts AWS Services Dynamically get latest AMI ID
StackSimplify © Kalyan Reddy Daida Terraform Variables Terraform Input Variables Terraform Output Values Terraform Local Values
StackSimplify © Kalyan Reddy Daida Terraform Input Variables Terraform Input Variables Input Variables - Basics Provide Input Variables when prompted during terraform plan or apply Override default variable values using CLI argument -var Override default variable values using Environment Variables (TF_var_aa) Provide Input Variables using terraform.tfvars files Provide Input Variables using <any- name>.tfvars file with CLI argument -var-file Provide Input Variables using auto.tfvars files Implement complex type constructors like List & Map in Input Variables Implement Custom Validation Rules in Variables Protect Sensitive Input Variables Input variables serve as parameters for a Terraform module, allowing aspects of the module to be customized without altering the module's own source code, and allowing modules to be shared between different configurations. 1 2 3 4 5 6 7 8 9 10
StackSimplify © Kalyan Reddy Daida Terraform Datasources Data sources allow data to be fetched or computed for use elsewhere in Terraform configuration. Use of data sources allows a Terraform configuration to make use of information defined outside of Terraform, or defined by another separate Terraform configuration. A data source is accessed via a special kind of resource known as a data resource, declared using a data block Each data resource is associated with a single data source, which determines the kind of object (or objects) it reads and what query constraint arguments are available Data resources have the same dependency resolution behavior as defined for managed resources. Setting the depends_on meta- argument within data blocks defers reading of the data source until after all changes to the dependencies have been applied.
StackSimplify © Kalyan Reddy Daida Terraform Datasources We can refer the data resource in a resource as depicted Data resources support count and for_each meta-arguments as defined for managed resources, with the same syntax and behavior. Each instance will separately read from its data source with its own variant of the constraint arguments, producing an indexed result. Data resources support the provider meta-argument as defined for managed resources, with the same syntax and behavior. Data resources do not currently have any customization settings available for their lifecycle, but the lifecycle nested block is reserved in case any are added in future versions. Meta-Arguments for Datasources
StackSimplify © Kalyan Reddy Daida Terraform Variables – Output Values Terraform Variables Outputs A root module can use outputs to print certain values in the CLI output after running terraform apply. When using remote state, root module outputs can be accessed by other configurations via a terraform_remote_state d ata source. A child module can use outputs to expose a subset of its resource attributes to a parent module. Output values are like the return values of a Terraform module and have several uses 1 2 3 Advanced
StackSimplify © Kalyan Reddy Daida Terraform For Loops Lists & Maps Meta-Argument Count & for_each
StackSimplify © Kalyan Reddy Daida Meta-Argument: count Variables: Lists & Maps For Loop with Lists For Loop with Maps For Loops with Advanced Maps Legacy Splat Operator (.*.) Latest Splat Operator [*] Meta-Argument: for_each Function: toset Function: tomap Datasource: aws_availability_zones Datasource: aws_ec2_instance_type_offerings Datasource: aws_availability_zones For Loop with Maps For Loop with if Function: keys Section-1 Section-2 Section-3 Section-4 Fix issues in Section-2 with section-3 Final Output Utility Project with Datasources
StackSimplify © Kalyan Reddy Daida AWS VPC 3-Tier Web, App and DB Amazon Virtual Private Cloud (Amazon VPC) Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet
StackSimplify © Kalyan Reddy Daida AWS VPC 3-Tier Architecture VPC AWS Cloud Availability Zone 1 Availability Zone 2 Private subnet Public subnet For EC2 Instances NAT gateway Private subnet For Databases Private subnet Public subnet For EC2 Instances NAT gateway Private subnet For Databases Internet gateway Outbound Communication Build manually using AWS Mgmt Console Build same using Terraform Terraform Modules Terraform Local Values Terraform Variables – terraform.tfvars Terraform Variables – vpc.auto.tfvars Terraform Version Constraints Terraform Code Organizing – Production Grade style Elastic IP address Elastic IP address
StackSimplify © Kalyan Reddy Daida What are we going to Learn ? Build VPC manually using AWS Management Console Build VPC using Terraform Modules Standardize the Terraform Code at Production Grade
StackSimplify © Kalyan Reddy Daida Terraform Modules Modules are containers for multiple resources that are used together. A module consists of a collection of .tf files kept together in a directory. Modules are the main way to package and reuse resource configurations with Terraform. Every Terraform configuration has at least one module, known as its root module, which consists of the resources defined in the .tf files in the main working directory A Terraform module (usually the root module of a configuration) can call other modules to include their resources into the configuration. Child modules can be called multiple times within the same configuration, and multiple configurations can use the same child module. In addition to modules from the local filesystem, Terraform can load modules from a public or private registry. This makes it possible to publish modules for others to use, and to use modules that others have published. A module that has been called by another module is often referred to as a child module.
StackSimplify © Kalyan Reddy Daida AWS EC2 Bastion Host Terraform Provisioners Amazon Virtual Private Cloud (Amazon VPC) Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM
StackSimplify © Kalyan Reddy Daida VPC AWS Cloud Availability Zone 1 Availability Zone 2 Private subnet Public subnet NAT gateway Private subnet For Databases Private subnet Public subnet Private subnet For Databases Internet gateway Outbound Communication Elastic IP address Bastion EC2 Instance Bastion Host Security group port 22 Destination: 0.0.0.0/0 AWS VPC + EC2 Instance + Security Groups Terraform & AWS Concepts Terraform Module: VPC Terraform Module: Security Group Terraform Module: AWS EC2 Instance Meta-Argument: depends_on Terraform null_resource Terraform File Provisioner Terraform Remote-exec Provisioner Terraform Local-exec Provisioner Admin SSH Port 22 EKS Cluster Tags for VPC Subnets Elastic IP address Terraform Datasource: aws_availability_zones (Dynamic)
StackSimplify © Kalyan Reddy Daida What are we going to learn ? Create AWS VPC using Terraform Modules + Update AZs Create AWS Security Groups using Terraform Modules Create AWS EC2 Instance using Terraform Modules Null Resource File Provisioner Remote-exec Provisioner Create AWS AMI Datasource to get latest AMI ID dynamically Local-exec Provisioner Variables defined in .tfvars and .auto.tfvars formats Define generic variables and Local Values Create AWS EC2 Elastic IP for Bastion Host EC2 Instance Create Terraform Provisioners with Null Resource EKS Variables
StackSimplify © Kalyan Reddy Daida Types of Provisioners Provisioner Types File Provisioner remote-exec Provisioner local-exec Provisioner Null Resource Connection Block Terraform Provisioners Concepts
StackSimplify © Kalyan Reddy Daida Terraform Provisioners Provisioners can be used to model specific actions on the local machine or on a remote machine in order to prepare servers Passing data into virtual machines and other compute resources Running configuration management software (packer, chef, ansible) Provisioners are a Last Resort First-class Terraform provider functionality may be available Creation-Time Provisioners Destroy-Time Provisioners Failure Behaviour: Continue: Ignore the error and continue with creation or destruction. Failure Behaviour: Fail: Raise an error and stop applying (the default behavior). If creation provisioner fails, taint resource Most provisioners require access to the remote resource via SSH or WinRM, and expect a nested connection block with details about how to connect. Connection Block
StackSimplify © Kalyan Reddy Daida Provisioners Introduction File Provisioner • File Provisioner is used to copy files or directories from the machine executing Terraform to the newly created resource. • The file provisioner supports both ssh and winrm type of connections remote-exec Provisioner • The remote-exec provisioner invokes a script on a remote resource after it is created. • This can be used to run a configuration management tool, bootstrap into a cluster, etc. local-exec Provisioner • The local-exec provisioner invokes a local executable after a resource is created. • This invokes a process on the machine running Terraform, not on the resource. null_resource • If you need to run provisioners that aren't directly associated with a specific resource, you can associate them with a null_resource. • Instances of null_resource are treated like normal resources, but they don't do anything. • Same as other resource, you can configure provisioners and connection details on a null_resource.
StackSimplify © Kalyan Reddy Daida AWS EKS Cluster
StackSimplify © Kalyan Reddy Daida AWS EKS – Core Objects EKS Cluster EKS Control Plane Worker Nodes & Node Groups Fargate Profiles (Serverless) VPC Contains Kubernetes Master components like etcd, kube- apiserver, kube- controller. It’s a managed service by AWS Group of EC2 Instances where we run our Application workloads Instead of EC2 Instances, we run our Application workloads on Serverless Fargate profiles With AWS VPC we follow secure networking standards which will allow us to run production workloads on EKS.
StackSimplify © Kalyan Reddy Daida How does EKS work? © Amazon
StackSimplify © Kalyan Reddy Daida EKS Control Plane 1. EKS runs a single tenant Kubernetes control plane for each cluster, and control plane infrastructure is not shared across clusters or AWS accounts. 2. This control plane consists of at least two API server nodes and three etcd nodes that run across three Availability Zones within a Region 3. EKS automatically detects and replaces unhealthy control plane instances, restarting them across the Availability Zones within the Region as needed. Worker Nodes & Node Groups 1. Worker machines in Kubernetes are called nodes. These are EC2 Instances 2. EKS worker nodes run in our AWS account and connect to our cluster's control plane via the cluster API server endpoint. 3. A node group is one or more EC2 instances that are deployed in an EC2 Autoscaling group. 4. All instances in a node group must 1. Be the same instance type 2. Be running the same AMI 3. Use the same EKS worker node IAM role EKS Cluster – Core Objects Detailed
StackSimplify © Kalyan Reddy Daida Fargate Profiles 1. AWS Fargate is a technology that provides on-demand, right-sized compute capacity for containers 2. With Fargate, we no longer have to provision, configure, or scale groups of virtual machines to run containers. 3. Each pod running on Fargate has its own isolation boundary and does not share the underlying kernel, CPU resources, memory resources, or elastic network interface with another pod. 4. AWS specially built Fargate controllers that recognizes the pods belonging to fargate and schedules them on Fargate profiles. 5. We will see more in our Fargate learning section. VPC 1. EKS uses AWS VPC network policies to restrict traffic between control plane components to within a single cluster. 2. Control plane components for a EKS cluster cannot view or receive communication from other clusters or other AWS accounts, except as authorized with Kubernetes RBAC policies. 3. This secure and highly-available configuration makes EKS reliable and recommended for production workloads. EKS Cluster – Core Objects Detailed
StackSimplify © Kalyan Reddy Daida Kubernetes Architecture
StackSimplify © Kalyan Reddy Daida Kubernetes Architecture
StackSimplify © Kalyan Reddy Daida Kubernetes - Architecture Kube Controller Manager Cloud Controller Manager kube-apiserver kube- scheduler etcd Container Runtime (Docker) Master Kube-Proxy Worker Node Kubelet Container Runtime (Docker) Kube-Proxy Worker Node Kubelet Container Runtime (Docker)
StackSimplify © Kalyan Reddy Daida Kubernetes Architecture - Master Kube Controller Manager Cloud Controller Manager kube-apiserver kube- scheduler etcd Container Runtime (Docker) Master • kube-apiserver • It acts as front end for the Kubernetes control plane. It exposes the Kubernetes API • Command line tools (like kubectl), Users and even Master components (scheduler, controller manager, etcd) and Worker node components like (Kubelet) everything talk with API Server. • etcd • Consistent and highly-available key value store used as Kubernetes’ backing store for all cluster data. • It stores all the masters and worker node information. • kube-scheduler • Scheduler is responsible for distributing containers across multiple nodes. • It watches for newly created Pods with no assigned node, and selects a node for them to run on.
StackSimplify © Kalyan Reddy Daida Kubernetes Architecture - Master Kube Controller Manager Cloud Controller Manager kube-apiserver kube- scheduler etcd Container Runtime (Docker) Master • kube-controller-manager • Controllers are responsible for noticing and responding when nodes, containers or endpoints go down. They make decisions to bring up new containers in such cases. • Node Controller: Responsible for noticing and responding when nodes go down. • Replication Controller: Responsible for maintaining the correct number of pods for every replication controller object in the system. • Endpoints Controller: Populates the Endpoints object (that is, joins Services & Pods) • Service Account & Token Controller: Creates default accounts and API Access for new namespaces.
StackSimplify © Kalyan Reddy Daida Kubernetes Architecture - Master Kube Controller Manager Cloud Controller Manager kube-apiserver kube- scheduler etcd Container Runtime (Docker) Master • cloud-controller-manager • A Kubernetes control plane component that embeds cloud-specific control logic. • It only runs controllers that are specific to your cloud provider. • On-Premise Kubernetes clusters will not have this component. • Node controller: For checking the cloud provider to determine if a node has been deleted in the cloud after it stops responding • Route controller: For setting up routes in the underlying cloud infrastructure • Service controller: For creating, updating and deleting cloud provider load balancer
StackSimplify © Kalyan Reddy Daida • Kubelet • Kubelet is the agent that runs on every node in the cluster • This agent is responsible for making sure that containers are running in a Pod on a node. • Kube-Proxy • It is a network proxy that runs on each node in your cluster. • It maintains network rules on nodes • In short, these network rules allow network communication to your Pods from network sessions inside or outside of your cluster. Kubernetes Architecture – Worker Nodes Kube-Proxy Worker Node Kubelet Container Runtime (Docker) • Container Runtime • Container Runtime is the underlying software where we run all these Kubernetes components. • We are using Docker, but we have other runtime options like rkt, container-d etc.
StackSimplify © Kalyan Reddy Daida Kubernetes - Architecture Kube Controller Manager Cloud Controller Manager kube-apiserver kube- scheduler etcd Container Runtime (Docker) Master Kube-Proxy Worker Node Kubelet Container Runtime (Docker) Kube-Proxy Worker Node Kubelet Container Runtime (Docker)
StackSimplify © Kalyan Reddy Daida AWS EKS Cluster
StackSimplify © Kalyan Reddy Daida EKS Kubernetes - Architecture EKS Controller Manager Fargate Controller Manager kube-apiserver kube- scheduler etcd Container Runtime Master Kube-Proxy Worker Node -1 Kubelet Container Runtime (Docker) Kube-Proxy Worker Node - 2 Kubelet Container Runtime EKS Control Plane EKS Node Group
StackSimplify © Kalyan Reddy Daida AWS EKS Cluster & Node Groups using Terraform Amazon Virtual Private Cloud (Amazon VPC) Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster
StackSimplify © Kalyan Reddy Daida EKS Cluster Creation Options using Terraform Terraform Resources Terraform Module from Terraform Public Registry
StackSimplify © Kalyan Reddy Daida AWS EKS Resources - High Level Breakdown Subnets (Public / Private) Route Tables NAT Gateway + Elastic IP Internet Gateway EKS Cluster IAM Role EKS Cluster Security Group EKS Cluster Network Interfaces EKS Node Group IAM Role EKS Node Group Security Group EKS Node Group Network Interfaces EKS Worker Nodes EC2 Instances Bastion Host EC2 Instance Bastion Host Security Group Bastion Host Elastic IP VPC Bastion Host (Optional) EKS Cluster EKS Node Group Pre-requisite Resources EKS Resources EKS Cluster
StackSimplify © Kalyan Reddy Daida VPC (our AWS Account) AWS Cloud Availability Zone 1 Availability Zone 2 Private subnet Public subnet NAT gateway Private subnet Public subnet Internet gateway Private NG Security group – Port 22 Bastion EC2 Instance EKS Worker Node EKS Worker Node Bastion Security group Destination: 0.0.0.0/0 Destination: 0.0.0.0/0 EKS Cluster & EKS Node Groups in Public and Private Subnets Admin SSH 22 EKS Node Group in Private Subnets Public NG Security group – Port 22 EKS Worker Node EKS Worker Node Destination: 0.0.0.0/0 EKS Node Group in Public Subnets Elastic IP EKS Elastic network interface EKS Elastic network interface VPC (Amazon EKS) EKS Control Plane Amazon Elastic Container Registry (Amazon ECR) Public Node Group – Access to EKS API Server Endpoint Private Node Group – Access to EKS API Server Endpoint via NAT Gateway NATGW Elastic IP IAM Role for EKS Cluster IAM Role for EKS Node Groups AWS Identity and Access Management (IAM) EKS Cluster Security group kubectl Client Run kubectl commands by accessing EKS API Server Endpoint via Internet EKS Elastic Network Interfaces A
StackSimplify © Kalyan Reddy Daida VPC (our AWS Account) AWS Cloud Availability Zone 1 Availability Zone 2 Private subnet Public subnet NAT gateway Private subnet Public subnet Internet gateway Private NG Security group – Port 22 Bastion EC2 Instance EKS Node Instance EKS Node Instance Bastion Security group Destination: 0.0.0.0/0 Destination: 0.0.0.0/0 EKS Cluster & EKS Node Groups in Public and Private Subnets Admin SSH 22 EKS Node Group in Private Subnets Public NG Security group – Port 22 EKS Node Instance EKS Node Instance Destination: 0.0.0.0/0 EKS Node Group in Public Subnets Elastic IP EKS Elastic network interface EKS Elastic network interface VPC (Amazon EKS) EKS Control Plane Amazon Elastic Container Registry (Amazon ECR) Public Node Group – Access to EKS API Server Endpoint Private Node Group – Access to EKS API Server Endpoint via NAT Gateway NATGW Elastic IP IAM Role for EKS Cluster IAM Role for EKS Node Groups AWS Identity and Access Management (IAM) EKS Cluster Security group kubectl Client Run kubectl commands by accessing EKS API Server Endpoint via Internet EKS Elastic Network Interfaces
StackSimplify © Kalyan Reddy Daida What are we going to learn ? Create AWS VPC using Terraform Modules Create AWS EC2 Bastion Host Define generic variables and Local Values C1 to C4-07 same as previous Section-07
StackSimplify © Kalyan Reddy Daida What are we going to learn ? Define EKS Outputs Define EKS Variables Create EKS Security Groups – Placeholder file Define IAM Roles for EKS Cluster and Node Groups Define EKS Node Group in Public Subnet Define EKS Cluster TF Configs EKS Variables autoload during Terraform Apply Define EKS Node Group in Private Subnet
StackSimplify © Kalyan Reddy Daida Time it takes to complete this Demo Real-World Demo 3
StackSimplify © Kalyan Reddy Daida VPC (our AWS Account) AWS Cloud Availability Zone 1 Availability Zone 2 Private subnet Public subnet NAT gateway Private subnet Public subnet Internet gateway Private NG Security group – Port 22 Bastion EC2 Instance EKS Node Instance EKS Node Instance Bastion Security group Destination: 0.0.0.0/0 Destination: 0.0.0.0/0 EKS Cluster & EKS Node Groups in Public and Private Subnets Admin SSH 22 EKS Node Group in Private Subnets Public NG Security group – Port 22 EKS Node Instance EKS Node Instance Destination: 0.0.0.0/0 EKS Node Group in Public Subnets Elastic IP EKS Elastic network interface EKS Elastic network interface VPC (Amazon EKS) EKS Control Plane Amazon Elastic Container Registry (Amazon ECR) Public Node Group – Access to EKS API Server Endpoint Private Node Group – Access to EKS API Server Endpoint via NAT Gateway NATGW Elastic IP IAM Role for EKS Cluster IAM Role for EKS Node Groups AWS Identity and Access Management (IAM) EKS Cluster Security group kubectl Client Run kubectl commands by accessing EKS API Server Endpoint via Internet EKS Elastic Network Interfaces
StackSimplify © Kalyan Reddy Daida • Elastic Network Interfaces (ENI) • When you create the cluster, Amazon EKS creates and manages network interfaces in your account that have Amazon EKS <cluster name> in their description. • These network interfaces allow AWS Fargate and Amazon EC2 instances to communicate with the EKS control plane present in Amazon VPC in Amazon Account (Not our AWS Account). • The Amazon EKS created cluster security group and any additional security groups that you specify when you create your cluster are applied to these network interfaces. • Very Important Note: These Network Interfaces were created in our EKS VPC in our AWS account but attached to EKS Control Plane Master Node instances of Amazon VPC. AWS EKS Resources - High Level Breakdown
StackSimplify © Kalyan Reddy Daida EKS Control Plane - Network Interfaces Network Interfaces created by EKS Control Plane in our EKS VPC. These are created and managed by EKS Network Interface description is outlined as Amazon EKS <CLUSTER-NAME>
StackSimplify © Kalyan Reddy Daida EKS ENI Our Amazon Account ID Private IP of from our EKS VPC Public Subnet Amazon VPC Account ID where EKS Control Plane is hosted Our EKS VPC ID
StackSimplify © Kalyan Reddy Daida AWS Elastic Network Interface Basic Understanding Just to understand AWS Elastic Network Interface concept
StackSimplify © Kalyan Reddy Daida AWS EKS Deployment & Service Amazon Virtual Private Cloud (Amazon VPC) Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster
StackSimplify © Kalyan Reddy Daida Kubernetes Sample Application default namespace NodePort Service Load Balancer Service (AWS Classic LB) Network Load Balancer Service (AWS NLB) EKS Cluster k8s Pods k8s ReplicaSet k8s Deployment http://<worker-node-publicip>:<node-port> http//<clb-dns-url> http//<nlb-dns-url>
StackSimplify © Kalyan Reddy Daida VPC (our AWS Account) AWS Cloud Availability Zone 1 Availability Zone 2 Public subnet Public subnet Internet gateway Kubernetes Deployment & Services - Architecture Public NG Security group EKS Node Instance EKS Node Group in Public Subnets EKS Elastic network interface EKS Elastic network interface VPC (Amazon EKS) EKS Control Plane Access to EKS API Server Endpoint EKS Cluster Security group kubectl Client Run kubectl commands by accessing EKS API Server Endpoint via Internet EKS Elastic Network Interfaces EKS Node Instance Kubernetes Service: LoadBalancer (AWS CLB) Kubernetes Service: LoadBalancer (AWS NLB) Kubernetes Service: NodePort k8s Services Deploy kube-manifests Users Docker Hub Pull Docker Image from Docker Hub
StackSimplify © Kalyan Reddy Daida What are we going to learn ? Create k8s Load Balancer Service Manifest (AWS CLB) Create k8s Deployment Manifest Create k8s Load Balancer Service Manifest (AWS NLB) Create k8s Node Port Service Manifest (Not recommended for prod) Kubernetes Manifests using YAML
StackSimplify © Kalyan Reddy Daida AWS EKS Deployment & Service using Terraform Provider Amazon Virtual Private Cloud (Amazon VPC) Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster
StackSimplify © Kalyan Reddy Daida Kubernetes Sample Application default namespace NodePort Service Load Balancer Service (AWS Classic LB) Network Load Balancer Service (AWS NLB) EKS Cluster k8s Pods k8s ReplicaSet k8s Deployment http://<worker-node-publicip>:<node-port> http//<clb-dns-url> http//<nlb-dns-url> Terraform Kubernetes Provider
StackSimplify © Kalyan Reddy Daida Terraform Remote State Datasource The terraform_remote_state data source retrieves the root module output values from project-1 Terraform configuration, using the latest state snapshot from the remote backend. Project-1 Project-2 project-1/terraform.tfstate project-2/terraform.tfstate terraform_remote_state data source Terraform Resources 1. AWS VPC 2. Bastion Host 3. EKS Cluster 4. EKS Node Groups 5. EKS Outputs Terraform Resources 1. Kubernetes Provider 2. Kubernetes Deployment 3. Kubernetes Load Balancer Service (CLB) 4. Kubernetes Load Balancer Service (NLB) 5. Kubernetes NodePort Service EKS Outputs from Project-1 1. cluster_id 2. cluster_endpoint 3. cluster_certificate_authority_data 4. token
StackSimplify © Kalyan Reddy Daida What are we going to learn ? Create k8s Load Balancer Service Manifest (AWS CLB) Create k8s Deployment Manifest Create k8s Load Balancer Service Manifest (AWS NLB) Create k8s Node Port Service Manifest (Not recommended for prod) Kubernetes Manifests using Terraform Define AWS and Kubernetes Providers & Datasources Create Remote State Datasource Define Terraform Settings - AWS and Kubernetes Provider Versions C1 C2 C3 C4 C5 C6 C7
StackSimplify © Kalyan Reddy Daida Terraform Remote State Storage & State Locking using AWS S3 & DynamoDB VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster Amazon Simple Storage Service (Amazon S3) Amazon DynamoDB Classic Load Balancer Autoscaling AWS IAM Network Load Balancer
StackSimplify © Kalyan Reddy Daida Desired & Current Terraform States terraform.tfstate Terraform Configuration Files Real World Resource – EC2 Instance Desired State Current State
StackSimplify © Kalyan Reddy Daida Terraform Local State Storage Terraform Remote State Storage Terraform State
StackSimplify © Kalyan Reddy Daida What is Terraform Backend ? Backends are responsible for storing state and providing an API for state locking. Terraform State Storage Terraform State Locking AWS S3 Bucket AWS DynamoDB
StackSimplify © Kalyan Reddy Daida Local State File Admin1 Desktop terraform.tfstate Admin1 Admin2 Admin3 Remote State File AWS Cloud EC2 Instance Admin1 Desktop terraform.tfstate Admin1 Admin2 Admin3 AWS Cloud EC2 Instance Admin2 Desktop Admin3 Desktop AWS S3 Bucket Multiple Team members cannot update the infrastructure as they don’t have access to State File This means we need store the state file in a shared location. Using Terraform Backend concept we can use AWS S3 as the shared storage for State Files If two team members are running Terraform at the same time, you may run into race conditions as multiple Terraform processes make concurrent updates to the state files, leading to conflicts, data loss, and state file corruption. Implement State Locking
StackSimplify © Kalyan Reddy Daida Terraform Remote State File with State Locking Admin1 Desktop terraform.tfstate Admin1 Admin2 Admin3 AWS Cloud EC2 Instance Admin2 Desktop Admin3 Desktop AWS S3 Bucket AWS DynamoDB Not all backends support State Locking. AWS S3 supports State Locking State locking happens automatically on all operations that could write state. If state locking fails, Terraform will not continue. You can disable state locking for most commands with the - lock flag but it is not recommended. If acquiring the lock is taking longer than expected, Terraform will output a status message. If Terraform doesn't output a message, state locking is still occurring if your backend supports it. Terraform has a force-unlock command to manually unlock the state if unlocking failed.
StackSimplify © Kalyan Reddy Daida Terraform Remote State File with State Locking Terraform State Storage using Remote Backend AWS S3 Terraform State Locking
StackSimplify © Kalyan Reddy Daida EKS Cluster EKS k8s Resources S3 Bucket AWS DynamoDB
StackSimplify © Kalyan Reddy Daida Terraform Remote State Datasource The terraform_remote_state data source retrieves the root module output values from project-1 Terraform configuration, using the latest state snapshot from the remote backend. Project-1 Project-2 project-1/terraform.tfstate project-2/terraform.tfstate terraform_remote_state data source Terraform Resources 1. AWS VPC 2. Bastion Host 3. EKS Cluster 4. EKS Node Groups 5. EKS Outputs Terraform Resources 1. Kubernetes Provider 2. Kubernetes Deployment 3. Kubernetes Load Balancer Service (CLB) 4. Kubernetes Load Balancer Service (NLB) 5. Kubernetes NodePort Service EKS Outputs from Project-1 1. cluster_id 2. cluster_endpoint 3. cluster_certificate_authority_data 4. token State Files in project local working directory In Section-11 Demo
StackSimplify © Kalyan Reddy Daida Terraform Remote State Datasource Project-1 Project-2 terraform_remote_state data source Terraform Resources 1. AWS VPC 2. Bastion Host 3. EKS Cluster 4. EKS Node Groups 5. EKS Outputs Terraform Resources 1. Kubernetes Provider 2. Kubernetes Deployment 3. Kubernetes Load Balancer Service (CLB) 4. Kubernetes Load Balancer Service (NLB) 5. Kubernetes NodePort Service EKS Outputs from Project-1 1. cluster_id 2. cluster_endpoint 3. cluster_certificate_authority_data 4. token AWS S3 AWS DynamoDB Project-1: terraform.tfstate AWS S3 AWS DynamoDB Project-2: terraform.tfstate
StackSimplify © Kalyan Reddy Daida Terraform Remote State Datasource In Project-2, Terraform getting EKS Cluster information from project-1 terraform state file stored in AWS S3 Bucket using Terraform Remote State Datasource.
StackSimplify © Kalyan Reddy Daida What are we going to learn ? Update Terraform Remote Backend Information for Project-1: EKS Cluster Update Terraform Remote Backend Information for Project-2: Kubernetes Resources (Deployment & Services) Update Terraform Remote State Datasource from local to remote backend (AWS S3 Bucket) to access Project-1 EKS Cluster Outputs needed for Kubernetes Provider in Project-02 C1 C1 C2
StackSimplify © Kalyan Reddy Daida Terraform Backends
StackSimplify © Kalyan Reddy Daida Terraform Backends Each Terraform configuration can specify a backend, which defines where and how operations are performed, where state snapshots are stored, etc. Where Backends are Used Backend configuration is only used by Terraform CLI. Terraform Cloud and Terraform Enterprise always use their own state storage when performing Terraform runs, so they ignore any backend block in the configuration. For Terraform Cloud users also it is always recommended to use backend block in Terraform configuration for commands like terraform taint which can be executed only using Terraform CLI
StackSimplify © Kalyan Reddy Daida Terraform Backends What Backends Do There are two things backends will be used for 1. Where state is stored 2. Where operations are performed. Terraform uses persistent state data to keep track of the resources it manages. Store State State Locking Operations State Locking is to prevent conflicts and inconsistencies when the operations are being performed "Operations" refers to performing API requests against infrastructure services in order to create, read, update, or destroy resources. Everyone working with a given collection of infrastructure resources must be able to access the same state data (shared state storage). Not every terraform subcommand performs API operations; many of them only operate on state data. Only two backends actually perform operations: local and remote. The remote backend can perform API operations remotely, using Terraform Cloud or Terraform Enterprise. What are Operations ? terraform apply terraform destroy
StackSimplify © Kalyan Reddy Daida Terraform Backends Backend Types Enhanced Backends Standard Backends Enhanced backends can both store state and perform operations. There are only two enhanced backends: local and remote Standard backends only store state, and rely on the local backend for performing operations. Example for Remote Backend Performing Operations : Terraform Cloud, Terraform Enterprise Example: AWS S3, Azure RM, Consul, etcd, gcs http and many more
StackSimplify © Kalyan Reddy Daida AWS EKS IRSA IAM Roles for Service Accounts VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling IAM IAM Policy AWS STS IAM Role Temporary security credential Kubernetes Job Kubernetes Service Account VERY VERY IMPORTANT CONCEPT FOR AWS EKS Section-13
StackSimplify © Kalyan Reddy Daida How to access AWS Services from Workloads running in EKS Cluster? AWS S3 Bucket1 Bucket2 Bucket3 Bucket4 default namespace EKS Cluster k8s Job List S3 Buckets Other AWS Services EKS Cluster AWS Cloud Bucket5 Demo Usecase: Kubernetes Workload (k8s Job with AWS CLI Container) when run with a command “s3 ls”, it should list the S3 Buckets. In short, Kubernetes Workload in EKS Cluster should be able to access AW Services. K8s Job don’t have access to AWS S3 APIs (this Job will fail)
StackSimplify © Kalyan Reddy Daida Why do Kubernetes Workloads need to access AWS Services ? EBS CSI Controller + Kubernetes Storage Class, PVC, PV EFS CSI Controller + Kubernetes Storage Class + PVC + PV AWS Load Balancer Controller + Kubernetes Ingress Resources We can create / resize / delete / retain AWS EBS Volumes from Kubernetes Resources in EKS Cluster We can map EFS File system to our Kubernetes Pods in our EKS Cluster. We can create AWS Application, Network Load Balancer with all the settings from our EKS Cluster using k8s Ingress Resources External DNS Controller We can create / update / delete AWS Route53 DNS records using External DNS For all the above, we need to understand the IRSA (IAM Roles for Service Accounts concept) in detail. Same applies if our Application Pods want to access AWS Services from EKS Cluster
StackSimplify © Kalyan Reddy Daida Key Items for IRSA Implementation IRSA IAM Roles for Service Accounts EKS Cluster OpenID Connect Provider AWS IAM Identity Provider AWS STS AssumeRoleWi thWebIdentity API operation AWS IAM Temporary Role Credentials Kubernetes Service Accounts Kubernetes ProjectedServiceAcco untToken feature (OIDC JSON Web Token)
StackSimplify © Kalyan Reddy Daida EKS Cluster OpenID Connect Provider URL EKS Cluster acts as an OpenID Connect Provider (It can act as External Identity Provider to AWS IAM) EKS Cluster contains the OpenID Connect Provider Issuer URL We can configure this OpenID Connect Issuer URL in AWS IAM Identity Provider
StackSimplify © Kalyan Reddy Daida EKS Cluster OpenID Connect Configuration Endpoint https://<EKS Cluster OpenID Connect provider URL>/.well-known/openid-configuration
StackSimplify © Kalyan Reddy Daida AWS IAM Identity Provider Add EKS OpenID Connect Provider as Identity Provider in AWS IAM
StackSimplify © Kalyan Reddy Daida AWS IAM Identity Provider Add EKS OpenID Connect Provider as Identity Provider in AWS IAM
StackSimplify © Kalyan Reddy Daida AWS IAM Roles for Kubernetes Service Accounts IAM IAM Policy AWS STS IAM Role Temporary security credential AWS S3 Bucket1 Bucket2 Bucket3 Bucket4 default namespace EKS Cluster k8s Service Account k8s Job List S3 Buckets Other AWS Services EKS Cluster Annotated with IAM Role AWS Cloud Bucket5 k8s Pod
StackSimplify © Kalyan Reddy Daida IRSA - Functional Flow default namespace EKS Cluster k8s Service Account k8s Job AWS Cloud k8s Pod EKS Cluster acting as External IDP to AWS IAM AWS IAM Feature: Federated Identities using OIDC Validate and accept JWT Token from EKS Cluster JWT will be sent to AWS STS 1 IAM Policy AWS STS IAM Role Temporary security credential AssumeRoleWithWebIdenti ty API operation ProjectedServiceAccountToken JWT Token will passed to AWS IAM 2 AWS STS will generate IAM temporary role credentials 3 k8s service account annotated with IAM Role AWS S3 Access AWS Services using Temp creds based on IAM role permissions 4
StackSimplify © Kalyan Reddy Daida Kubernetes Service Account Mounted Secret - JWT Token
StackSimplify © Kalyan Reddy Daida Kubernetes Service Account Mounted Secret - JWT Token Decoded JWT Token Website: https://jwt.io/
StackSimplify © Kalyan Reddy Daida What are we going to learn ? .......................... Add EKS Cluster as OpenID Connect Provider in AWS IAM Service
StackSimplify © Kalyan Reddy Daida What are we going to learn ? c1 Update Terraform Remote Backend information – AWS S3 Bucket Key & DynamoDB Table c2 Define Terraform Remote State Datasource for Project-1 EKS Cluster c3-01 c3-02 Define generic variables and local values c4-01 Define AWS Provider and Kubernetes Provider c4-02 Create IAM Policy and IAM Role with Action: AssumeRoleWithWebIdentity c4-03 Create Kubernetes Service Account in EKS Cluster and annotate with IAM Role c4-04 Create Kubernetes Job with Kubernetes Service Account and AWS CLI Container
StackSimplify © Kalyan Reddy Daida AWS EKS Storage
StackSimplify © Kalyan Reddy Daida EKS Storage In-Tree EBS Provisioner EBS CSI Driver EFS CSI Driver FSx for Luster CSI CSI means Container Storage Interface Latest & Greatest available today & ready for production use As on today, not supported on AWS EKS Fargate (Serverless) Allows EKS Clusters to manage lifecycle of EBS Volumes for persistent storage, EFS File systems & FSx for Luster File systems Supported for k8s 1.14 & later Supported for k8s 1.16 & later Legacy Will be deprecated soon
StackSimplify © Kalyan Reddy Daida • EBS provides block level storage volumes for use with EC2 & Container instances. • We can mount these volumes as devices on our EC2 & Container instances. • EBS volumes that are attached to an instance are exposed as storage volumes that persist independently from the life of the EC2 or Container instance. • We can dynamically change the configuration of a volume attached to an instance. • AWS recommends EBS for data that must be quickly accessible and requires long-term persistence. • EBS is well suited to both database-style applications that rely on random reads and writes, and to throughput-intensive applications that perform long, continuous reads and writes. AWS Elastic Block Store - Introduction
StackSimplify © Kalyan Reddy Daida AWS EKS Storage Elastic Block Store VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling IAM IAM Policy AWS STS IAM Role Temporary security credential Kubernetes Service Account AWS EBS CSI Driver Install Section-14 Kubernetes Deployment Kubernetes Daemon Set AWS EBS
StackSimplify © Kalyan Reddy Daida AWS EBS CSI Driver Why do we need to use EBS CSI Driver in EKS Cluster? AWS EBS Container Storage Interface (CSI) driver allows EKS clusters to manage the lifecycle of EBS volumes for persistent volumes in k8s (Create / Resize / Delete Volumes).
StackSimplify © Kalyan Reddy Daida AWS EBS CSI Driver Managing the EBS CSI Driver self- managed add-on Managing the EBS CSI driver as an EKS add-on EBS CSI Driver - Deployment Options Terraform Helm Provider Terraform EKS Add On Resource
StackSimplify © Kalyan Reddy Daida AWS EBS CSI Driver IAM IAM Policy AWS STS IAM Role Temporary security credential kube-system namespace EKS Cluster EBS CSI k8s Service Account Other AWS Services EKS Cluster Annotated with IAM Role AWS Cloud EBS CSI Controller Deployment EBS CSI Node Daemon Set AWS EBS Volume Volume Volume Volume Volume Can Create / Update / Delete EBS Volumes
StackSimplify © Kalyan Reddy Daida What are we going to learn ? .......................... Add EKS Cluster as OpenID Connect Provider in AWS IAM Service
StackSimplify © Kalyan Reddy Daida What are we going to learn ? c1 Update Terraform Remote Backend information – AWS S3 Bucket Key & DynamoDB Table c2 Define Terraform Remote State Datasource for Project-1 EKS Cluster c3-01 c3-02 Define generic variables and local values c4-01 Define Terraform HTTP Datasource to download the EBS CSI IAM Role from Github c4-02 Create IAM Policy and IAM Role with AssumeRoleWithWebIdentity c4-03 Define Helm provider c4-04 Install EBS CSI Driver using Helm Resource c4-05 Create EBS CSI Outputs
StackSimplify © Kalyan Reddy Daida AWS EKS Storage Elastic Block Store VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling AWS EBS CSI Driver – Sample App using YAML AWS EBS Section-15 IAM IAM Policy AWS STS IAM Role Temporary security credential Kubernetes Service Account Kubernetes Deployment Kubernetes Daemon Set
StackSimplify © Kalyan Reddy Daida User Management Web Application - Architecture User Management Web Application Java Spring Boot Create User List User Delete User MySQL DB schema: webappdb Table: User Default User: admin101
StackSimplify © Kalyan Reddy Daida POD ReplicaSet Deployment (mysql) MySQL – ClusterIP Service MySql EKS Cluster Environment Variables Volumes Volume Mounts ClusterIP Service Storage Class Persistent Volume Claim Config Map Deployment AWS Elastic Block Store - EBS EKS Storage EBS CSI Driver YAML EKS Storage with EBS CSI Driver - Demo
StackSimplify © Kalyan Reddy Daida POD REST API ReplicaSet Deployment (UserMgmt) UserMgmt - LB Service - CLB POD ReplicaSet Deployment (mysql) MySQL – ClusterIP Service MySql EKS Cluster Environment Variables Volumes Volume Mounts ClusterIP Service Storage Class Persistent Volume Claim Config Map Deployment NodePort Service Deployment Environment Variables AWS Elastic Block Store - EBS YAML LB Services – CLB & NLB UserMgmt - NodePort Service UserMgmt - LB Service - NLB Users http://<workernode-publicip>:<node-port> http://<CLB-DNS-URL> http://<NLB-DNS-URL> EKS Storage with EBS CSI Driver - Demo EKS Storage EBS CSI Driver
StackSimplify © Kalyan Reddy Daida EKS Storage with EBS CSI Driver - Demo NodePort Service LB Service - CLB LB Service - NLB http://<worker-node-publicip>:<node-port> http//<nlb-dns-url> http//<clb-dns-url> k8s Pods k8s ReplicaSet k8s Deployment k8s Persistent Volume Claim k8s Persistent Volume k8s Storage Class default namespace EKS Cluster MySQL Deployment k8s Pods k8s ReplicaSet k8s Deployment UserMgmt Deployment MySQL k8s ClusterIP Service Note-1: PVC Claims must exist in the same namespace as the Pod using the claim. The cluster finds the claim in the Pod's namespace and uses it to get the PersistentVolume backing the claim Note-2: A PersistentVolume (PV) is a piece of storage in the cluster that has been provisioned by an administrator or dynamically provisioned using Storage Classes. It is a resource in the cluster just like a node is a cluster resource Note-3: PVC Status changes from Pending to Bound after MySQL Deployment
StackSimplify © Kalyan Reddy Daida What are we going to learn ? 1 Create Kubernetes Storage Class 2 Create Kubernetes Persistent Volume Claim 3 Create Kubernetes Config Map which will create the database schema in MySQL DB 4 Create Kubernetes Deployment for MySQL DB 5 Create Cluster IP Service for MySQL DB 6 Create Kubernetes Deployment for UserMgmt WebApp 7 Create Kubernetes Service of type Load Balancer (AWS Classic Load Balancer) 8 Create Kubernetes Service of type Load Balancer (AWS Network Load Balancer) 9 Create Kubernetes Node Port Service Kubernetes Manifests using YAML
StackSimplify © Kalyan Reddy Daida AWS EKS Storage Elastic Block Store VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling AWS EBS CSI Driver – Sample App using Terraform AWS EBS Section-16 IAM IAM Policy AWS STS IAM Role Temporary security credential Kubernetes Service Account Kubernetes Deployment Kubernetes Daemon Set
StackSimplify © Kalyan Reddy Daida POD ReplicaSet Deployment (mysql) MySQL – ClusterIP Service MySql EKS Cluster Environment Variables Volumes Volume Mounts ClusterIP Service Storage Class Persistent Volume Claim Config Map Deployment AWS Elastic Block Store - EBS EKS Storage EBS CSI Driver EKS Storage with EBS CSI Driver - Demo
StackSimplify © Kalyan Reddy Daida POD REST API ReplicaSet Deployment (UserMgmt) UserMgmt - LB Service - CLB POD ReplicaSet Deployment (mysql) MySQL – ClusterIP Service MySql EKS Cluster Environment Variables Volumes Volume Mounts ClusterIP Service Storage Class Persistent Volume Claim Config Map Deployment NodePort Service Deployment Environment Variables AWS Elastic Block Store - EBS LB Services – CLB & NLB UserMgmt - NodePort Service UserMgmt - LB Service - NLB Users http://<workernode-publicip>:<node-port> http://<CLB-DNS-URL> http://<NLB-DNS-URL> EKS Storage with EBS CSI Driver - Demo
StackSimplify © Kalyan Reddy Daida EKS Storage with EBS CSI Driver - Demo NodePort Service LB Service - CLB LB Service - NLB http://<worker-node-publicip>:<node-port> http//<nlb-dns-url> http//<clb-dns-url> k8s Pods k8s ReplicaSet k8s Deployment k8s Persistent Volume Claim k8s Persistent Volume k8s Storage Class default namespace EKS Cluster MySQL Deployment k8s Pods k8s ReplicaSet k8s Deployment UserMgmt Deployment MySQL k8s ClusterIP Service Note-1: PVC Claims must exist in the same namespace as the Pod using the claim. The cluster finds the claim in the Pod's namespace and uses it to get the PersistentVolume backing the claim Note-2: A PersistentVolume (PV) is a piece of storage in the cluster that has been provisioned by an administrator or dynamically provisioned using Storage Classes. It is a resource in the cluster just like a node is a cluster resource Note-3: PVC Status changes from Pending to Bound after MySQL Deployment Terraform Kubernetes Provider
StackSimplify © Kalyan Reddy Daida What are we going to learn ? c1 Update Terraform Remote Backend information – AWS S3 Bucket Key & DynamoDB Table c2 Define Terraform Remote State Datasource for Project-1 EKS Cluster c3 Define AWS & Kubernetes Terraform Providers c4-01 Create Kubernetes Storage Class c4-02 Create Kubernetes Persistent Volume Claim c4-03 Create Kubernetes Config Map which will create the database schema in MySQL DB c4-04 Create Kubernetes Deployment for MySQL DB c4-05 Create Kubernetes Cluster IP Service for MySQL DB Kubernetes Manifests using Terraform
StackSimplify © Kalyan Reddy Daida What are we going to learn ? c4-06 Create Kubernetes Deployment for UserMgmt WebApp c4-07 Create Kubernetes Service of type Load Balancer (AWS Classic Load Balancer) c4-08 Create Kubernetes Service of type Load Balancer (AWS Network Load Balancer) c4-09 Create Kubernetes Node Port Service sql file Create webappdb.sql file which contains the DB Schema creation queries used in k8s configMap c4-03 Kubernetes Manifests using Terraform
StackSimplify © Kalyan Reddy Daida AWS EKS Storage Elastic Block Store VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling EBS Volumes – Resize and Retain Features AWS EBS Section-17 IAM IAM Policy AWS STS IAM Role Temporary security credential Kubernetes Service Account Kubernetes Deployment Kubernetes Daemon Set
StackSimplify © Kalyan Reddy Daida EBS Volumes - Resize & Retain Features
StackSimplify © Kalyan Reddy Daida What are we going to learn ? Update Kubernetes Storage Class arguments to support Volume Expansion (Resizing Volumes) and Reclaim Policy as Retain. Default Reclaim Policy is Delete if not defined when PVC is deleted, volume will be deleted automatically Very Important Note: As part of Volume Resizing, we can only increase the size of EBS Volume. We cannot reduce the Volume size
StackSimplify © Kalyan Reddy Daida AWS EKS Storage Elastic Block Store VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling Managing the EBS CSI driver as an EKS add-on AWS EBS Section-18 IAM IAM Policy AWS STS IAM Role Temporary security credential Kubernetes Service Account Kubernetes Deployment Kubernetes Daemon Set
StackSimplify © Kalyan Reddy Daida AWS EBS CSI Driver Managing the EBS CSI Driver self- managed add-on using HELM Managing the EBS CSI driver as an EKS add-on EBS CSI Driver - Deployment Options
StackSimplify © Kalyan Reddy Daida EBS CSI driver as an EKS add-on EBS CSI Driver as EKS Add-On Currently it is in preview mode Has good number of limitations as on today unlike Self-Managed Add-On approach using HELM (Section-14). In future, this might become the default deployment option for EBS CSI Driver That said we will also automate this using Terraform now Additional Reference: https://docs.aws.amazon.com/eks/latest/userguide/managing-ebs-csi.html
StackSimplify © Kalyan Reddy Daida What are we going to learn ? c1 Update Terraform Remote Backend information – AWS S3 Bucket Key & DynamoDB Table c2 Define Terraform Remote State Datasource for Project-1 EKS Cluster c3-01 c3-02 Define generic variables and local values c4-01 Define Terraform HTTP Datasource to download the EBS CSI IAM Role from Github c4-02 Create IAM Policy and IAM Role with AssumeRoleWithWebIdentity c4-03 Install EBS CSI Driver using EKS Add-On option c4-04 Define EBS CSI Driver Outputs
StackSimplify © Kalyan Reddy Daida What are we going to learn ? Once the EBS CSI Driver is installed using EKS Add-On option, Deploy our User Management Sample Application and test and ensure everything good from EBS Volumes excluding the limitations with this approach.
StackSimplify © Kalyan Reddy Daida AWS EKS Identity & Access Management using AWS IAM VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling Introduction EKS IAM IAM IAM Policy IAM Role Kubernetes Config Map IAM User IAM Group
StackSimplify © Kalyan Reddy Daida AWS EKS Identity & Access Management using AWS IAM VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling AWS EKS Authentication and Authorization EKS IAM IAM IAM Policy IAM Role Kubernetes Config Map IAM User IAM Group
StackSimplify © Kalyan Reddy Daida EKS Authentication & Authorization Reference: https://docs.aws.amazon.com/eks/latest/userguide/cluster-auth.html Authorization Authentication AWS IAM k8s RBAC
StackSimplify © Kalyan Reddy Daida EKS Authentication & Authorization EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM K8s API Server Role Binding Role Cluster Role Binding Cluster Role Authorization Authentication kubectl client aws-iam-authenticator Server Kubernetes Role-based Access Control (RBAC) Verify IAM Identity IAM Identity Kubernetes User Check IAM Identity Token Approve/Decline Allow/Deny Kubernetes User Kubernetes Action IAM Identity Token Kubernetes Action Allow / Deny 1 2 3 IAM Policy IAM Role 4 5 6 7 8
StackSimplify © Kalyan Reddy Daida EKS Authentication & Authorization 0 Kubernetes Action: From kubectl cli, run the command like kubectl get pods 1 Kubectl client makes a request to k8s API server passing an access-token with the user’s information 2 k8s API server passes this token to EKS Control Plane’s service: aws-iam-authenticator 3 aws-iam-authenticator calls AWS IAM service and passes the access-token to check if this is valid user and whether that user has permissions to access the EKS cluster 3-1 Authentication Check: AWS IAM makes internal authentication check by using access-token 3-2 Authorization Check: AWS IAM makes internal authorization check by checking IAM policies tied to this user (User with API calls to eks::* resources should be allowed) 4 aws-iam-authenticator checks with aws-auth ConfigMap whether this user has permissions to access this EKS cluster resources
StackSimplify © Kalyan Reddy Daida EKS Authentication & Authorization 5 aws-iam-authenticator returns approve/decline response to the k8s API server 6 k8s API Server will pass a user who already was validated with an authentication module to an authorization module to check for its permissions (Role Based Access Control – RBAC) 7 Authorization Module will send the Allow / Deny response to k8s API Server 8 k8s API Server will perform (Allow) the Kubernetes action (Example: kubectl get pods) or Deny based on response from Authorization Module
StackSimplify © Kalyan Reddy Daida AWS EKS Identity & Access Management using AWS IAM VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling AWS EKS IAM Usecases EKS IAM IAM IAM Policy IAM Role Kubernetes Config Map IAM User IAM Group
StackSimplify © Kalyan Reddy Daida A Developer requesting full access to a namespace (dev) in EKS Cluster and in addition, also asking for read- only access to EKS Cluster 1. Kubernetes Role 2. Kubernetes Role Binding 3. Kubernetes Cluster Role 4. Kubernetes Cluster Role Binding Section-19 Section-20 Section-21 Section-22 Section-23 Section-24 Section-25 IAM IAM Policy IAM Role Kubernetes Config Map IAM User IAM Group Role Binding Role Cluster Role Binding Cluster Role AWS EKS IAM Usecases Provision AWS IAM Admins as EKS Admins Provision AWS IAM Basic User as EKS Admin Automate Section-19,20 with Terraform Provision EKS Admins with AWS IAM Roles & IAM Groups Automate Section-22 with Terraform Provision EKS Read-Only Users with IAM Roles, IAM Groups, Kubernetes Cluster Role and Cluster Role Binding
StackSimplify © Kalyan Reddy Daida EKS Authentication & Authorization - Admin User EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM K8s API Server Role Binding Role Cluster Role Binding Cluster Role Authorization Authentication kubectl client aws-iam-authenticator Server Kubernetes Role-based Access Control (RBAC) Verify IAM Identity IAM Identity Kubernetes User Check IAM Identity Token Approve IAM Identity Token Kubernetes Action Allow 1 2 3 IAM Policy IAM Role 4 5 6 ACCESS GRANTED
StackSimplify © Kalyan Reddy Daida Provision AWS Admins as EKS Admins kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy Administrator Access IAM User eksadmin1 ACCESS GRANTED
StackSimplify © Kalyan Reddy Daida EKS Authentication & Authorization - Basic User EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM K8s API Server Role Binding Role Cluster Role Binding Cluster Role Authorization Authentication kubectl client aws-iam-authenticator Server Kubernetes Role-based Access Control (RBAC) Verify IAM Identity IAM Identity Kubernetes User Check IAM Identity Token Approve IAM Identity Token Kubernetes Action Allow 1 2 3 IAM Policy IAM Role 4 5 6 ACCESS GRANTED EKS Full Access IAM Policy
StackSimplify © Kalyan Reddy Daida Provision AWS Basic User as EKS Admin kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy EKS Full Access IAM User eksadmin2 ACCESS GRANTED
StackSimplify © Kalyan Reddy Daida Usecase - Multiple EKS Admin Users IAM Users AWS IAM Adding all these users in aws-auth ConfigMap is not a feasible Option from maintenance perspective Complexity increases If we need to add many IAM Users as EKS Admins (20, 30, 40, 50) what should we do ? Option-1: Add those User ARNs in mapUsers section of aws-auth ConfigMap Every time we add a new user, we need to update the Kubernetes aws-auth ConfigMap in EKS Cluster
StackSimplify © Kalyan Reddy Daida Usecase - Multiple EKS Admin Users IAM Users AWS IAM IAM Group: eksadmins Can we use IAM Groups to simplify this EKS Admin Access Process ? YES Setting up the whole base for this is complex, many things like below are involved 1. STS Assume Role Trust Policy 2. IAM Policy 3. IAM Role 4. IAM Group Policy 5. IAM Groups After all steps are completed, provisioning EKS Admins becomes so so easy Step-1: Create IAM User Step-2: Associate that User to IAM Group: eksadmins. (User gets access to EKS Cluster)
StackSimplify © Kalyan Reddy Daida Provision EKS Admins using IAM Roles & IAM Groups kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy EKS Full Access ACCESS GRANTED IAM Trust Policy STS Assume Role IAM User eksadmin3 IAM Role IAM Group eksadmins IAM Group Policy IAM User eksadmin4 IAM User eksadmin5
StackSimplify © Kalyan Reddy Daida Provision EKS ReadOnly Users using IAM Roles & IAM Groups kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy EKS Read- Only Access ACCESS GRANTED IAM Trust Policy STS Assume Role IAM User eksread1 IAM Role IAM Group eksreadon ly IAM Group Policy IAM User eksread2 IAM User eksread3 Kubernetes RBAC
StackSimplify © Kalyan Reddy Daida Cluster Role
StackSimplify © Kalyan Reddy Daida ClusterRoleBinding & aws-auth ConfigMap How does the aws-auth ConfigMap enforce the Kubernetes RBAC permissions defined in ClusterRole & ClusterRoleBinding? Subject Name in ClusterRoleBinding should match the groups value in aws-auth ConfigMap
StackSimplify © Kalyan Reddy Daida Usecase EKS Cluster Read-Only Access EKS Dev Namespace Full Access (All Verbs – Create , Apply, Get, List, Delete Resources) Kubernetes Cluster Role Kubernetes Cluster Role Binding Kubernetes Role Kubernetes Role Binding EKS Developer IAM User A Developer requesting full access to a namespace (dev) in EKS Cluster and in addition, also asking for read-only access to EKS Cluster
StackSimplify © Kalyan Reddy Daida Provision EKS Developer Users using IAM Roles & IAM Groups kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy EKS ReadOnly Access ACCESS GRANTED IAM Trust Policy STS Assume Role IAM User eksdeveloper1 IAM Role IAM Group Developer IAM Group Policy IAM User eksdeveloper2 DEV namespace Cluster Role Cluster Role Binding Role Binding Role Kubernetes RBAC
StackSimplify © Kalyan Reddy Daida aws-auth ConfigMap EKS Admins with IAM Users, Groups and Roles Section- 22, 23 Section-24 Section-25 Section- 19, 20, 21 EKS ReadOnly Access with IAM Users, Groups, Roles & k8s ClusterRole & ClusterRoleBinding EKS Developer Access with IAM Users, Groups, Roles & k8s ClusterRole, ClusterRoleBinding & Role, RoleBinding IAM Users as EKS Admins
StackSimplify © Kalyan Reddy Daida AWS EKS Identity & Access Management using AWS IAM VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling EKS Cluster Creator User EKS IAM IAM IAM Policy Kubernetes Config Map IAM User
StackSimplify © Kalyan Reddy Daida AWS EKS Cluster Creator User kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy Administrator Access IAM User kalyandev User: kalyandev AWS CLI aws configure with Security Credentials Terraform to create EKS cluster kalyandev becomes the EKS Cluster Creator User The user with which we create the EKS Cluster is called Cluster_Creator_User This user information is not stored in AWS EKS Cluster aws-auth configmap If we face any issues with `k8s aws-auth configmap` and if we lost access to EKS Cluster we need the `cluster_creator` user to restore the stuff ALWAYS REMEMBER WITH WHICH USER EKS CLUSTER IS CREATED EKS Cluster Creator User
StackSimplify © Kalyan Reddy Daida AWS EKS Identity & Access Management using AWS IAM VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling Provision AWS Admins as EKS Admins Section-19 IAM IAM Policy Kubernetes Config Map IAM User
StackSimplify © Kalyan Reddy Daida Provision AWS Admins as EKS Admins kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy Administrator Access IAM User eksadmin1 NO ACCESS
StackSimplify © Kalyan Reddy Daida EKS Authentication & Authorization - Admin User EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM K8s API Server Role Binding Role Cluster Role Binding Cluster Role Authorization Authentication kubectl client aws-iam-authenticator Server Kubernetes Role-based Access Control (RBAC) Verify IAM Identity IAM Identity Kubernetes User Check IAM Identity Token Decline IAM Identity Token Kubernetes Action Deny 1 2 3 IAM Policy IAM Role 4 5 6 NO ACCESS
StackSimplify © Kalyan Reddy Daida AWS EKS - Default ConfigMap
StackSimplify © Kalyan Reddy Daida Provision AWS Admins as EKS Admins kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy Administrator Access IAM User eksadmin1 ACCESS GRANTED
StackSimplify © Kalyan Reddy Daida EKS Authentication & Authorization - Admin User EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM K8s API Server Role Binding Role Cluster Role Binding Cluster Role Authorization Authentication kubectl client aws-iam-authenticator Server Kubernetes Role-based Access Control (RBAC) Verify IAM Identity IAM Identity Kubernetes User Check IAM Identity Token Approve IAM Identity Token Kubernetes Action Allow 1 2 3 IAM Policy IAM Role 4 5 6 ACCESS GRANTED
StackSimplify © Kalyan Reddy Daida AWS EKS - ConfigMap with mapUsers
StackSimplify © Kalyan Reddy Daida AWS EKS Identity & Access Management using AWS IAM VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling Provision AWS Basic User as EKS Admin using IAM EKS Full Access Policy Section-20 IAM IAM Policy Kubernetes Config Map IAM User
StackSimplify © Kalyan Reddy Daida Provision AWS Basic User as EKS Admin You want to give FULL ACCESS to AWS EKS Cluster but for other AWS Services NO ACCESS Usecase Step-1: Create IAM Basic User Step-2: Create IAM Policy with EKS Full Access and associate to IAM User Step-3: Update user information in EKS Cluster aws-auth ConfigMap
StackSimplify © Kalyan Reddy Daida Provision AWS Basic User as EKS Admin kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy EKS Full Access IAM User eksadmin2 ACCESS GRANTED IAM Policy Administrator Access IAM User eksadmin1
StackSimplify © Kalyan Reddy Daida EKS Authentication & Authorization - Basic User EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM K8s API Server Role Binding Role Cluster Role Binding Cluster Role Authorization Authentication kubectl client aws-iam-authenticator Server Kubernetes Role-based Access Control (RBAC) Verify IAM Identity IAM Identity Kubernetes User Check IAM Identity Token Approve IAM Identity Token Kubernetes Action Allow 1 2 3 IAM Policy IAM Role 4 5 6 ACCESS GRANTED EKS Full Access IAM Policy
StackSimplify © Kalyan Reddy Daida AWS EKS - ConfigMap with mapUsers
StackSimplify © Kalyan Reddy Daida AWS IAM Policy - EKS Full Access AWS IAM IAM Policy EKS Full Access Policy IAM User eksadmin2
StackSimplify © Kalyan Reddy Daida AWS EKS Identity & Access Management using AWS IAM VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling Section-19 & Section-20 Automate using Terraform Section-21 IAM IAM Policy Kubernetes Config Map IAM User
StackSimplify © Kalyan Reddy Daida Provision AWS Basic User as EKS Admin kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy EKS Full Access IAM User eksadmin2 ACCESS GRANTED IAM Policy Administrator Access IAM User eksadmin1
StackSimplify © Kalyan Reddy Daida Provision EKS Admins with IAM Users Task-1: Create IAM User with Admin Access Policy Task-2: Create IAM User with EKS Full Access policy Task-3: Define Terraform Kubernetes Provider Task-4: Define aws_caller_identity to get AWS Account ID Task-5: Create locals block to define k8s config map roles and users Task-6: Create Kubernetes Config Map Resource aws- auth Task-7: Update EKS Node Group resource to get created only after Config Map aws-auth is created EKS Admins with IAM Users
StackSimplify © Kalyan Reddy Daida What are we going to learn ? c7-01 Create Terraform Kubernetes Provider c7-02 Create Kubernetes ConfigMap Resource c8-01 Create IAM Admin User with Admin Access Policy c8-02 Create IAM Basic User with EKS Full Access Policy Terraform Manifests ……………. ……………. c5-07 Add depends_on Meta-argument to ensure EKS Node Group gets created only after aws-auth ConfigMap is created
StackSimplify © Kalyan Reddy Daida AWS EKS Identity & Access Management using AWS IAM VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling Provision EKS Admins with IAM Roles & IAM Groups Section-22 IAM IAM Policy IAM Role Kubernetes Config Map IAM User IAM Group
StackSimplify © Kalyan Reddy Daida Usecase - Multiple EKS Admin Users IAM Users AWS IAM Adding all these users in aws-auth ConfigMap is not a feasible Option from maintenance perspective Complexity increases If we need to add many IAM Users as EKS Admins (20, 30, 40, 50) what should we do ? Option-1: Add those User ARNs in mapUsers section of aws-auth ConfigMap Every time we add a new user, we need to update the Kubernetes aws-auth ConfigMap in EKS Cluster
StackSimplify © Kalyan Reddy Daida Usecase - Multiple EKS Admin Users IAM Users AWS IAM IAM Group: eksadmins Can we use IAM Groups to simplify this EKS Admin Access Process ? YES Setting up the whole base for this is complex, many things like below are involved 1. STS Assume Role Trust Policy 2. IAM Policy 3. IAM Role 4. IAM Group Policy 5. IAM Groups After all steps are completed, provisioning EKS Admins becomes so so easy Step-1: Create IAM User Step-2: Associate that User to IAM Group: eksadmins. (User gets access to EKS Cluster)
StackSimplify © Kalyan Reddy Daida Provision EKS Admins using IAM Roles & IAM Groups kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy EKS Full Access ACCESS GRANTED IAM Trust Policy STS Assume Role IAM User eksadmin3 IAM Role IAM Group eksadmins IAM Group Policy IAM User eksadmin4 IAM User eksadmin5
StackSimplify © Kalyan Reddy Daida AWS EKS - ConfigMap with mapRoles
StackSimplify © Kalyan Reddy Daida Section-22 Implement with manual steps Section-23 Automate using Terraform Provision EKS Admins using IAM Roles & IAM Groups
StackSimplify © Kalyan Reddy Daida AWS EKS Identity & Access Management using AWS IAM VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling Provision EKS Admins with IAM Roles & IAM Groups Automate with Terraform Section-23 IAM IAM Policy IAM Role Kubernetes Config Map IAM User IAM Group
StackSimplify © Kalyan Reddy Daida Provision EKS Admins using IAM Roles & IAM Groups kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy EKS Full Access ACCESS GRANTED IAM Trust Policy STS Assume Role IAM User eksadmin1 IAM Role IAM Group eksadmins IAM Group Policy IAM User eksadmin2 IAM User eksadmin3
StackSimplify © Kalyan Reddy Daida Provision EKS Admins using IAM Roles & IAM Groups Task-1: Define Terraform Kubernetes Provider Task-2: Create locals block to define k8s config map roles and users Task-3: Define aws_caller_identity to get AWS Account ID Task-4: Create IAM Role with STS Assume Role Policy and EKS full access policy Task-5: Create IAM Group Policy and IAM Group Task-6: Create IAM users and associate to IAM Group EKS Admins with IAM Roles & IAM Groups
StackSimplify © Kalyan Reddy Daida What are we going to learn ? c7-01 Create Terraform Kubernetes Provider c7-02 Create Kubernetes ConfigMap Resource + UPDATE with mapRoles changes c8-01 Create IAM Admin User with Admin Access Policy c8-02 Create IAM Basic User with EKS Full Access Policy c9-01 Create IAM Role with STS Assume Role Policy and EKS Full Access Policy Terraform Manifests ……………. c9-02 Create IAM Group and IAM Users and associate IAM Users to IAM Group
StackSimplify © Kalyan Reddy Daida Sample Output of aws-auth ConfigMap after creating EKS Cluster using Terraform
StackSimplify © Kalyan Reddy Daida AWS EKS Identity & Access Management using AWS IAM VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling Kubernetes RBAC Fundamentals Section-24 IAM IAM Policy IAM Role Kubernetes Config Map IAM User IAM Group Kubernetes Cluster Role Kubernetes Cluster Role Binding
StackSimplify © Kalyan Reddy Daida Kubernetes RBAC Subjects API Groups Verbs Users or processes that need access to the Kubernetes API The k8s API objects that we grant access to List of actions that can be taken on a resource Kind: Group, User Kind: Service Account core extensions apps batch Create List Watch Delete Patch get Replace Read Kubernetes RBAC - Fundamentals Pods Deployments Services StatefulSets Resources Kubernetes API Reference: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/ API Groups Reference: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#-strong-api- groups-strong-
StackSimplify © Kalyan Reddy Daida Kubernetes RBAC A ClusterRole can be used to grant the same permissions as a Role, but because they are cluster-scoped, access will be granted across cluster A Cluster Role Binding is used to tie the Cluster Role and Subject together A Role can only be used to grant access to resources within a single namespace. A Role Binding is used to tie the Role and Subject together Section-24 Demo Section-25 Demo
StackSimplify © Kalyan Reddy Daida Kubernetes RBAC Role Create (Verb) Pod (Resource) Namespace: DEV Role Binding User / Group (Subject) Role Create (Verb) Pod (Resource) Namespace: QA Role Binding User / Group (Subject) Cluster Role Create (Verb) Cluster Role Binding User / Group (Subject) Kubernetes Cluster RBAC
StackSimplify © Kalyan Reddy Daida Cluster Role
StackSimplify © Kalyan Reddy Daida Cluster Role Binding
StackSimplify © Kalyan Reddy Daida AWS EKS Identity & Access Management using AWS IAM VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling Provision EKS Read-Only Users with IAM Roles & IAM Groups Automate with Terraform Section-24 IAM IAM Policy IAM Role Kubernetes Config Map IAM User IAM Group Kubernetes Cluster Role Kubernetes Cluster Role Binding
StackSimplify © Kalyan Reddy Daida Provision EKS ReadOnly Users using IAM Roles & IAM Groups kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy EKS Read- Only Access ACCESS GRANTED IAM Trust Policy STS Assume Role IAM User eksread1 IAM Role IAM Group eksreadon ly IAM Group Policy IAM User eksread2 IAM User eksread3 Kubernetes RBAC
StackSimplify © Kalyan Reddy Daida aws-auth ConfigMap
StackSimplify © Kalyan Reddy Daida Cluster Role
StackSimplify © Kalyan Reddy Daida Cluster Role Binding
StackSimplify © Kalyan Reddy Daida ClusterRoleBinding & aws-auth ConfigMap How does the aws-auth ConfigMap enforce the Kubernetes RBAC permissions defined in ClusterRole & ClusterRoleBinding? Subject Name in ClusterRoleBinding should match the groups value in aws-auth ConfigMap
StackSimplify © Kalyan Reddy Daida Provision EKS ReadOnly Users using IAM Roles, IAM Groups with Kubernetes RBAC (Cluster Role & Cluster Role Binding) Task-1: Define Terraform Kubernetes Provider Task-2: Create locals block to define k8s config map roles and users Task-3: Define aws_caller_identity to get AWS Account ID Task-4: Create IAM Role with STS Assume Role Policy and EKS Read-Only access policy Task-5: Create IAM Group Policy and IAM Group (eksreadonly) Task-6: Create IAM users and associate to IAM Group (eksreaduser1) EKS Read-Only Users with IAM Roles & IAM Groups Task-7: Create Cluster Role and Cluster Role Binding k8s RBAC Resources Task-8: update aws- auth ConfigMap
StackSimplify © Kalyan Reddy Daida What are we going to learn ? c7-01 Create Terraform Kubernetes Provider c7-02 Create Kubernetes ConfigMap Resource + UPDATE with mapRoles changes c8 & c9 Create IAM Admin User with mapUsers in aws-auth Create EKS Admins with IAM Roles & mapRoles c10-01 Create IAM Role with STS Assume Role Policy and EKS READONLY Access Policy c10-02 Create IAM Group and IAM Users and associate IAM Users to IAM Group Terraform Manifests ……………. c10-03 Create Kubernetes RBAC ClusterRole & ClusterRoleBinding Resources
StackSimplify © Kalyan Reddy Daida AWS EKS Identity & Access Management using AWS IAM VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling Provision EKS Developer Users with IAM Roles & IAM Groups Automate with Terraform Section-25 IAM IAM Policy IAM Role Kubernetes Config Map IAM User IAM Group Kubernetes Cluster Role Kubernetes Cluster Role Binding Kubernetes Role Kubernetes Role Binding
StackSimplify © Kalyan Reddy Daida Usecase EKS Cluster Read-Only Access EKS Dev Namespace Full Access (All Verbs – Create , Apply, Get, List, Delete Resources) Kubernetes Cluster Role Kubernetes Cluster Role Binding Kubernetes Role Kubernetes Role Binding EKS Developer IAM User A Developer requesting full access to a namespace (dev) in EKS Cluster and in addition, also asking for read-only access to EKS Cluster
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx
Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx

Recommended

Kubernetes-Fundamentals.pptx
Kubernetes-Fundamentals.pptxKubernetes-Fundamentals.pptx
Kubernetes-Fundamentals.pptxsatish642065
 
Terraform for azure: the good, the bad and the ugly -
Terraform for azure: the good, the bad and the ugly - Terraform for azure: the good, the bad and the ugly -
Terraform for azure: the good, the bad and the ugly - Giulio Vian
 
COP_RoR_QuArrk_Session_Oct_2022.pptx
COP_RoR_QuArrk_Session_Oct_2022.pptxCOP_RoR_QuArrk_Session_Oct_2022.pptx
COP_RoR_QuArrk_Session_Oct_2022.pptxNitesh95975
 
From Docker Straight to AWS
From Docker Straight to AWSFrom Docker Straight to AWS
From Docker Straight to AWSDevOps.com
 
Cloud-native .NET Microservices mit Kubernetes
Cloud-native .NET Microservices mit KubernetesCloud-native .NET Microservices mit Kubernetes
Cloud-native .NET Microservices mit KubernetesQAware GmbH
 
Terraform for azure: the good, the bad and the ugly -
Terraform for azure: the good, the bad and the ugly -Terraform for azure: the good, the bad and the ugly -
Terraform for azure: the good, the bad and the ugly -Giulio Vian
 
Building Deploying and Managing Microservices-based Applications with Azure P...
Building Deploying and Managing Microservices-based Applications with Azure P...Building Deploying and Managing Microservices-based Applications with Azure P...
Building Deploying and Managing Microservices-based Applications with Azure P...CodeOps Technologies LLP
 
DevOpsCon Cloud Workshop
DevOpsCon Cloud Workshop DevOpsCon Cloud Workshop
DevOpsCon Cloud Workshop Sascha Möllering
 

Recommended

Kubernetes-Fundamentals.pptx
Kubernetes-Fundamentals.pptxKubernetes-Fundamentals.pptx
Kubernetes-Fundamentals.pptxsatish642065
 
Terraform for azure: the good, the bad and the ugly -
Terraform for azure: the good, the bad and the ugly - Terraform for azure: the good, the bad and the ugly -
Terraform for azure: the good, the bad and the ugly - Giulio Vian
 
COP_RoR_QuArrk_Session_Oct_2022.pptx
COP_RoR_QuArrk_Session_Oct_2022.pptxCOP_RoR_QuArrk_Session_Oct_2022.pptx
COP_RoR_QuArrk_Session_Oct_2022.pptxNitesh95975
 
From Docker Straight to AWS
From Docker Straight to AWSFrom Docker Straight to AWS
From Docker Straight to AWSDevOps.com
 
Cloud-native .NET Microservices mit Kubernetes
Cloud-native .NET Microservices mit KubernetesCloud-native .NET Microservices mit Kubernetes
Cloud-native .NET Microservices mit KubernetesQAware GmbH
 
Terraform for azure: the good, the bad and the ugly -
Terraform for azure: the good, the bad and the ugly -Terraform for azure: the good, the bad and the ugly -
Terraform for azure: the good, the bad and the ugly -Giulio Vian
 
Building Deploying and Managing Microservices-based Applications with Azure P...
Building Deploying and Managing Microservices-based Applications with Azure P...Building Deploying and Managing Microservices-based Applications with Azure P...
Building Deploying and Managing Microservices-based Applications with Azure P...CodeOps Technologies LLP
 
DevOpsCon Cloud Workshop
DevOpsCon Cloud Workshop DevOpsCon Cloud Workshop
DevOpsCon Cloud Workshop Sascha Möllering
 
How (and why) to roll your own Docker SaaS
How (and why) to roll your own Docker SaaSHow (and why) to roll your own Docker SaaS
How (and why) to roll your own Docker SaaSRyan Crawford
 
Deploying a Kubernetes App with Amazon EKS
Deploying a Kubernetes App with Amazon EKSDeploying a Kubernetes App with Amazon EKS
Deploying a Kubernetes App with Amazon EKSLaura Frank Tacho
 
Building a Kubernetes App with Amazon EKS
Building a Kubernetes App with Amazon EKSBuilding a Kubernetes App with Amazon EKS
Building a Kubernetes App with Amazon EKSDevOps.com
 
Kubernetes Day 2017 - Build, Ship and Run Your APP, Production !!
Kubernetes Day 2017 - Build, Ship and Run Your APP, Production !!Kubernetes Day 2017 - Build, Ship and Run Your APP, Production !!
Kubernetes Day 2017 - Build, Ship and Run Your APP, Production !!smalltown
 
Upgrading to Esri ArcGIS 10: Avoid the Pitfalls, Reap the Benefits
Upgrading to Esri ArcGIS 10: Avoid the Pitfalls, Reap the BenefitsUpgrading to Esri ArcGIS 10: Avoid the Pitfalls, Reap the Benefits
Upgrading to Esri ArcGIS 10: Avoid the Pitfalls, Reap the BenefitsSSP Innovations
 
Docker vs. Kubernetes vs. Serverless
Docker vs. Kubernetes vs. ServerlessDocker vs. Kubernetes vs. Serverless
Docker vs. Kubernetes vs. ServerlessLogicworksNY
 
56k.cloud training
56k.cloud training56k.cloud training
56k.cloud trainingBrian Christner
 
Experiences with AWS immutable deploys and job processing
Experiences with AWS immutable deploys and job processingExperiences with AWS immutable deploys and job processing
Experiences with AWS immutable deploys and job processingDocker, Inc.
 
Docker, cornerstone of an hybrid cloud?
Docker, cornerstone of an hybrid cloud?Docker, cornerstone of an hybrid cloud?
Docker, cornerstone of an hybrid cloud?Adrien Blind
 
04_Azure Kubernetes Service: Basic Practices for Developers_GAB2019
04_Azure Kubernetes Service: Basic Practices for Developers_GAB201904_Azure Kubernetes Service: Basic Practices for Developers_GAB2019
04_Azure Kubernetes Service: Basic Practices for Developers_GAB2019Kumton Suttiraksiri
 
20211028 ADDO Adapting to Covid with Serverless Craeg Strong Ariel Partners
20211028 ADDO Adapting to Covid with Serverless Craeg Strong Ariel Partners20211028 ADDO Adapting to Covid with Serverless Craeg Strong Ariel Partners
20211028 ADDO Adapting to Covid with Serverless Craeg Strong Ariel PartnersCraeg Strong
 
Kubo (Cloud Foundry Container Platform): Your Gateway Drug to Cloud-native
Kubo (Cloud Foundry Container Platform): Your Gateway Drug to Cloud-nativeKubo (Cloud Foundry Container Platform): Your Gateway Drug to Cloud-native
Kubo (Cloud Foundry Container Platform): Your Gateway Drug to Cloud-nativecornelia davis
 
Kubo (Cloud Foundry Container Platform): Your Gateway Drug to Cloud-native
Kubo (Cloud Foundry Container Platform): Your Gateway Drug to Cloud-nativeKubo (Cloud Foundry Container Platform): Your Gateway Drug to Cloud-native
Kubo (Cloud Foundry Container Platform): Your Gateway Drug to Cloud-nativeVMware Tanzu
 
ContainerDay 2020 - Using Docker as a frontend for Amazon ECS and AWS Fargate
ContainerDay 2020 - Using Docker as a frontend for Amazon ECS and AWS Fargate ContainerDay 2020 - Using Docker as a frontend for Amazon ECS and AWS Fargate
ContainerDay 2020 - Using Docker as a frontend for Amazon ECS and AWS Fargate Massimo Ferre'
 
20211202 NADOG Adapting to Covid with Serverless Craeg Strong Ariel Partners
20211202 NADOG Adapting to Covid with Serverless Craeg Strong Ariel Partners20211202 NADOG Adapting to Covid with Serverless Craeg Strong Ariel Partners
20211202 NADOG Adapting to Covid with Serverless Craeg Strong Ariel PartnersCraeg Strong
 
TestCorner#22 - Evolving QA implementation for Microservices in Viveport
TestCorner#22 - Evolving QA implementation for Microservices in ViveportTestCorner#22 - Evolving QA implementation for Microservices in Viveport
TestCorner#22 - Evolving QA implementation for Microservices in ViveportHTC
 
Jenkins as a Service - Code all the way down
Jenkins as a Service - Code all the way downJenkins as a Service - Code all the way down
Jenkins as a Service - Code all the way downSteve Mactaggart
 
Kubernetes for .NET Developers
Kubernetes for .NET DevelopersKubernetes for .NET Developers
Kubernetes for .NET DevelopersLorenzo Barbieri
 
Docker ee an architecture and operations overview
Docker ee an architecture and operations overviewDocker ee an architecture and operations overview
Docker ee an architecture and operations overviewDocker, Inc.
 
Compare Docker deployment options in the public cloud
Compare Docker deployment options in the public cloudCompare Docker deployment options in the public cloud
Compare Docker deployment options in the public cloudSreenivas Makam
 
Delhi 99530 vip 56974 Genuine Escort Service Call Girls in Kishangarh
Delhi 99530 vip 56974 Genuine Escort Service Call Girls in KishangarhDelhi 99530 vip 56974 Genuine Escort Service Call Girls in Kishangarh
Delhi 99530 vip 56974 Genuine Escort Service Call Girls in Kishangarh9953056974 Low Rate Call Girls In Saket, Delhi NCR
 
Digital Advertising Lecture for Advanced Digital & Social Media Strategy at U...
Digital Advertising Lecture for Advanced Digital & Social Media Strategy at U...Digital Advertising Lecture for Advanced Digital & Social Media Strategy at U...
Digital Advertising Lecture for Advanced Digital & Social Media Strategy at U...Valters Lauzums
 

More Related Content

Similar to Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx

How (and why) to roll your own Docker SaaS
How (and why) to roll your own Docker SaaSHow (and why) to roll your own Docker SaaS
How (and why) to roll your own Docker SaaSRyan Crawford
 
Deploying a Kubernetes App with Amazon EKS
Deploying a Kubernetes App with Amazon EKSDeploying a Kubernetes App with Amazon EKS
Deploying a Kubernetes App with Amazon EKSLaura Frank Tacho
 
Building a Kubernetes App with Amazon EKS
Building a Kubernetes App with Amazon EKSBuilding a Kubernetes App with Amazon EKS
Building a Kubernetes App with Amazon EKSDevOps.com
 
Kubernetes Day 2017 - Build, Ship and Run Your APP, Production !!
Kubernetes Day 2017 - Build, Ship and Run Your APP, Production !!Kubernetes Day 2017 - Build, Ship and Run Your APP, Production !!
Kubernetes Day 2017 - Build, Ship and Run Your APP, Production !!smalltown
 
Upgrading to Esri ArcGIS 10: Avoid the Pitfalls, Reap the Benefits
Upgrading to Esri ArcGIS 10: Avoid the Pitfalls, Reap the BenefitsUpgrading to Esri ArcGIS 10: Avoid the Pitfalls, Reap the Benefits
Upgrading to Esri ArcGIS 10: Avoid the Pitfalls, Reap the BenefitsSSP Innovations
 
Docker vs. Kubernetes vs. Serverless
Docker vs. Kubernetes vs. ServerlessDocker vs. Kubernetes vs. Serverless
Docker vs. Kubernetes vs. ServerlessLogicworksNY
 
Experiences with AWS immutable deploys and job processing
Experiences with AWS immutable deploys and job processingExperiences with AWS immutable deploys and job processing
Experiences with AWS immutable deploys and job processingDocker, Inc.
 
Docker, cornerstone of an hybrid cloud?
Docker, cornerstone of an hybrid cloud?Docker, cornerstone of an hybrid cloud?
Docker, cornerstone of an hybrid cloud?Adrien Blind
 
04_Azure Kubernetes Service: Basic Practices for Developers_GAB2019
04_Azure Kubernetes Service: Basic Practices for Developers_GAB201904_Azure Kubernetes Service: Basic Practices for Developers_GAB2019
04_Azure Kubernetes Service: Basic Practices for Developers_GAB2019Kumton Suttiraksiri
 
20211028 ADDO Adapting to Covid with Serverless Craeg Strong Ariel Partners
20211028 ADDO Adapting to Covid with Serverless Craeg Strong Ariel Partners20211028 ADDO Adapting to Covid with Serverless Craeg Strong Ariel Partners
20211028 ADDO Adapting to Covid with Serverless Craeg Strong Ariel PartnersCraeg Strong
 
Kubo (Cloud Foundry Container Platform): Your Gateway Drug to Cloud-native
Kubo (Cloud Foundry Container Platform): Your Gateway Drug to Cloud-nativeKubo (Cloud Foundry Container Platform): Your Gateway Drug to Cloud-native
Kubo (Cloud Foundry Container Platform): Your Gateway Drug to Cloud-nativecornelia davis
 
Kubo (Cloud Foundry Container Platform): Your Gateway Drug to Cloud-native
Kubo (Cloud Foundry Container Platform): Your Gateway Drug to Cloud-nativeKubo (Cloud Foundry Container Platform): Your Gateway Drug to Cloud-native
Kubo (Cloud Foundry Container Platform): Your Gateway Drug to Cloud-nativeVMware Tanzu
 
ContainerDay 2020 - Using Docker as a frontend for Amazon ECS and AWS Fargate
ContainerDay 2020 - Using Docker as a frontend for Amazon ECS and AWS Fargate ContainerDay 2020 - Using Docker as a frontend for Amazon ECS and AWS Fargate
ContainerDay 2020 - Using Docker as a frontend for Amazon ECS and AWS Fargate Massimo Ferre'
 
20211202 NADOG Adapting to Covid with Serverless Craeg Strong Ariel Partners
20211202 NADOG Adapting to Covid with Serverless Craeg Strong Ariel Partners20211202 NADOG Adapting to Covid with Serverless Craeg Strong Ariel Partners
20211202 NADOG Adapting to Covid with Serverless Craeg Strong Ariel PartnersCraeg Strong
 
TestCorner#22 - Evolving QA implementation for Microservices in Viveport
TestCorner#22 - Evolving QA implementation for Microservices in ViveportTestCorner#22 - Evolving QA implementation for Microservices in Viveport
TestCorner#22 - Evolving QA implementation for Microservices in ViveportHTC
 
Jenkins as a Service - Code all the way down
Jenkins as a Service - Code all the way downJenkins as a Service - Code all the way down
Jenkins as a Service - Code all the way downSteve Mactaggart
 
Kubernetes for .NET Developers
Kubernetes for .NET DevelopersKubernetes for .NET Developers
Kubernetes for .NET DevelopersLorenzo Barbieri
 
Docker ee an architecture and operations overview
Docker ee an architecture and operations overviewDocker ee an architecture and operations overview
Docker ee an architecture and operations overviewDocker, Inc.
 
Compare Docker deployment options in the public cloud
Compare Docker deployment options in the public cloudCompare Docker deployment options in the public cloud
Compare Docker deployment options in the public cloudSreenivas Makam
 

Similar to Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx (20)

How (and why) to roll your own Docker SaaS
How (and why) to roll your own Docker SaaSHow (and why) to roll your own Docker SaaS
How (and why) to roll your own Docker SaaS
 
Deploying a Kubernetes App with Amazon EKS
Deploying a Kubernetes App with Amazon EKSDeploying a Kubernetes App with Amazon EKS
Deploying a Kubernetes App with Amazon EKS
 
Building a Kubernetes App with Amazon EKS
Building a Kubernetes App with Amazon EKSBuilding a Kubernetes App with Amazon EKS
Building a Kubernetes App with Amazon EKS
 
Kubernetes Day 2017 - Build, Ship and Run Your APP, Production !!
Kubernetes Day 2017 - Build, Ship and Run Your APP, Production !!Kubernetes Day 2017 - Build, Ship and Run Your APP, Production !!
Kubernetes Day 2017 - Build, Ship and Run Your APP, Production !!
 
Upgrading to Esri ArcGIS 10: Avoid the Pitfalls, Reap the Benefits
Upgrading to Esri ArcGIS 10: Avoid the Pitfalls, Reap the BenefitsUpgrading to Esri ArcGIS 10: Avoid the Pitfalls, Reap the Benefits
Upgrading to Esri ArcGIS 10: Avoid the Pitfalls, Reap the Benefits
 
Docker vs. Kubernetes vs. Serverless
Docker vs. Kubernetes vs. ServerlessDocker vs. Kubernetes vs. Serverless
Docker vs. Kubernetes vs. Serverless
 
56k.cloud training
56k.cloud training56k.cloud training
56k.cloud training
 
Experiences with AWS immutable deploys and job processing
Experiences with AWS immutable deploys and job processingExperiences with AWS immutable deploys and job processing
Experiences with AWS immutable deploys and job processing
 
Docker, cornerstone of an hybrid cloud?
Docker, cornerstone of an hybrid cloud?Docker, cornerstone of an hybrid cloud?
Docker, cornerstone of an hybrid cloud?
 
04_Azure Kubernetes Service: Basic Practices for Developers_GAB2019
04_Azure Kubernetes Service: Basic Practices for Developers_GAB201904_Azure Kubernetes Service: Basic Practices for Developers_GAB2019
04_Azure Kubernetes Service: Basic Practices for Developers_GAB2019
 
20211028 ADDO Adapting to Covid with Serverless Craeg Strong Ariel Partners
20211028 ADDO Adapting to Covid with Serverless Craeg Strong Ariel Partners20211028 ADDO Adapting to Covid with Serverless Craeg Strong Ariel Partners
20211028 ADDO Adapting to Covid with Serverless Craeg Strong Ariel Partners
 
Kubo (Cloud Foundry Container Platform): Your Gateway Drug to Cloud-native
Kubo (Cloud Foundry Container Platform): Your Gateway Drug to Cloud-nativeKubo (Cloud Foundry Container Platform): Your Gateway Drug to Cloud-native
Kubo (Cloud Foundry Container Platform): Your Gateway Drug to Cloud-native
 
Kubo (Cloud Foundry Container Platform): Your Gateway Drug to Cloud-native
Kubo (Cloud Foundry Container Platform): Your Gateway Drug to Cloud-nativeKubo (Cloud Foundry Container Platform): Your Gateway Drug to Cloud-native
Kubo (Cloud Foundry Container Platform): Your Gateway Drug to Cloud-native
 
ContainerDay 2020 - Using Docker as a frontend for Amazon ECS and AWS Fargate
ContainerDay 2020 - Using Docker as a frontend for Amazon ECS and AWS Fargate ContainerDay 2020 - Using Docker as a frontend for Amazon ECS and AWS Fargate
ContainerDay 2020 - Using Docker as a frontend for Amazon ECS and AWS Fargate
 
20211202 NADOG Adapting to Covid with Serverless Craeg Strong Ariel Partners
20211202 NADOG Adapting to Covid with Serverless Craeg Strong Ariel Partners20211202 NADOG Adapting to Covid with Serverless Craeg Strong Ariel Partners
20211202 NADOG Adapting to Covid with Serverless Craeg Strong Ariel Partners
 
TestCorner#22 - Evolving QA implementation for Microservices in Viveport
TestCorner#22 - Evolving QA implementation for Microservices in ViveportTestCorner#22 - Evolving QA implementation for Microservices in Viveport
TestCorner#22 - Evolving QA implementation for Microservices in Viveport
 
Jenkins as a Service - Code all the way down
Jenkins as a Service - Code all the way downJenkins as a Service - Code all the way down
Jenkins as a Service - Code all the way down
 
Kubernetes for .NET Developers
Kubernetes for .NET DevelopersKubernetes for .NET Developers
Kubernetes for .NET Developers
 
Docker ee an architecture and operations overview
Docker ee an architecture and operations overviewDocker ee an architecture and operations overview
Docker ee an architecture and operations overview
 
Compare Docker deployment options in the public cloud
Compare Docker deployment options in the public cloudCompare Docker deployment options in the public cloud
Compare Docker deployment options in the public cloud
 

Recently uploaded

Digital Advertising Lecture for Advanced Digital & Social Media Strategy at U...
Digital Advertising Lecture for Advanced Digital & Social Media Strategy at U...Digital Advertising Lecture for Advanced Digital & Social Media Strategy at U...
Digital Advertising Lecture for Advanced Digital & Social Media Strategy at U...Valters Lauzums
 
Delhi Call Girls Punjabi Bagh 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip Call
Delhi Call Girls Punjabi Bagh 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip CallDelhi Call Girls Punjabi Bagh 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip Call
Delhi Call Girls Punjabi Bagh 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip Callshivangimorya083
 
Market Analysis in the 5 Largest Economic Countries in Southeast Asia.pdf
Market Analysis in the 5 Largest Economic Countries in Southeast Asia.pdfMarket Analysis in the 5 Largest Economic Countries in Southeast Asia.pdf
Market Analysis in the 5 Largest Economic Countries in Southeast Asia.pdfRachmat Ramadhan H
 
Discover Why Less is More in B2B Research
Discover Why Less is More in B2B ResearchDiscover Why Less is More in B2B Research
Discover Why Less is More in B2B Researchmichael115558
 
Log Analysis using OSSEC sasoasasasas.pptx
Log Analysis using OSSEC sasoasasasas.pptxLog Analysis using OSSEC sasoasasasas.pptx
Log Analysis using OSSEC sasoasasasas.pptxJohnnyPlasten
 
Invezz.com - Grow your wealth with trading signals
Invezz.com - Grow your wealth with trading signalsInvezz.com - Grow your wealth with trading signals
Invezz.com - Grow your wealth with trading signalsInvezz1
 
CebaBaby dropshipping via API with DroFX.pptx
CebaBaby dropshipping via API with DroFX.pptxCebaBaby dropshipping via API with DroFX.pptx
CebaBaby dropshipping via API with DroFX.pptxolyaivanovalion
 
Midocean dropshipping via API with DroFx
Midocean dropshipping via API with DroFxMidocean dropshipping via API with DroFx
Midocean dropshipping via API with DroFxolyaivanovalion
 
Delhi Call Girls CP 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip Call
Delhi Call Girls CP 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip CallDelhi Call Girls CP 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip Call
Delhi Call Girls CP 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip Callshivangimorya083
 
VIP Model Call Girls Hinjewadi ( Pune ) Call ON 8005736733 Starting From 5K t...
VIP Model Call Girls Hinjewadi ( Pune ) Call ON 8005736733 Starting From 5K t...VIP Model Call Girls Hinjewadi ( Pune ) Call ON 8005736733 Starting From 5K t...
VIP Model Call Girls Hinjewadi ( Pune ) Call ON 8005736733 Starting From 5K t...SUHANI PANDEY
 
Halmar dropshipping via API with DroFx
Halmar dropshipping via API with DroFxHalmar dropshipping via API with DroFx
Halmar dropshipping via API with DroFxolyaivanovalion
 
Week-01-2.ppt BBB human Computer interaction
Week-01-2.ppt BBB human Computer interactionWeek-01-2.ppt BBB human Computer interaction
Week-01-2.ppt BBB human Computer interactionfulawalesam
 
Smarteg dropshipping via API with DroFx.pptx
Smarteg dropshipping via API with DroFx.pptxSmarteg dropshipping via API with DroFx.pptx
Smarteg dropshipping via API with DroFx.pptxolyaivanovalion
 
Call me @ 9892124323 Cheap Rate Call Girls in Vashi with Real Photo 100% Secure
Call me @ 9892124323 Cheap Rate Call Girls in Vashi with Real Photo 100% SecureCall me @ 9892124323 Cheap Rate Call Girls in Vashi with Real Photo 100% Secure
Call me @ 9892124323 Cheap Rate Call Girls in Vashi with Real Photo 100% SecurePooja Nehwal
 
Call Girls Indiranagar Just Call 👗 7737669865 👗 Top Class Call Girl Service B...
Call Girls Indiranagar Just Call 👗 7737669865 👗 Top Class Call Girl Service B...Call Girls Indiranagar Just Call 👗 7737669865 👗 Top Class Call Girl Service B...
Call Girls Indiranagar Just Call 👗 7737669865 👗 Top Class Call Girl Service B...amitlee9823
 
FESE Capital Markets Fact Sheet 2024 Q1.pdf
FESE Capital Markets Fact Sheet 2024 Q1.pdfFESE Capital Markets Fact Sheet 2024 Q1.pdf
FESE Capital Markets Fact Sheet 2024 Q1.pdfMarinCaroMartnezBerg
 

Recently uploaded (20)

Delhi 99530 vip 56974 Genuine Escort Service Call Girls in Kishangarh
Delhi 99530 vip 56974 Genuine Escort Service Call Girls in KishangarhDelhi 99530 vip 56974 Genuine Escort Service Call Girls in Kishangarh
Delhi 99530 vip 56974 Genuine Escort Service Call Girls in Kishangarh
 
Digital Advertising Lecture for Advanced Digital & Social Media Strategy at U...
Digital Advertising Lecture for Advanced Digital & Social Media Strategy at U...Digital Advertising Lecture for Advanced Digital & Social Media Strategy at U...
Digital Advertising Lecture for Advanced Digital & Social Media Strategy at U...
 
Abortion pills in Doha Qatar (+966572737505 ! Get Cytotec
Abortion pills in Doha Qatar (+966572737505 ! Get CytotecAbortion pills in Doha Qatar (+966572737505 ! Get Cytotec
Abortion pills in Doha Qatar (+966572737505 ! Get Cytotec
 
Delhi Call Girls Punjabi Bagh 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip Call
Delhi Call Girls Punjabi Bagh 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip CallDelhi Call Girls Punjabi Bagh 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip Call
Delhi Call Girls Punjabi Bagh 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip Call
 
Market Analysis in the 5 Largest Economic Countries in Southeast Asia.pdf
Market Analysis in the 5 Largest Economic Countries in Southeast Asia.pdfMarket Analysis in the 5 Largest Economic Countries in Southeast Asia.pdf
Market Analysis in the 5 Largest Economic Countries in Southeast Asia.pdf
 
Discover Why Less is More in B2B Research
Discover Why Less is More in B2B ResearchDiscover Why Less is More in B2B Research
Discover Why Less is More in B2B Research
 
Log Analysis using OSSEC sasoasasasas.pptx
Log Analysis using OSSEC sasoasasasas.pptxLog Analysis using OSSEC sasoasasasas.pptx
Log Analysis using OSSEC sasoasasasas.pptx
 
Call Girls In Shalimar Bagh ( Delhi) 9953330565 Escorts Service
Call Girls In Shalimar Bagh ( Delhi) 9953330565 Escorts ServiceCall Girls In Shalimar Bagh ( Delhi) 9953330565 Escorts Service
Call Girls In Shalimar Bagh ( Delhi) 9953330565 Escorts Service
 
Invezz.com - Grow your wealth with trading signals
Invezz.com - Grow your wealth with trading signalsInvezz.com - Grow your wealth with trading signals
Invezz.com - Grow your wealth with trading signals
 
CebaBaby dropshipping via API with DroFX.pptx
CebaBaby dropshipping via API with DroFX.pptxCebaBaby dropshipping via API with DroFX.pptx
CebaBaby dropshipping via API with DroFX.pptx
 
Midocean dropshipping via API with DroFx
Midocean dropshipping via API with DroFxMidocean dropshipping via API with DroFx
Midocean dropshipping via API with DroFx
 
Delhi Call Girls CP 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip Call
Delhi Call Girls CP 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip CallDelhi Call Girls CP 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip Call
Delhi Call Girls CP 9711199171 ☎✔👌✔ Whatsapp Hard And Sexy Vip Call
 
VIP Model Call Girls Hinjewadi ( Pune ) Call ON 8005736733 Starting From 5K t...
VIP Model Call Girls Hinjewadi ( Pune ) Call ON 8005736733 Starting From 5K t...VIP Model Call Girls Hinjewadi ( Pune ) Call ON 8005736733 Starting From 5K t...
VIP Model Call Girls Hinjewadi ( Pune ) Call ON 8005736733 Starting From 5K t...
 
Halmar dropshipping via API with DroFx
Halmar dropshipping via API with DroFxHalmar dropshipping via API with DroFx
Halmar dropshipping via API with DroFx
 
Week-01-2.ppt BBB human Computer interaction
Week-01-2.ppt BBB human Computer interactionWeek-01-2.ppt BBB human Computer interaction
Week-01-2.ppt BBB human Computer interaction
 
Smarteg dropshipping via API with DroFx.pptx
Smarteg dropshipping via API with DroFx.pptxSmarteg dropshipping via API with DroFx.pptx
Smarteg dropshipping via API with DroFx.pptx
 
Call me @ 9892124323 Cheap Rate Call Girls in Vashi with Real Photo 100% Secure
Call me @ 9892124323 Cheap Rate Call Girls in Vashi with Real Photo 100% SecureCall me @ 9892124323 Cheap Rate Call Girls in Vashi with Real Photo 100% Secure
Call me @ 9892124323 Cheap Rate Call Girls in Vashi with Real Photo 100% Secure
 
Call Girls Indiranagar Just Call 👗 7737669865 👗 Top Class Call Girl Service B...
Call Girls Indiranagar Just Call 👗 7737669865 👗 Top Class Call Girl Service B...Call Girls Indiranagar Just Call 👗 7737669865 👗 Top Class Call Girl Service B...
Call Girls Indiranagar Just Call 👗 7737669865 👗 Top Class Call Girl Service B...
 
(NEHA) Call Girls Katra Call Now 8617697112 Katra Escorts 24x7
(NEHA) Call Girls Katra Call Now 8617697112 Katra Escorts 24x7(NEHA) Call Girls Katra Call Now 8617697112 Katra Escorts 24x7
(NEHA) Call Girls Katra Call Now 8617697112 Katra Escorts 24x7
 
FESE Capital Markets Fact Sheet 2024 Q1.pdf
FESE Capital Markets Fact Sheet 2024 Q1.pdfFESE Capital Markets Fact Sheet 2024 Q1.pdf
FESE Capital Markets Fact Sheet 2024 Q1.pdf
 

Terraform-on-AWS-EKS-v5 adshdhddhowahaaaaaaaaaaa.pptx

  • 1. StackSimplify Terraform on AWS EKS Kubernetes - 50 Real-World Demos Kalyan Reddy Daida
  • 2. StackSimplify © Kalyan Reddy Daida AWS EKS Kubernetes Azure AKS Kubernetes Google GKE Kubernetes AWS CloudFormation DevOps on AWS & Azure AWS ECS Docker on AWS Kubernetes Certifications CKAD, CKA, CKS HashiCorp Certified Terraform Associate on AWS with 50 Practical Demos HashiCorp Certified Vault & Consul Terraform on AWS with SRE and IaC DevOps with 20 Real-World Demos HashiCorp Certified Terraform Associate on Azure with 60+ Practical Demos Terraform on Azure with IaC DevOps SRE with 20+ Real-World Demos Jenkins Ansible Azure Certs AZ-900, 104, 204, 400 DevOps & SRE Roadmap AWS Lambda Google Cloud Associate & Professional Certs Azure AKS Part-2 Python Terraform on AWS EKS Elastic Kubernetes Service with 50+ Real-World Demos
  • 3. StackSimplify Terraform on AWS EKS Kubernetes - 50 Real-World Demos Kalyan Reddy Daida
  • 4. StackSimplify © Kalyan Reddy Daida Terraform Fundamentals (4.5 Hours) Kubernetes Fundamentals (3 Hours) AWS VPC 3-Tier Network EC2 Bastion Host in Public Subnets EKS Cluster (Public and Private Node Group) Kubernetes Deployment & Services using TF k8s Provider Terraform Remote State Storage (Key Concept for Real-World Implementation) EKS Cluster EKS IRSA (AWS IAM Roles for k8s Service Accounts) Kubernetes Storage: EBS CSI (5 Demos) EKS IAM (7 Demos) EKS Load Balancer Controller Ingress (17 Demos) EKS Fargate (3 Demos) Autoscaling (Cluster Autoscaler, HPA, VPA) EKS Monitoring and Logging (CloudWatch Agent + FluentBit) 50 Real-World Demos Kubernetes Storage: EFS CSI (4 Demos)
  • 5. StackSimplify © Kalyan Reddy Daida GitHub Step-by-Step Documentation
  • 6. StackSimplify © Kalyan Reddy Daida How are Terraform Projects organized ? 4 Terraform Projects 1 YAML Project EKS Cluster Terraform Project
  • 7. StackSimplify © Kalyan Reddy Daida How are Terraform Projects organized ? AWS Load Balancer Controller Terraform Project AWS External DNS Terraform Project Ingress + External DNS YAML Project
  • 8. StackSimplify © Kalyan Reddy Daida How are Terraform Projects organized ? Ingress + External DNS Terraform Project In short, every AWS EKS demo is automated with Terraform Every Terraform Project is organized in GitHub and contains step by step documentation
  • 9. StackSimplify © Kalyan Reddy Daida AWS EKS Kubernetes Storage AWS EBS Volume Volume Volume Volume Volume AWS EBS CSI Install on EKS Kubernetes Sample App with EBS Volumes (YAML Manifests) Kubernetes Sample App with EBS Volumes (Terraform Manifests) D1 D2 D3 AWS EFS CSI Install on EKS AWS EFS Static Provisioning AWS EFS Dynamic Provisioning D1 D2 D3 Elastic File System (AWS EFS) File system File system File system File system AWS EFS Mounts for Fargate Workloads D4 EBS CSI Controller EFS CSI Controller EBS Volumes Resizing D4 EBS CSI Install using EKS Add-On D5
  • 10. StackSimplify © Kalyan Reddy Daida AWS EKS Autoscaling, Monitoring & Logging Kubernetes Cluster Autoscaler Install Cluster Autoscaler Testing using Sample App Horizontal Pod Autoscaler with Sample App D1 D2 D3 EKS Monitoring & Logging (Implement using kubectl) EKS Monitoring & Logging (Automate with Terraform) D1 D2 Autoscaling Monitoring & Logging Vertical Pod Autoscaler Install D4 Vertical Pod Autoscaler Testing with Sample App D5 CloudWatch Agent FluentBit CloudWatch Agent FluentBit
  • 11. StackSimplify © Kalyan Reddy Daida A Developer requesting full access to a namespace (dev) in EKS Cluster and in addition, also asking for read- only access to EKS Cluster 1. Kubernetes Role 2. Kubernetes Role Binding 3. Kubernetes Cluster Role 4. Kubernetes Cluster Role Binding Section-19 Section-20 Section-21 Section-22 Section-23 Section-24 Section-25 IAM IAM Policy IAM Role Kubernetes Config Map IAM User IAM Group Role Binding Role Cluster Role Binding Cluster Role AWS EKS IAM Demos Provision AWS IAM Admins as EKS Admins Provision AWS IAM Basic User as EKS Admin Automate Section-19,20 with Terraform Provision EKS Admins with AWS IAM Roles & IAM Groups Automate Section-22 with Terraform Provision EKS Read-Only Users with IAM Roles, IAM Groups, Kubernetes Cluster Role and Cluster Role Binding
  • 12. StackSimplify © Kalyan Reddy Daida AWS Load Balancer Controller Install Ingress Basics Ingress Context Path Routing Ingress SSL & SSL Redirect Ingress Cross Namespaces External DNS Install Ingress + External DNS k8s Service + External DNS Ingress Name based Virtual Host Routing SSL Discovery - Host SSL Discovery - TLS Ingress Groups Ingress Target Type - IP Ingress Internal ALB D1 D2 D3 D4 D5 D6 D7 D8 D9 D10 D11 D12 D13 D14 AWS Load Balancer Controller AWS Application Load Balancer Kubernetes Ingress Service Terraform Kubernetes Provider AWS EKS Load Balancer Demos
  • 13. StackSimplify © Kalyan Reddy Daida Network Load Balancer Basics Network Load Balancer TLS + External DNS Network Load Balancer Internal LB AWS Load Balancer Controller AWS Network Load Balancer Kubernetes Service Terraform Kubernetes Provider D15 D16 D17 AWS EKS Load Balancer Controller Demos AWS Fargate EKS Fargate Profiles Run k8s Workloads on Fargate Fargate Only EKS Cluster (VERY IMPORTANT) D1 D2 D3 EKS Cluster Fargate Elastic Load Balancing Application Load Balancer Network Load Balancer
  • 14. StackSimplify © Kalyan Reddy Daida Terraform Providers AWS Kubernetes Kubectl HELM NULL HTTP Terraform Providers
  • 15. StackSimplify © Kalyan Reddy Daida GitHub Repository Repository Used For Repository URL Course Main Repository with step-by-step documentation https://github.com/stacksimplify/terraform-on-aws-eks
  • 16. StackSimplify © Kalyan Reddy Daida END OF INTRODUCTION
  • 17. StackSimplify © Kalyan Reddy Daida Terraform Infrastructure as Code IaC
  • 18. StackSimplify © Kalyan Reddy Daida What is Infrastructure as Code ?
  • 19. StackSimplify © Kalyan Reddy Daida Traditional Way of Managing Infrastructure Dev QA Staging Production Disaster Recovery Admin-1 Admin-1 Documentation Admin-2 Admin-2 Admin-2 5 Days 5 Days 5 Days 5 Days 5 Days Total Time: 25 Days
  • 20. StackSimplify © Kalyan Reddy Daida Traditional Way of Managing Infrastructure Dev QA Staging Production Disaster Recovery Admin-1 Admin-1 Documentation (Steps Missing) Admin-2 Admin-2 Admin-2 No CI Delays Issues Outages Not-in- Sync Many Problems at many places in manual process
  • 21. StackSimplify © Kalyan Reddy Daida Traditional Way of Managing Infrastructure Dev QA Staging Production Disaster Recovery Admin-1 Admin-1 Documentation Admin-2 Admin-2 Admin-2 Infrastructure scalability – Workforce need to be increased to meet the timelines Dev QA Staging Production Disaster Recovery Documentation Admin-3 Admin-3 Admin-4 Admin-4 Admin-4
  • 22. StackSimplify © Kalyan Reddy Daida Traditional Way of Managing Infrastructure Prod-1 Prod-2 Prod-3 Prod-4 On-Demand Scale-Up and Scale-Down is not an option Prod-1 Prod-2 Scale Up Scale Down
  • 23. StackSimplify © Kalyan Reddy Daida Manage using IaC with Terraform Dev QA Staging Production Disaster Recovery Admin-1 5 Days Total Time: 25 Days reduced to 5 days, Provisioning environments will be in minutes or seconds Check-In TF Code Triggers TF Runs Creates Infra Terraform Cloud One-Time Work Re-Use Template s Quick & Fast Reliable Tracked for Audit DevOps / CI CD for IaC Scale-Up and Scale-Down On-Demand Github
  • 24. StackSimplify © Kalyan Reddy Daida Manage using IaC with Terraform Visibility IaC serves as a very clear reference of what resources we created, and what their settings are. We don’t have to navigate to the web console to check the parameters. Stability If you accidentally change the wrong setting or delete the wrong resource in the web console you can break things. IaC helps solve this, especially when it is combined with version control, such as Git. Scalability With IaC we can write it once and then reuse it many times. This means that one well written template can be used as the basis for multiple services, in multiple regions around the world, making it much easier to horizontally scale. Security Once again IaC gives you a unified template for how to deploy our architecture. If we create one well secured architecture we can reuse it multiple times, and know that each deployed version is following the same settings. Audit Terraform not only creates resources it also maintains the record of what is created in real world cloud environments using its State files.
  • 25. StackSimplify © Kalyan Reddy Daida Google Trends – Past 5 Years
  • 26. StackSimplify © Kalyan Reddy Daida Google Trends – Past 1 Year
  • 27. StackSimplify © Kalyan Reddy Daida Terraform Site Reliability Engineering SRE
  • 28. StackSimplify © Kalyan Reddy Daida What is SRE?
  • 29. StackSimplify © Kalyan Reddy Daida 50% Infrastructure Automation 50% Operations Site Reliability Engineering - SRE Our course primarily focuses on Infrastructure Automation which will be a key role for an SRE even though weightage is 50%
  • 30. StackSimplify © Kalyan Reddy Daida Terraform Installation
  • 31. StackSimplify © Kalyan Reddy Daida Terraform Installation Terraform CLI AWS CLI VS Code Editor Terraform plugin for VS Code Mac OS Linux OS Windows OS
  • 32. StackSimplify © Kalyan Reddy Daida Terraform Command Basics
  • 33. StackSimplify © Kalyan Reddy Daida init validate plan apply destroy 1 2 3 4 5 terraform init terraform validate terraform plan terraform apply terraform destroy Terraform Workflow
  • 34. StackSimplify © Kalyan Reddy Daida init validate plan apply destroy 1 2 3 4 5 • Used to Initialize a working directory containing terraform config files • This is the first command that should be run after writing a new Terraform configuration • Downloads Providers • Validates the terraform configurations files in that respective directory to ensure they are syntactically valid and internally consistent. • Creates an execution plan • Terraform performs a refresh and determines what actions are necessary to achieve the desired state specified in configuration files • Used to apply the changes required to reach the desired state of the configuration. • By default, apply scan s the current directory for the configuration and applies the changes appropriately. • Used to destroy the Terraform- managed infrastructure • This will ask for confirmation before destroying. Terraform Workflow
  • 35. StackSimplify © Kalyan Reddy Daida Terraform Language Basics
  • 36. StackSimplify © Kalyan Reddy Daida • Code in the Terraform language is stored in plain text files with the .tf file extension. • There is also a JSON-based variant of the language that is named with the .tf.json file extension. • We can call the files containing terraform code as Terraform Configuration Files or Terraform Manifests Terraform Language Basics – Files Terraform Working Directory Terraform Configuration Files ending with .tf as extension
  • 37. StackSimplify © Kalyan Reddy Daida Terraform Language Basics – Configuration Syntax Blocks Arguments Identifiers Comments HCL – HashiCorp Language Terraform
  • 38. StackSimplify © Kalyan Reddy Daida Terraform Language Basics – Configuration Syntax Block Type Block Labels Arguments Based on Block Type block labels will be 1 or 2 Example: Resource – 2 labels Variables – 1 label Top Level & Block inside Blocks Top Level Blocks: resource, provider Block Inside Block: provisioners, resource specific blocks like tags
  • 39. StackSimplify © Kalyan Reddy Daida Terraform Language Basics – Configuration Syntax Argument Name [or] Identifier Argument Value [or] Expression
  • 40. StackSimplify © Kalyan Reddy Daida Terraform Language Basics – Configuration Syntax Single Line Comments with # or // Multi-line comment
  • 41. StackSimplify © Kalyan Reddy Daida Terraform Block Providers Block Resources Block Input Variables Block Output Values Block Data Sources Block Modules Block Local Values Block Terraform Top-Level Blocks Fundamental Blocks Variable Blocks Calling / Referencing Blocks Terraform language uses a limited number of top-level block types, which are blocks that can appear outside of any other block in a TF configuration file. Most of Terraform's features are implemented as top-level blocks.
  • 42. StackSimplify © Kalyan Reddy Daida Terraform Fundamental Blocks
  • 43. StackSimplify © Kalyan Reddy Daida Terraform Basic Blocks Terraform Block Provider Block Resource Block Special block used to configure some behaviors Required Terraform Version List Required Providers Terraform Backend HEART of Terraform Terraform relies on providers to interact with Remote Systems Declare providers for Terraform to install providers & use them Provider configurations belong to Root Module Each Resource Block describes one or more Infrastructure Objects Resource Syntax: How to declare Resources? Resource Behavior: How Terraform handles resource declarations? Provisioners: We can configure Resource post-creation actions c1-versions.tf c2-resource-name.tf
  • 44. StackSimplify © Kalyan Reddy Daida Terraform Block
  • 45. StackSimplify © Kalyan Reddy Daida • This block can be called in 3 ways. All means the same. • Terraform Block • Terraform Settings Block • Terraform Configuration Block • Each terraform block can contain a number of settings related to Terraform's behavior. • VERY VERY IMPORTANT TO MEMORIZE • Within a terraform block, only constant values can be used; arguments may not refer to named objects such as resources, input variables, etc, and may not use any of the Terraform language built-in functions. Terraform Block
  • 46. StackSimplify © Kalyan Reddy Daida Terraform Block from 0.13 onwards
  • 47. StackSimplify © Kalyan Reddy Daida Terraform Block Terraform Block Required Terraform Version Provider Requirements Terraform Backend Experimental Language Features Passing Metadata to Providers
  • 48. StackSimplify © Kalyan Reddy Daida Terraform Providers
  • 49. StackSimplify © Kalyan Reddy Daida Terraform Providers AWS Cloud VPC Public subnet EC2 Instance AWS APIs Terraform Admin Local Desktop Terraform CLI Terraform AWS Provider Terraform Registry terraform init terraform plan terraform destroy terraform apply Providers are HEART of Terraform Without Providers Terraform cannot manage any infrastructure. Providers are distributed separately from Terraform and each provider has its own release cycles and Version Numbers Terraform Registry is publicly available which contains many Terraform Providers for most major Infra Platforms Every Resource Type (example: EC2 Instance), is implemented by a Provider 1 2 terraform validate 3 4 5
  • 50. StackSimplify © Kalyan Reddy Daida Provider Requirements Provider Configuration Dependency Lock File Terraform Providers
  • 51. StackSimplify © Kalyan Reddy Daida Dependency Lock File
  • 52. StackSimplify © Kalyan Reddy Daida Required Providers Local Names Local Names are Module specific and should be unique per-module Terraform configurations always refer to local name of provider outside required_provider block Users of a provider can choose any local name for it (myaws, aws1, aws2). Recommended way of choosing local name is to use preferred local name of that provider (For AWS Provider: hashicorp/aws, preferred local name is aws) Source It is the primary location where we can download the Terraform Provider Source addresses consist of three parts delimited by slashes (/) [<HOSTNAME>/]<NAMESPACE>/<TYPE> registry.terraform.io/hashicorp/aws Registry Name is optional as default is going to be Terraform Public Registry
  • 53. StackSimplify © Kalyan Reddy Daida Terraform Provider Registry Providers Modules Provider Badges Provider Documentation These are owned and maintained by HashiCorp These are owned and maintained by third-party technology partners. HashiCorp has verified the authenticity of the Provider’s publisher Community providers are published to the Terraform Registry by individual maintainers, groups of maintainers, or other members of the Terraform community. Archived Providers are Official or Verified Providers that are no longer maintained by HashiCorp or the community. registry.terraform.io Terraform Registry
  • 54. StackSimplify © Kalyan Reddy Daida Terraform Resources Introduction
  • 55. StackSimplify © Kalyan Reddy Daida Terraform Language Basics – Configuration Syntax Block Type Block Labels Arguments Based on Block Type block labels will be 1 or 2 Example: Resource – 2 labels Variables – 1 label Top Level & Block inside Blocks Top Level Blocks: resource, provider Block Inside Block: provisioners, resource specific blocks like tags
  • 56. StackSimplify © Kalyan Reddy Daida Resource Syntax Resource Type: It determines the kind of infrastructure object it manages and what arguments and other attributes the resource supports. Resource Local Name: It is used to refer to this resource from elsewhere in the same Terraform module, but has no significance outside that module's scope. The resource type and name together serve as an identifier for a given resource and so must be unique within a module Meta-Arguments: Can be used with any resource to change the behavior of resources Resource Arguments: Will be specific to resource type. Argument Values can make use of Expressions or other Terraform Dynamic Language Features
  • 57. StackSimplify © Kalyan Reddy Daida Terraform State
  • 58. StackSimplify © Kalyan Reddy Daida Resource Behavior Terraform Resource Create Resource Destroy Resource Update in-place Resources Destroy and re- create Create resources that exist in the configuration but are not associated with a real infrastructure object in the state. Destroy resources that exist in the state but no longer exist in the configuration. Update in-place resources whose arguments have changed. Destroy and re-create resources whose arguments have changed but which cannot be updated in-place due to remote API limitations. Terraform State
  • 59. StackSimplify © Kalyan Reddy Daida Terraform State AWS Cloud VPC Public subnet EC2 Instance AWS APIs Terraform Admin Local Desktop Terraform CLI Terraform AWS Provider Terraform Registry terraform init terraform plan terraform destroy terraform apply This state is stored by default in a local file named "terraform.tfstate", but it can also be stored remotely, which works better in a team environment. The primary purpose of Terraform state is to store bindings between objects in a remote system and resource instances declared in your configuration. 1 2 terraform validate 3 4 5 Terraform State File terraform.tfstate Terraform must store state about your managed infrastructure and configuration This state is used by Terraform to map real world resources to your configuration (.tf files), keep track of metadata, and to improve performance for large infrastructures. When Terraform creates a remote object in response to a change of configuration, it will record the identity of that remote object against a particular resource instance, and then potentially update or delete that object in response to future configuration changes.
  • 60. StackSimplify © Kalyan Reddy Daida Desired & Current Terraform States terraform.tfstate Terraform Configuration Files Real World Resource – EC2 Instance Desired State Current State
  • 61. StackSimplify © Kalyan Reddy Daida Terraform Input Variables Datasources Outputs
  • 62. StackSimplify © Kalyan Reddy Daida What are we going to learn ? Default VPC AWS Cloud Public subnet EC2 Instance Security group VPC-SSH Security group VPC-Web EC2 Key Pair Terraform Input Variables Terraform Output Values Terraform Datasources Terraform Concepts AWS Services Dynamically get latest AMI ID
  • 63. StackSimplify © Kalyan Reddy Daida Terraform Variables Terraform Input Variables Terraform Output Values Terraform Local Values
  • 64. StackSimplify © Kalyan Reddy Daida Terraform Input Variables Terraform Input Variables Input Variables - Basics Provide Input Variables when prompted during terraform plan or apply Override default variable values using CLI argument -var Override default variable values using Environment Variables (TF_var_aa) Provide Input Variables using terraform.tfvars files Provide Input Variables using <any- name>.tfvars file with CLI argument -var-file Provide Input Variables using auto.tfvars files Implement complex type constructors like List & Map in Input Variables Implement Custom Validation Rules in Variables Protect Sensitive Input Variables Input variables serve as parameters for a Terraform module, allowing aspects of the module to be customized without altering the module's own source code, and allowing modules to be shared between different configurations. 1 2 3 4 5 6 7 8 9 10
  • 65. StackSimplify © Kalyan Reddy Daida Terraform Datasources Data sources allow data to be fetched or computed for use elsewhere in Terraform configuration. Use of data sources allows a Terraform configuration to make use of information defined outside of Terraform, or defined by another separate Terraform configuration. A data source is accessed via a special kind of resource known as a data resource, declared using a data block Each data resource is associated with a single data source, which determines the kind of object (or objects) it reads and what query constraint arguments are available Data resources have the same dependency resolution behavior as defined for managed resources. Setting the depends_on meta- argument within data blocks defers reading of the data source until after all changes to the dependencies have been applied.
  • 66. StackSimplify © Kalyan Reddy Daida Terraform Datasources We can refer the data resource in a resource as depicted Data resources support count and for_each meta-arguments as defined for managed resources, with the same syntax and behavior. Each instance will separately read from its data source with its own variant of the constraint arguments, producing an indexed result. Data resources support the provider meta-argument as defined for managed resources, with the same syntax and behavior. Data resources do not currently have any customization settings available for their lifecycle, but the lifecycle nested block is reserved in case any are added in future versions. Meta-Arguments for Datasources
  • 67. StackSimplify © Kalyan Reddy Daida Terraform Variables – Output Values Terraform Variables Outputs A root module can use outputs to print certain values in the CLI output after running terraform apply. When using remote state, root module outputs can be accessed by other configurations via a terraform_remote_state d ata source. A child module can use outputs to expose a subset of its resource attributes to a parent module. Output values are like the return values of a Terraform module and have several uses 1 2 3 Advanced
  • 68. StackSimplify © Kalyan Reddy Daida Terraform For Loops Lists & Maps Meta-Argument Count & for_each
  • 69. StackSimplify © Kalyan Reddy Daida Meta-Argument: count Variables: Lists & Maps For Loop with Lists For Loop with Maps For Loops with Advanced Maps Legacy Splat Operator (.*.) Latest Splat Operator [*] Meta-Argument: for_each Function: toset Function: tomap Datasource: aws_availability_zones Datasource: aws_ec2_instance_type_offerings Datasource: aws_availability_zones For Loop with Maps For Loop with if Function: keys Section-1 Section-2 Section-3 Section-4 Fix issues in Section-2 with section-3 Final Output Utility Project with Datasources
  • 70. StackSimplify © Kalyan Reddy Daida AWS VPC 3-Tier Web, App and DB Amazon Virtual Private Cloud (Amazon VPC) Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet
  • 71. StackSimplify © Kalyan Reddy Daida AWS VPC 3-Tier Architecture VPC AWS Cloud Availability Zone 1 Availability Zone 2 Private subnet Public subnet For EC2 Instances NAT gateway Private subnet For Databases Private subnet Public subnet For EC2 Instances NAT gateway Private subnet For Databases Internet gateway Outbound Communication Build manually using AWS Mgmt Console Build same using Terraform Terraform Modules Terraform Local Values Terraform Variables – terraform.tfvars Terraform Variables – vpc.auto.tfvars Terraform Version Constraints Terraform Code Organizing – Production Grade style Elastic IP address Elastic IP address
  • 72. StackSimplify © Kalyan Reddy Daida What are we going to Learn ? Build VPC manually using AWS Management Console Build VPC using Terraform Modules Standardize the Terraform Code at Production Grade
  • 73. StackSimplify © Kalyan Reddy Daida Terraform Modules Modules are containers for multiple resources that are used together. A module consists of a collection of .tf files kept together in a directory. Modules are the main way to package and reuse resource configurations with Terraform. Every Terraform configuration has at least one module, known as its root module, which consists of the resources defined in the .tf files in the main working directory A Terraform module (usually the root module of a configuration) can call other modules to include their resources into the configuration. Child modules can be called multiple times within the same configuration, and multiple configurations can use the same child module. In addition to modules from the local filesystem, Terraform can load modules from a public or private registry. This makes it possible to publish modules for others to use, and to use modules that others have published. A module that has been called by another module is often referred to as a child module.
  • 74. StackSimplify © Kalyan Reddy Daida AWS EC2 Bastion Host Terraform Provisioners Amazon Virtual Private Cloud (Amazon VPC) Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM
  • 75. StackSimplify © Kalyan Reddy Daida VPC AWS Cloud Availability Zone 1 Availability Zone 2 Private subnet Public subnet NAT gateway Private subnet For Databases Private subnet Public subnet Private subnet For Databases Internet gateway Outbound Communication Elastic IP address Bastion EC2 Instance Bastion Host Security group port 22 Destination: 0.0.0.0/0 AWS VPC + EC2 Instance + Security Groups Terraform & AWS Concepts Terraform Module: VPC Terraform Module: Security Group Terraform Module: AWS EC2 Instance Meta-Argument: depends_on Terraform null_resource Terraform File Provisioner Terraform Remote-exec Provisioner Terraform Local-exec Provisioner Admin SSH Port 22 EKS Cluster Tags for VPC Subnets Elastic IP address Terraform Datasource: aws_availability_zones (Dynamic)
  • 76. StackSimplify © Kalyan Reddy Daida What are we going to learn ? Create AWS VPC using Terraform Modules + Update AZs Create AWS Security Groups using Terraform Modules Create AWS EC2 Instance using Terraform Modules Null Resource File Provisioner Remote-exec Provisioner Create AWS AMI Datasource to get latest AMI ID dynamically Local-exec Provisioner Variables defined in .tfvars and .auto.tfvars formats Define generic variables and Local Values Create AWS EC2 Elastic IP for Bastion Host EC2 Instance Create Terraform Provisioners with Null Resource EKS Variables
  • 77. StackSimplify © Kalyan Reddy Daida Types of Provisioners Provisioner Types File Provisioner remote-exec Provisioner local-exec Provisioner Null Resource Connection Block Terraform Provisioners Concepts
  • 78. StackSimplify © Kalyan Reddy Daida Terraform Provisioners Provisioners can be used to model specific actions on the local machine or on a remote machine in order to prepare servers Passing data into virtual machines and other compute resources Running configuration management software (packer, chef, ansible) Provisioners are a Last Resort First-class Terraform provider functionality may be available Creation-Time Provisioners Destroy-Time Provisioners Failure Behaviour: Continue: Ignore the error and continue with creation or destruction. Failure Behaviour: Fail: Raise an error and stop applying (the default behavior). If creation provisioner fails, taint resource Most provisioners require access to the remote resource via SSH or WinRM, and expect a nested connection block with details about how to connect. Connection Block
  • 79. StackSimplify © Kalyan Reddy Daida Provisioners Introduction File Provisioner • File Provisioner is used to copy files or directories from the machine executing Terraform to the newly created resource. • The file provisioner supports both ssh and winrm type of connections remote-exec Provisioner • The remote-exec provisioner invokes a script on a remote resource after it is created. • This can be used to run a configuration management tool, bootstrap into a cluster, etc. local-exec Provisioner • The local-exec provisioner invokes a local executable after a resource is created. • This invokes a process on the machine running Terraform, not on the resource. null_resource • If you need to run provisioners that aren't directly associated with a specific resource, you can associate them with a null_resource. • Instances of null_resource are treated like normal resources, but they don't do anything. • Same as other resource, you can configure provisioners and connection details on a null_resource.
  • 80. StackSimplify © Kalyan Reddy Daida AWS EKS Cluster
  • 81. StackSimplify © Kalyan Reddy Daida AWS EKS – Core Objects EKS Cluster EKS Control Plane Worker Nodes & Node Groups Fargate Profiles (Serverless) VPC Contains Kubernetes Master components like etcd, kube- apiserver, kube- controller. It’s a managed service by AWS Group of EC2 Instances where we run our Application workloads Instead of EC2 Instances, we run our Application workloads on Serverless Fargate profiles With AWS VPC we follow secure networking standards which will allow us to run production workloads on EKS.
  • 82. StackSimplify © Kalyan Reddy Daida How does EKS work? © Amazon
  • 83. StackSimplify © Kalyan Reddy Daida EKS Control Plane 1. EKS runs a single tenant Kubernetes control plane for each cluster, and control plane infrastructure is not shared across clusters or AWS accounts. 2. This control plane consists of at least two API server nodes and three etcd nodes that run across three Availability Zones within a Region 3. EKS automatically detects and replaces unhealthy control plane instances, restarting them across the Availability Zones within the Region as needed. Worker Nodes & Node Groups 1. Worker machines in Kubernetes are called nodes. These are EC2 Instances 2. EKS worker nodes run in our AWS account and connect to our cluster's control plane via the cluster API server endpoint. 3. A node group is one or more EC2 instances that are deployed in an EC2 Autoscaling group. 4. All instances in a node group must 1. Be the same instance type 2. Be running the same AMI 3. Use the same EKS worker node IAM role EKS Cluster – Core Objects Detailed
  • 84. StackSimplify © Kalyan Reddy Daida Fargate Profiles 1. AWS Fargate is a technology that provides on-demand, right-sized compute capacity for containers 2. With Fargate, we no longer have to provision, configure, or scale groups of virtual machines to run containers. 3. Each pod running on Fargate has its own isolation boundary and does not share the underlying kernel, CPU resources, memory resources, or elastic network interface with another pod. 4. AWS specially built Fargate controllers that recognizes the pods belonging to fargate and schedules them on Fargate profiles. 5. We will see more in our Fargate learning section. VPC 1. EKS uses AWS VPC network policies to restrict traffic between control plane components to within a single cluster. 2. Control plane components for a EKS cluster cannot view or receive communication from other clusters or other AWS accounts, except as authorized with Kubernetes RBAC policies. 3. This secure and highly-available configuration makes EKS reliable and recommended for production workloads. EKS Cluster – Core Objects Detailed
  • 85. StackSimplify © Kalyan Reddy Daida Kubernetes Architecture
  • 86. StackSimplify © Kalyan Reddy Daida Kubernetes Architecture
  • 87. StackSimplify © Kalyan Reddy Daida Kubernetes - Architecture Kube Controller Manager Cloud Controller Manager kube-apiserver kube- scheduler etcd Container Runtime (Docker) Master Kube-Proxy Worker Node Kubelet Container Runtime (Docker) Kube-Proxy Worker Node Kubelet Container Runtime (Docker)
  • 88. StackSimplify © Kalyan Reddy Daida Kubernetes Architecture - Master Kube Controller Manager Cloud Controller Manager kube-apiserver kube- scheduler etcd Container Runtime (Docker) Master • kube-apiserver • It acts as front end for the Kubernetes control plane. It exposes the Kubernetes API • Command line tools (like kubectl), Users and even Master components (scheduler, controller manager, etcd) and Worker node components like (Kubelet) everything talk with API Server. • etcd • Consistent and highly-available key value store used as Kubernetes’ backing store for all cluster data. • It stores all the masters and worker node information. • kube-scheduler • Scheduler is responsible for distributing containers across multiple nodes. • It watches for newly created Pods with no assigned node, and selects a node for them to run on.
  • 89. StackSimplify © Kalyan Reddy Daida Kubernetes Architecture - Master Kube Controller Manager Cloud Controller Manager kube-apiserver kube- scheduler etcd Container Runtime (Docker) Master • kube-controller-manager • Controllers are responsible for noticing and responding when nodes, containers or endpoints go down. They make decisions to bring up new containers in such cases. • Node Controller: Responsible for noticing and responding when nodes go down. • Replication Controller: Responsible for maintaining the correct number of pods for every replication controller object in the system. • Endpoints Controller: Populates the Endpoints object (that is, joins Services & Pods) • Service Account & Token Controller: Creates default accounts and API Access for new namespaces.
  • 90. StackSimplify © Kalyan Reddy Daida Kubernetes Architecture - Master Kube Controller Manager Cloud Controller Manager kube-apiserver kube- scheduler etcd Container Runtime (Docker) Master • cloud-controller-manager • A Kubernetes control plane component that embeds cloud-specific control logic. • It only runs controllers that are specific to your cloud provider. • On-Premise Kubernetes clusters will not have this component. • Node controller: For checking the cloud provider to determine if a node has been deleted in the cloud after it stops responding • Route controller: For setting up routes in the underlying cloud infrastructure • Service controller: For creating, updating and deleting cloud provider load balancer
  • 91. StackSimplify © Kalyan Reddy Daida • Kubelet • Kubelet is the agent that runs on every node in the cluster • This agent is responsible for making sure that containers are running in a Pod on a node. • Kube-Proxy • It is a network proxy that runs on each node in your cluster. • It maintains network rules on nodes • In short, these network rules allow network communication to your Pods from network sessions inside or outside of your cluster. Kubernetes Architecture – Worker Nodes Kube-Proxy Worker Node Kubelet Container Runtime (Docker) • Container Runtime • Container Runtime is the underlying software where we run all these Kubernetes components. • We are using Docker, but we have other runtime options like rkt, container-d etc.
  • 92. StackSimplify © Kalyan Reddy Daida Kubernetes - Architecture Kube Controller Manager Cloud Controller Manager kube-apiserver kube- scheduler etcd Container Runtime (Docker) Master Kube-Proxy Worker Node Kubelet Container Runtime (Docker) Kube-Proxy Worker Node Kubelet Container Runtime (Docker)
  • 93. StackSimplify © Kalyan Reddy Daida AWS EKS Cluster
  • 94. StackSimplify © Kalyan Reddy Daida EKS Kubernetes - Architecture EKS Controller Manager Fargate Controller Manager kube-apiserver kube- scheduler etcd Container Runtime Master Kube-Proxy Worker Node -1 Kubelet Container Runtime (Docker) Kube-Proxy Worker Node - 2 Kubelet Container Runtime EKS Control Plane EKS Node Group
  • 95. StackSimplify © Kalyan Reddy Daida AWS EKS Cluster & Node Groups using Terraform Amazon Virtual Private Cloud (Amazon VPC) Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster
  • 96. StackSimplify © Kalyan Reddy Daida EKS Cluster Creation Options using Terraform Terraform Resources Terraform Module from Terraform Public Registry
  • 97. StackSimplify © Kalyan Reddy Daida AWS EKS Resources - High Level Breakdown Subnets (Public / Private) Route Tables NAT Gateway + Elastic IP Internet Gateway EKS Cluster IAM Role EKS Cluster Security Group EKS Cluster Network Interfaces EKS Node Group IAM Role EKS Node Group Security Group EKS Node Group Network Interfaces EKS Worker Nodes EC2 Instances Bastion Host EC2 Instance Bastion Host Security Group Bastion Host Elastic IP VPC Bastion Host (Optional) EKS Cluster EKS Node Group Pre-requisite Resources EKS Resources EKS Cluster
  • 98. StackSimplify © Kalyan Reddy Daida VPC (our AWS Account) AWS Cloud Availability Zone 1 Availability Zone 2 Private subnet Public subnet NAT gateway Private subnet Public subnet Internet gateway Private NG Security group – Port 22 Bastion EC2 Instance EKS Worker Node EKS Worker Node Bastion Security group Destination: 0.0.0.0/0 Destination: 0.0.0.0/0 EKS Cluster & EKS Node Groups in Public and Private Subnets Admin SSH 22 EKS Node Group in Private Subnets Public NG Security group – Port 22 EKS Worker Node EKS Worker Node Destination: 0.0.0.0/0 EKS Node Group in Public Subnets Elastic IP EKS Elastic network interface EKS Elastic network interface VPC (Amazon EKS) EKS Control Plane Amazon Elastic Container Registry (Amazon ECR) Public Node Group – Access to EKS API Server Endpoint Private Node Group – Access to EKS API Server Endpoint via NAT Gateway NATGW Elastic IP IAM Role for EKS Cluster IAM Role for EKS Node Groups AWS Identity and Access Management (IAM) EKS Cluster Security group kubectl Client Run kubectl commands by accessing EKS API Server Endpoint via Internet EKS Elastic Network Interfaces A
  • 99. StackSimplify © Kalyan Reddy Daida VPC (our AWS Account) AWS Cloud Availability Zone 1 Availability Zone 2 Private subnet Public subnet NAT gateway Private subnet Public subnet Internet gateway Private NG Security group – Port 22 Bastion EC2 Instance EKS Node Instance EKS Node Instance Bastion Security group Destination: 0.0.0.0/0 Destination: 0.0.0.0/0 EKS Cluster & EKS Node Groups in Public and Private Subnets Admin SSH 22 EKS Node Group in Private Subnets Public NG Security group – Port 22 EKS Node Instance EKS Node Instance Destination: 0.0.0.0/0 EKS Node Group in Public Subnets Elastic IP EKS Elastic network interface EKS Elastic network interface VPC (Amazon EKS) EKS Control Plane Amazon Elastic Container Registry (Amazon ECR) Public Node Group – Access to EKS API Server Endpoint Private Node Group – Access to EKS API Server Endpoint via NAT Gateway NATGW Elastic IP IAM Role for EKS Cluster IAM Role for EKS Node Groups AWS Identity and Access Management (IAM) EKS Cluster Security group kubectl Client Run kubectl commands by accessing EKS API Server Endpoint via Internet EKS Elastic Network Interfaces
  • 100. StackSimplify © Kalyan Reddy Daida What are we going to learn ? Create AWS VPC using Terraform Modules Create AWS EC2 Bastion Host Define generic variables and Local Values C1 to C4-07 same as previous Section-07
  • 101. StackSimplify © Kalyan Reddy Daida What are we going to learn ? Define EKS Outputs Define EKS Variables Create EKS Security Groups – Placeholder file Define IAM Roles for EKS Cluster and Node Groups Define EKS Node Group in Public Subnet Define EKS Cluster TF Configs EKS Variables autoload during Terraform Apply Define EKS Node Group in Private Subnet
  • 102. StackSimplify © Kalyan Reddy Daida Time it takes to complete this Demo Real-World Demo 3
  • 103. StackSimplify © Kalyan Reddy Daida VPC (our AWS Account) AWS Cloud Availability Zone 1 Availability Zone 2 Private subnet Public subnet NAT gateway Private subnet Public subnet Internet gateway Private NG Security group – Port 22 Bastion EC2 Instance EKS Node Instance EKS Node Instance Bastion Security group Destination: 0.0.0.0/0 Destination: 0.0.0.0/0 EKS Cluster & EKS Node Groups in Public and Private Subnets Admin SSH 22 EKS Node Group in Private Subnets Public NG Security group – Port 22 EKS Node Instance EKS Node Instance Destination: 0.0.0.0/0 EKS Node Group in Public Subnets Elastic IP EKS Elastic network interface EKS Elastic network interface VPC (Amazon EKS) EKS Control Plane Amazon Elastic Container Registry (Amazon ECR) Public Node Group – Access to EKS API Server Endpoint Private Node Group – Access to EKS API Server Endpoint via NAT Gateway NATGW Elastic IP IAM Role for EKS Cluster IAM Role for EKS Node Groups AWS Identity and Access Management (IAM) EKS Cluster Security group kubectl Client Run kubectl commands by accessing EKS API Server Endpoint via Internet EKS Elastic Network Interfaces
  • 104. StackSimplify © Kalyan Reddy Daida • Elastic Network Interfaces (ENI) • When you create the cluster, Amazon EKS creates and manages network interfaces in your account that have Amazon EKS <cluster name> in their description. • These network interfaces allow AWS Fargate and Amazon EC2 instances to communicate with the EKS control plane present in Amazon VPC in Amazon Account (Not our AWS Account). • The Amazon EKS created cluster security group and any additional security groups that you specify when you create your cluster are applied to these network interfaces. • Very Important Note: These Network Interfaces were created in our EKS VPC in our AWS account but attached to EKS Control Plane Master Node instances of Amazon VPC. AWS EKS Resources - High Level Breakdown
  • 105. StackSimplify © Kalyan Reddy Daida EKS Control Plane - Network Interfaces Network Interfaces created by EKS Control Plane in our EKS VPC. These are created and managed by EKS Network Interface description is outlined as Amazon EKS <CLUSTER-NAME>
  • 106. StackSimplify © Kalyan Reddy Daida EKS ENI Our Amazon Account ID Private IP of from our EKS VPC Public Subnet Amazon VPC Account ID where EKS Control Plane is hosted Our EKS VPC ID
  • 107. StackSimplify © Kalyan Reddy Daida AWS Elastic Network Interface Basic Understanding Just to understand AWS Elastic Network Interface concept
  • 108. StackSimplify © Kalyan Reddy Daida AWS EKS Deployment & Service Amazon Virtual Private Cloud (Amazon VPC) Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster
  • 109. StackSimplify © Kalyan Reddy Daida Kubernetes Sample Application default namespace NodePort Service Load Balancer Service (AWS Classic LB) Network Load Balancer Service (AWS NLB) EKS Cluster k8s Pods k8s ReplicaSet k8s Deployment http://<worker-node-publicip>:<node-port> http//<clb-dns-url> http//<nlb-dns-url>
  • 110. StackSimplify © Kalyan Reddy Daida VPC (our AWS Account) AWS Cloud Availability Zone 1 Availability Zone 2 Public subnet Public subnet Internet gateway Kubernetes Deployment & Services - Architecture Public NG Security group EKS Node Instance EKS Node Group in Public Subnets EKS Elastic network interface EKS Elastic network interface VPC (Amazon EKS) EKS Control Plane Access to EKS API Server Endpoint EKS Cluster Security group kubectl Client Run kubectl commands by accessing EKS API Server Endpoint via Internet EKS Elastic Network Interfaces EKS Node Instance Kubernetes Service: LoadBalancer (AWS CLB) Kubernetes Service: LoadBalancer (AWS NLB) Kubernetes Service: NodePort k8s Services Deploy kube-manifests Users Docker Hub Pull Docker Image from Docker Hub
  • 111. StackSimplify © Kalyan Reddy Daida What are we going to learn ? Create k8s Load Balancer Service Manifest (AWS CLB) Create k8s Deployment Manifest Create k8s Load Balancer Service Manifest (AWS NLB) Create k8s Node Port Service Manifest (Not recommended for prod) Kubernetes Manifests using YAML
  • 112. StackSimplify © Kalyan Reddy Daida AWS EKS Deployment & Service using Terraform Provider Amazon Virtual Private Cloud (Amazon VPC) Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster
  • 113. StackSimplify © Kalyan Reddy Daida Kubernetes Sample Application default namespace NodePort Service Load Balancer Service (AWS Classic LB) Network Load Balancer Service (AWS NLB) EKS Cluster k8s Pods k8s ReplicaSet k8s Deployment http://<worker-node-publicip>:<node-port> http//<clb-dns-url> http//<nlb-dns-url> Terraform Kubernetes Provider
  • 114. StackSimplify © Kalyan Reddy Daida Terraform Remote State Datasource The terraform_remote_state data source retrieves the root module output values from project-1 Terraform configuration, using the latest state snapshot from the remote backend. Project-1 Project-2 project-1/terraform.tfstate project-2/terraform.tfstate terraform_remote_state data source Terraform Resources 1. AWS VPC 2. Bastion Host 3. EKS Cluster 4. EKS Node Groups 5. EKS Outputs Terraform Resources 1. Kubernetes Provider 2. Kubernetes Deployment 3. Kubernetes Load Balancer Service (CLB) 4. Kubernetes Load Balancer Service (NLB) 5. Kubernetes NodePort Service EKS Outputs from Project-1 1. cluster_id 2. cluster_endpoint 3. cluster_certificate_authority_data 4. token
  • 115. StackSimplify © Kalyan Reddy Daida What are we going to learn ? Create k8s Load Balancer Service Manifest (AWS CLB) Create k8s Deployment Manifest Create k8s Load Balancer Service Manifest (AWS NLB) Create k8s Node Port Service Manifest (Not recommended for prod) Kubernetes Manifests using Terraform Define AWS and Kubernetes Providers & Datasources Create Remote State Datasource Define Terraform Settings - AWS and Kubernetes Provider Versions C1 C2 C3 C4 C5 C6 C7
  • 116. StackSimplify © Kalyan Reddy Daida Terraform Remote State Storage & State Locking using AWS S3 & DynamoDB VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster Amazon Simple Storage Service (Amazon S3) Amazon DynamoDB Classic Load Balancer Autoscaling AWS IAM Network Load Balancer
  • 117. StackSimplify © Kalyan Reddy Daida Desired & Current Terraform States terraform.tfstate Terraform Configuration Files Real World Resource – EC2 Instance Desired State Current State
  • 118. StackSimplify © Kalyan Reddy Daida Terraform Local State Storage Terraform Remote State Storage Terraform State
  • 119. StackSimplify © Kalyan Reddy Daida What is Terraform Backend ? Backends are responsible for storing state and providing an API for state locking. Terraform State Storage Terraform State Locking AWS S3 Bucket AWS DynamoDB
  • 120. StackSimplify © Kalyan Reddy Daida Local State File Admin1 Desktop terraform.tfstate Admin1 Admin2 Admin3 Remote State File AWS Cloud EC2 Instance Admin1 Desktop terraform.tfstate Admin1 Admin2 Admin3 AWS Cloud EC2 Instance Admin2 Desktop Admin3 Desktop AWS S3 Bucket Multiple Team members cannot update the infrastructure as they don’t have access to State File This means we need store the state file in a shared location. Using Terraform Backend concept we can use AWS S3 as the shared storage for State Files If two team members are running Terraform at the same time, you may run into race conditions as multiple Terraform processes make concurrent updates to the state files, leading to conflicts, data loss, and state file corruption. Implement State Locking
  • 121. StackSimplify © Kalyan Reddy Daida Terraform Remote State File with State Locking Admin1 Desktop terraform.tfstate Admin1 Admin2 Admin3 AWS Cloud EC2 Instance Admin2 Desktop Admin3 Desktop AWS S3 Bucket AWS DynamoDB Not all backends support State Locking. AWS S3 supports State Locking State locking happens automatically on all operations that could write state. If state locking fails, Terraform will not continue. You can disable state locking for most commands with the - lock flag but it is not recommended. If acquiring the lock is taking longer than expected, Terraform will output a status message. If Terraform doesn't output a message, state locking is still occurring if your backend supports it. Terraform has a force-unlock command to manually unlock the state if unlocking failed.
  • 122. StackSimplify © Kalyan Reddy Daida Terraform Remote State File with State Locking Terraform State Storage using Remote Backend AWS S3 Terraform State Locking
  • 123. StackSimplify © Kalyan Reddy Daida EKS Cluster EKS k8s Resources S3 Bucket AWS DynamoDB
  • 124. StackSimplify © Kalyan Reddy Daida Terraform Remote State Datasource The terraform_remote_state data source retrieves the root module output values from project-1 Terraform configuration, using the latest state snapshot from the remote backend. Project-1 Project-2 project-1/terraform.tfstate project-2/terraform.tfstate terraform_remote_state data source Terraform Resources 1. AWS VPC 2. Bastion Host 3. EKS Cluster 4. EKS Node Groups 5. EKS Outputs Terraform Resources 1. Kubernetes Provider 2. Kubernetes Deployment 3. Kubernetes Load Balancer Service (CLB) 4. Kubernetes Load Balancer Service (NLB) 5. Kubernetes NodePort Service EKS Outputs from Project-1 1. cluster_id 2. cluster_endpoint 3. cluster_certificate_authority_data 4. token State Files in project local working directory In Section-11 Demo
  • 125. StackSimplify © Kalyan Reddy Daida Terraform Remote State Datasource Project-1 Project-2 terraform_remote_state data source Terraform Resources 1. AWS VPC 2. Bastion Host 3. EKS Cluster 4. EKS Node Groups 5. EKS Outputs Terraform Resources 1. Kubernetes Provider 2. Kubernetes Deployment 3. Kubernetes Load Balancer Service (CLB) 4. Kubernetes Load Balancer Service (NLB) 5. Kubernetes NodePort Service EKS Outputs from Project-1 1. cluster_id 2. cluster_endpoint 3. cluster_certificate_authority_data 4. token AWS S3 AWS DynamoDB Project-1: terraform.tfstate AWS S3 AWS DynamoDB Project-2: terraform.tfstate
  • 126. StackSimplify © Kalyan Reddy Daida Terraform Remote State Datasource In Project-2, Terraform getting EKS Cluster information from project-1 terraform state file stored in AWS S3 Bucket using Terraform Remote State Datasource.
  • 127. StackSimplify © Kalyan Reddy Daida What are we going to learn ? Update Terraform Remote Backend Information for Project-1: EKS Cluster Update Terraform Remote Backend Information for Project-2: Kubernetes Resources (Deployment & Services) Update Terraform Remote State Datasource from local to remote backend (AWS S3 Bucket) to access Project-1 EKS Cluster Outputs needed for Kubernetes Provider in Project-02 C1 C1 C2
  • 128. StackSimplify © Kalyan Reddy Daida Terraform Backends
  • 129. StackSimplify © Kalyan Reddy Daida Terraform Backends Each Terraform configuration can specify a backend, which defines where and how operations are performed, where state snapshots are stored, etc. Where Backends are Used Backend configuration is only used by Terraform CLI. Terraform Cloud and Terraform Enterprise always use their own state storage when performing Terraform runs, so they ignore any backend block in the configuration. For Terraform Cloud users also it is always recommended to use backend block in Terraform configuration for commands like terraform taint which can be executed only using Terraform CLI
  • 130. StackSimplify © Kalyan Reddy Daida Terraform Backends What Backends Do There are two things backends will be used for 1. Where state is stored 2. Where operations are performed. Terraform uses persistent state data to keep track of the resources it manages. Store State State Locking Operations State Locking is to prevent conflicts and inconsistencies when the operations are being performed "Operations" refers to performing API requests against infrastructure services in order to create, read, update, or destroy resources. Everyone working with a given collection of infrastructure resources must be able to access the same state data (shared state storage). Not every terraform subcommand performs API operations; many of them only operate on state data. Only two backends actually perform operations: local and remote. The remote backend can perform API operations remotely, using Terraform Cloud or Terraform Enterprise. What are Operations ? terraform apply terraform destroy
  • 131. StackSimplify © Kalyan Reddy Daida Terraform Backends Backend Types Enhanced Backends Standard Backends Enhanced backends can both store state and perform operations. There are only two enhanced backends: local and remote Standard backends only store state, and rely on the local backend for performing operations. Example for Remote Backend Performing Operations : Terraform Cloud, Terraform Enterprise Example: AWS S3, Azure RM, Consul, etcd, gcs http and many more
  • 132. StackSimplify © Kalyan Reddy Daida AWS EKS IRSA IAM Roles for Service Accounts VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling IAM IAM Policy AWS STS IAM Role Temporary security credential Kubernetes Job Kubernetes Service Account VERY VERY IMPORTANT CONCEPT FOR AWS EKS Section-13
  • 133. StackSimplify © Kalyan Reddy Daida How to access AWS Services from Workloads running in EKS Cluster? AWS S3 Bucket1 Bucket2 Bucket3 Bucket4 default namespace EKS Cluster k8s Job List S3 Buckets Other AWS Services EKS Cluster AWS Cloud Bucket5 Demo Usecase: Kubernetes Workload (k8s Job with AWS CLI Container) when run with a command “s3 ls”, it should list the S3 Buckets. In short, Kubernetes Workload in EKS Cluster should be able to access AW Services. K8s Job don’t have access to AWS S3 APIs (this Job will fail)
  • 134. StackSimplify © Kalyan Reddy Daida Why do Kubernetes Workloads need to access AWS Services ? EBS CSI Controller + Kubernetes Storage Class, PVC, PV EFS CSI Controller + Kubernetes Storage Class + PVC + PV AWS Load Balancer Controller + Kubernetes Ingress Resources We can create / resize / delete / retain AWS EBS Volumes from Kubernetes Resources in EKS Cluster We can map EFS File system to our Kubernetes Pods in our EKS Cluster. We can create AWS Application, Network Load Balancer with all the settings from our EKS Cluster using k8s Ingress Resources External DNS Controller We can create / update / delete AWS Route53 DNS records using External DNS For all the above, we need to understand the IRSA (IAM Roles for Service Accounts concept) in detail. Same applies if our Application Pods want to access AWS Services from EKS Cluster
  • 135. StackSimplify © Kalyan Reddy Daida Key Items for IRSA Implementation IRSA IAM Roles for Service Accounts EKS Cluster OpenID Connect Provider AWS IAM Identity Provider AWS STS AssumeRoleWi thWebIdentity API operation AWS IAM Temporary Role Credentials Kubernetes Service Accounts Kubernetes ProjectedServiceAcco untToken feature (OIDC JSON Web Token)
  • 136. StackSimplify © Kalyan Reddy Daida EKS Cluster OpenID Connect Provider URL EKS Cluster acts as an OpenID Connect Provider (It can act as External Identity Provider to AWS IAM) EKS Cluster contains the OpenID Connect Provider Issuer URL We can configure this OpenID Connect Issuer URL in AWS IAM Identity Provider
  • 137. StackSimplify © Kalyan Reddy Daida EKS Cluster OpenID Connect Configuration Endpoint https://<EKS Cluster OpenID Connect provider URL>/.well-known/openid-configuration
  • 138. StackSimplify © Kalyan Reddy Daida AWS IAM Identity Provider Add EKS OpenID Connect Provider as Identity Provider in AWS IAM
  • 139. StackSimplify © Kalyan Reddy Daida AWS IAM Identity Provider Add EKS OpenID Connect Provider as Identity Provider in AWS IAM
  • 140. StackSimplify © Kalyan Reddy Daida AWS IAM Roles for Kubernetes Service Accounts IAM IAM Policy AWS STS IAM Role Temporary security credential AWS S3 Bucket1 Bucket2 Bucket3 Bucket4 default namespace EKS Cluster k8s Service Account k8s Job List S3 Buckets Other AWS Services EKS Cluster Annotated with IAM Role AWS Cloud Bucket5 k8s Pod
  • 141. StackSimplify © Kalyan Reddy Daida IRSA - Functional Flow default namespace EKS Cluster k8s Service Account k8s Job AWS Cloud k8s Pod EKS Cluster acting as External IDP to AWS IAM AWS IAM Feature: Federated Identities using OIDC Validate and accept JWT Token from EKS Cluster JWT will be sent to AWS STS 1 IAM Policy AWS STS IAM Role Temporary security credential AssumeRoleWithWebIdenti ty API operation ProjectedServiceAccountToken JWT Token will passed to AWS IAM 2 AWS STS will generate IAM temporary role credentials 3 k8s service account annotated with IAM Role AWS S3 Access AWS Services using Temp creds based on IAM role permissions 4
  • 142. StackSimplify © Kalyan Reddy Daida Kubernetes Service Account Mounted Secret - JWT Token
  • 143. StackSimplify © Kalyan Reddy Daida Kubernetes Service Account Mounted Secret - JWT Token Decoded JWT Token Website: https://jwt.io/
  • 144. StackSimplify © Kalyan Reddy Daida What are we going to learn ? .......................... Add EKS Cluster as OpenID Connect Provider in AWS IAM Service
  • 145. StackSimplify © Kalyan Reddy Daida What are we going to learn ? c1 Update Terraform Remote Backend information – AWS S3 Bucket Key & DynamoDB Table c2 Define Terraform Remote State Datasource for Project-1 EKS Cluster c3-01 c3-02 Define generic variables and local values c4-01 Define AWS Provider and Kubernetes Provider c4-02 Create IAM Policy and IAM Role with Action: AssumeRoleWithWebIdentity c4-03 Create Kubernetes Service Account in EKS Cluster and annotate with IAM Role c4-04 Create Kubernetes Job with Kubernetes Service Account and AWS CLI Container
  • 146. StackSimplify © Kalyan Reddy Daida AWS EKS Storage
  • 147. StackSimplify © Kalyan Reddy Daida EKS Storage In-Tree EBS Provisioner EBS CSI Driver EFS CSI Driver FSx for Luster CSI CSI means Container Storage Interface Latest & Greatest available today & ready for production use As on today, not supported on AWS EKS Fargate (Serverless) Allows EKS Clusters to manage lifecycle of EBS Volumes for persistent storage, EFS File systems & FSx for Luster File systems Supported for k8s 1.14 & later Supported for k8s 1.16 & later Legacy Will be deprecated soon
  • 148. StackSimplify © Kalyan Reddy Daida • EBS provides block level storage volumes for use with EC2 & Container instances. • We can mount these volumes as devices on our EC2 & Container instances. • EBS volumes that are attached to an instance are exposed as storage volumes that persist independently from the life of the EC2 or Container instance. • We can dynamically change the configuration of a volume attached to an instance. • AWS recommends EBS for data that must be quickly accessible and requires long-term persistence. • EBS is well suited to both database-style applications that rely on random reads and writes, and to throughput-intensive applications that perform long, continuous reads and writes. AWS Elastic Block Store - Introduction
  • 149. StackSimplify © Kalyan Reddy Daida AWS EKS Storage Elastic Block Store VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling IAM IAM Policy AWS STS IAM Role Temporary security credential Kubernetes Service Account AWS EBS CSI Driver Install Section-14 Kubernetes Deployment Kubernetes Daemon Set AWS EBS
  • 150. StackSimplify © Kalyan Reddy Daida AWS EBS CSI Driver Why do we need to use EBS CSI Driver in EKS Cluster? AWS EBS Container Storage Interface (CSI) driver allows EKS clusters to manage the lifecycle of EBS volumes for persistent volumes in k8s (Create / Resize / Delete Volumes).
  • 151. StackSimplify © Kalyan Reddy Daida AWS EBS CSI Driver Managing the EBS CSI Driver self- managed add-on Managing the EBS CSI driver as an EKS add-on EBS CSI Driver - Deployment Options Terraform Helm Provider Terraform EKS Add On Resource
  • 152. StackSimplify © Kalyan Reddy Daida AWS EBS CSI Driver IAM IAM Policy AWS STS IAM Role Temporary security credential kube-system namespace EKS Cluster EBS CSI k8s Service Account Other AWS Services EKS Cluster Annotated with IAM Role AWS Cloud EBS CSI Controller Deployment EBS CSI Node Daemon Set AWS EBS Volume Volume Volume Volume Volume Can Create / Update / Delete EBS Volumes
  • 153. StackSimplify © Kalyan Reddy Daida What are we going to learn ? .......................... Add EKS Cluster as OpenID Connect Provider in AWS IAM Service
  • 154. StackSimplify © Kalyan Reddy Daida What are we going to learn ? c1 Update Terraform Remote Backend information – AWS S3 Bucket Key & DynamoDB Table c2 Define Terraform Remote State Datasource for Project-1 EKS Cluster c3-01 c3-02 Define generic variables and local values c4-01 Define Terraform HTTP Datasource to download the EBS CSI IAM Role from Github c4-02 Create IAM Policy and IAM Role with AssumeRoleWithWebIdentity c4-03 Define Helm provider c4-04 Install EBS CSI Driver using Helm Resource c4-05 Create EBS CSI Outputs
  • 155. StackSimplify © Kalyan Reddy Daida AWS EKS Storage Elastic Block Store VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling AWS EBS CSI Driver – Sample App using YAML AWS EBS Section-15 IAM IAM Policy AWS STS IAM Role Temporary security credential Kubernetes Service Account Kubernetes Deployment Kubernetes Daemon Set
  • 156. StackSimplify © Kalyan Reddy Daida User Management Web Application - Architecture User Management Web Application Java Spring Boot Create User List User Delete User MySQL DB schema: webappdb Table: User Default User: admin101
  • 157. StackSimplify © Kalyan Reddy Daida POD ReplicaSet Deployment (mysql) MySQL – ClusterIP Service MySql EKS Cluster Environment Variables Volumes Volume Mounts ClusterIP Service Storage Class Persistent Volume Claim Config Map Deployment AWS Elastic Block Store - EBS EKS Storage EBS CSI Driver YAML EKS Storage with EBS CSI Driver - Demo
  • 158. StackSimplify © Kalyan Reddy Daida POD REST API ReplicaSet Deployment (UserMgmt) UserMgmt - LB Service - CLB POD ReplicaSet Deployment (mysql) MySQL – ClusterIP Service MySql EKS Cluster Environment Variables Volumes Volume Mounts ClusterIP Service Storage Class Persistent Volume Claim Config Map Deployment NodePort Service Deployment Environment Variables AWS Elastic Block Store - EBS YAML LB Services – CLB & NLB UserMgmt - NodePort Service UserMgmt - LB Service - NLB Users http://<workernode-publicip>:<node-port> http://<CLB-DNS-URL> http://<NLB-DNS-URL> EKS Storage with EBS CSI Driver - Demo EKS Storage EBS CSI Driver
  • 159. StackSimplify © Kalyan Reddy Daida EKS Storage with EBS CSI Driver - Demo NodePort Service LB Service - CLB LB Service - NLB http://<worker-node-publicip>:<node-port> http//<nlb-dns-url> http//<clb-dns-url> k8s Pods k8s ReplicaSet k8s Deployment k8s Persistent Volume Claim k8s Persistent Volume k8s Storage Class default namespace EKS Cluster MySQL Deployment k8s Pods k8s ReplicaSet k8s Deployment UserMgmt Deployment MySQL k8s ClusterIP Service Note-1: PVC Claims must exist in the same namespace as the Pod using the claim. The cluster finds the claim in the Pod's namespace and uses it to get the PersistentVolume backing the claim Note-2: A PersistentVolume (PV) is a piece of storage in the cluster that has been provisioned by an administrator or dynamically provisioned using Storage Classes. It is a resource in the cluster just like a node is a cluster resource Note-3: PVC Status changes from Pending to Bound after MySQL Deployment
  • 160. StackSimplify © Kalyan Reddy Daida What are we going to learn ? 1 Create Kubernetes Storage Class 2 Create Kubernetes Persistent Volume Claim 3 Create Kubernetes Config Map which will create the database schema in MySQL DB 4 Create Kubernetes Deployment for MySQL DB 5 Create Cluster IP Service for MySQL DB 6 Create Kubernetes Deployment for UserMgmt WebApp 7 Create Kubernetes Service of type Load Balancer (AWS Classic Load Balancer) 8 Create Kubernetes Service of type Load Balancer (AWS Network Load Balancer) 9 Create Kubernetes Node Port Service Kubernetes Manifests using YAML
  • 161. StackSimplify © Kalyan Reddy Daida AWS EKS Storage Elastic Block Store VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling AWS EBS CSI Driver – Sample App using Terraform AWS EBS Section-16 IAM IAM Policy AWS STS IAM Role Temporary security credential Kubernetes Service Account Kubernetes Deployment Kubernetes Daemon Set
  • 162. StackSimplify © Kalyan Reddy Daida POD ReplicaSet Deployment (mysql) MySQL – ClusterIP Service MySql EKS Cluster Environment Variables Volumes Volume Mounts ClusterIP Service Storage Class Persistent Volume Claim Config Map Deployment AWS Elastic Block Store - EBS EKS Storage EBS CSI Driver EKS Storage with EBS CSI Driver - Demo
  • 163. StackSimplify © Kalyan Reddy Daida POD REST API ReplicaSet Deployment (UserMgmt) UserMgmt - LB Service - CLB POD ReplicaSet Deployment (mysql) MySQL – ClusterIP Service MySql EKS Cluster Environment Variables Volumes Volume Mounts ClusterIP Service Storage Class Persistent Volume Claim Config Map Deployment NodePort Service Deployment Environment Variables AWS Elastic Block Store - EBS LB Services – CLB & NLB UserMgmt - NodePort Service UserMgmt - LB Service - NLB Users http://<workernode-publicip>:<node-port> http://<CLB-DNS-URL> http://<NLB-DNS-URL> EKS Storage with EBS CSI Driver - Demo
  • 164. StackSimplify © Kalyan Reddy Daida EKS Storage with EBS CSI Driver - Demo NodePort Service LB Service - CLB LB Service - NLB http://<worker-node-publicip>:<node-port> http//<nlb-dns-url> http//<clb-dns-url> k8s Pods k8s ReplicaSet k8s Deployment k8s Persistent Volume Claim k8s Persistent Volume k8s Storage Class default namespace EKS Cluster MySQL Deployment k8s Pods k8s ReplicaSet k8s Deployment UserMgmt Deployment MySQL k8s ClusterIP Service Note-1: PVC Claims must exist in the same namespace as the Pod using the claim. The cluster finds the claim in the Pod's namespace and uses it to get the PersistentVolume backing the claim Note-2: A PersistentVolume (PV) is a piece of storage in the cluster that has been provisioned by an administrator or dynamically provisioned using Storage Classes. It is a resource in the cluster just like a node is a cluster resource Note-3: PVC Status changes from Pending to Bound after MySQL Deployment Terraform Kubernetes Provider
  • 165. StackSimplify © Kalyan Reddy Daida What are we going to learn ? c1 Update Terraform Remote Backend information – AWS S3 Bucket Key & DynamoDB Table c2 Define Terraform Remote State Datasource for Project-1 EKS Cluster c3 Define AWS & Kubernetes Terraform Providers c4-01 Create Kubernetes Storage Class c4-02 Create Kubernetes Persistent Volume Claim c4-03 Create Kubernetes Config Map which will create the database schema in MySQL DB c4-04 Create Kubernetes Deployment for MySQL DB c4-05 Create Kubernetes Cluster IP Service for MySQL DB Kubernetes Manifests using Terraform
  • 166. StackSimplify © Kalyan Reddy Daida What are we going to learn ? c4-06 Create Kubernetes Deployment for UserMgmt WebApp c4-07 Create Kubernetes Service of type Load Balancer (AWS Classic Load Balancer) c4-08 Create Kubernetes Service of type Load Balancer (AWS Network Load Balancer) c4-09 Create Kubernetes Node Port Service sql file Create webappdb.sql file which contains the DB Schema creation queries used in k8s configMap c4-03 Kubernetes Manifests using Terraform
  • 167. StackSimplify © Kalyan Reddy Daida AWS EKS Storage Elastic Block Store VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling EBS Volumes – Resize and Retain Features AWS EBS Section-17 IAM IAM Policy AWS STS IAM Role Temporary security credential Kubernetes Service Account Kubernetes Deployment Kubernetes Daemon Set
  • 168. StackSimplify © Kalyan Reddy Daida EBS Volumes - Resize & Retain Features
  • 169. StackSimplify © Kalyan Reddy Daida What are we going to learn ? Update Kubernetes Storage Class arguments to support Volume Expansion (Resizing Volumes) and Reclaim Policy as Retain. Default Reclaim Policy is Delete if not defined when PVC is deleted, volume will be deleted automatically Very Important Note: As part of Volume Resizing, we can only increase the size of EBS Volume. We cannot reduce the Volume size
  • 170. StackSimplify © Kalyan Reddy Daida AWS EKS Storage Elastic Block Store VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling Managing the EBS CSI driver as an EKS add-on AWS EBS Section-18 IAM IAM Policy AWS STS IAM Role Temporary security credential Kubernetes Service Account Kubernetes Deployment Kubernetes Daemon Set
  • 171. StackSimplify © Kalyan Reddy Daida AWS EBS CSI Driver Managing the EBS CSI Driver self- managed add-on using HELM Managing the EBS CSI driver as an EKS add-on EBS CSI Driver - Deployment Options
  • 172. StackSimplify © Kalyan Reddy Daida EBS CSI driver as an EKS add-on EBS CSI Driver as EKS Add-On Currently it is in preview mode Has good number of limitations as on today unlike Self-Managed Add-On approach using HELM (Section-14). In future, this might become the default deployment option for EBS CSI Driver That said we will also automate this using Terraform now Additional Reference: https://docs.aws.amazon.com/eks/latest/userguide/managing-ebs-csi.html
  • 173. StackSimplify © Kalyan Reddy Daida What are we going to learn ? c1 Update Terraform Remote Backend information – AWS S3 Bucket Key & DynamoDB Table c2 Define Terraform Remote State Datasource for Project-1 EKS Cluster c3-01 c3-02 Define generic variables and local values c4-01 Define Terraform HTTP Datasource to download the EBS CSI IAM Role from Github c4-02 Create IAM Policy and IAM Role with AssumeRoleWithWebIdentity c4-03 Install EBS CSI Driver using EKS Add-On option c4-04 Define EBS CSI Driver Outputs
  • 174. StackSimplify © Kalyan Reddy Daida What are we going to learn ? Once the EBS CSI Driver is installed using EKS Add-On option, Deploy our User Management Sample Application and test and ensure everything good from EBS Volumes excluding the limitations with this approach.
  • 175. StackSimplify © Kalyan Reddy Daida AWS EKS Identity & Access Management using AWS IAM VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling Introduction EKS IAM IAM IAM Policy IAM Role Kubernetes Config Map IAM User IAM Group
  • 176. StackSimplify © Kalyan Reddy Daida AWS EKS Identity & Access Management using AWS IAM VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling AWS EKS Authentication and Authorization EKS IAM IAM IAM Policy IAM Role Kubernetes Config Map IAM User IAM Group
  • 177. StackSimplify © Kalyan Reddy Daida EKS Authentication & Authorization Reference: https://docs.aws.amazon.com/eks/latest/userguide/cluster-auth.html Authorization Authentication AWS IAM k8s RBAC
  • 178. StackSimplify © Kalyan Reddy Daida EKS Authentication & Authorization EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM K8s API Server Role Binding Role Cluster Role Binding Cluster Role Authorization Authentication kubectl client aws-iam-authenticator Server Kubernetes Role-based Access Control (RBAC) Verify IAM Identity IAM Identity Kubernetes User Check IAM Identity Token Approve/Decline Allow/Deny Kubernetes User Kubernetes Action IAM Identity Token Kubernetes Action Allow / Deny 1 2 3 IAM Policy IAM Role 4 5 6 7 8
  • 179. StackSimplify © Kalyan Reddy Daida EKS Authentication & Authorization 0 Kubernetes Action: From kubectl cli, run the command like kubectl get pods 1 Kubectl client makes a request to k8s API server passing an access-token with the user’s information 2 k8s API server passes this token to EKS Control Plane’s service: aws-iam-authenticator 3 aws-iam-authenticator calls AWS IAM service and passes the access-token to check if this is valid user and whether that user has permissions to access the EKS cluster 3-1 Authentication Check: AWS IAM makes internal authentication check by using access-token 3-2 Authorization Check: AWS IAM makes internal authorization check by checking IAM policies tied to this user (User with API calls to eks::* resources should be allowed) 4 aws-iam-authenticator checks with aws-auth ConfigMap whether this user has permissions to access this EKS cluster resources
  • 180. StackSimplify © Kalyan Reddy Daida EKS Authentication & Authorization 5 aws-iam-authenticator returns approve/decline response to the k8s API server 6 k8s API Server will pass a user who already was validated with an authentication module to an authorization module to check for its permissions (Role Based Access Control – RBAC) 7 Authorization Module will send the Allow / Deny response to k8s API Server 8 k8s API Server will perform (Allow) the Kubernetes action (Example: kubectl get pods) or Deny based on response from Authorization Module
  • 181. StackSimplify © Kalyan Reddy Daida AWS EKS Identity & Access Management using AWS IAM VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling AWS EKS IAM Usecases EKS IAM IAM IAM Policy IAM Role Kubernetes Config Map IAM User IAM Group
  • 182. StackSimplify © Kalyan Reddy Daida A Developer requesting full access to a namespace (dev) in EKS Cluster and in addition, also asking for read- only access to EKS Cluster 1. Kubernetes Role 2. Kubernetes Role Binding 3. Kubernetes Cluster Role 4. Kubernetes Cluster Role Binding Section-19 Section-20 Section-21 Section-22 Section-23 Section-24 Section-25 IAM IAM Policy IAM Role Kubernetes Config Map IAM User IAM Group Role Binding Role Cluster Role Binding Cluster Role AWS EKS IAM Usecases Provision AWS IAM Admins as EKS Admins Provision AWS IAM Basic User as EKS Admin Automate Section-19,20 with Terraform Provision EKS Admins with AWS IAM Roles & IAM Groups Automate Section-22 with Terraform Provision EKS Read-Only Users with IAM Roles, IAM Groups, Kubernetes Cluster Role and Cluster Role Binding
  • 183. StackSimplify © Kalyan Reddy Daida EKS Authentication & Authorization - Admin User EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM K8s API Server Role Binding Role Cluster Role Binding Cluster Role Authorization Authentication kubectl client aws-iam-authenticator Server Kubernetes Role-based Access Control (RBAC) Verify IAM Identity IAM Identity Kubernetes User Check IAM Identity Token Approve IAM Identity Token Kubernetes Action Allow 1 2 3 IAM Policy IAM Role 4 5 6 ACCESS GRANTED
  • 184. StackSimplify © Kalyan Reddy Daida Provision AWS Admins as EKS Admins kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy Administrator Access IAM User eksadmin1 ACCESS GRANTED
  • 185. StackSimplify © Kalyan Reddy Daida EKS Authentication & Authorization - Basic User EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM K8s API Server Role Binding Role Cluster Role Binding Cluster Role Authorization Authentication kubectl client aws-iam-authenticator Server Kubernetes Role-based Access Control (RBAC) Verify IAM Identity IAM Identity Kubernetes User Check IAM Identity Token Approve IAM Identity Token Kubernetes Action Allow 1 2 3 IAM Policy IAM Role 4 5 6 ACCESS GRANTED EKS Full Access IAM Policy
  • 186. StackSimplify © Kalyan Reddy Daida Provision AWS Basic User as EKS Admin kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy EKS Full Access IAM User eksadmin2 ACCESS GRANTED
  • 187. StackSimplify © Kalyan Reddy Daida Usecase - Multiple EKS Admin Users IAM Users AWS IAM Adding all these users in aws-auth ConfigMap is not a feasible Option from maintenance perspective Complexity increases If we need to add many IAM Users as EKS Admins (20, 30, 40, 50) what should we do ? Option-1: Add those User ARNs in mapUsers section of aws-auth ConfigMap Every time we add a new user, we need to update the Kubernetes aws-auth ConfigMap in EKS Cluster
  • 188. StackSimplify © Kalyan Reddy Daida Usecase - Multiple EKS Admin Users IAM Users AWS IAM IAM Group: eksadmins Can we use IAM Groups to simplify this EKS Admin Access Process ? YES Setting up the whole base for this is complex, many things like below are involved 1. STS Assume Role Trust Policy 2. IAM Policy 3. IAM Role 4. IAM Group Policy 5. IAM Groups After all steps are completed, provisioning EKS Admins becomes so so easy Step-1: Create IAM User Step-2: Associate that User to IAM Group: eksadmins. (User gets access to EKS Cluster)
  • 189. StackSimplify © Kalyan Reddy Daida Provision EKS Admins using IAM Roles & IAM Groups kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy EKS Full Access ACCESS GRANTED IAM Trust Policy STS Assume Role IAM User eksadmin3 IAM Role IAM Group eksadmins IAM Group Policy IAM User eksadmin4 IAM User eksadmin5
  • 190. StackSimplify © Kalyan Reddy Daida Provision EKS ReadOnly Users using IAM Roles & IAM Groups kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy EKS Read- Only Access ACCESS GRANTED IAM Trust Policy STS Assume Role IAM User eksread1 IAM Role IAM Group eksreadon ly IAM Group Policy IAM User eksread2 IAM User eksread3 Kubernetes RBAC
  • 191. StackSimplify © Kalyan Reddy Daida Cluster Role
  • 192. StackSimplify © Kalyan Reddy Daida ClusterRoleBinding & aws-auth ConfigMap How does the aws-auth ConfigMap enforce the Kubernetes RBAC permissions defined in ClusterRole & ClusterRoleBinding? Subject Name in ClusterRoleBinding should match the groups value in aws-auth ConfigMap
  • 193. StackSimplify © Kalyan Reddy Daida Usecase EKS Cluster Read-Only Access EKS Dev Namespace Full Access (All Verbs – Create , Apply, Get, List, Delete Resources) Kubernetes Cluster Role Kubernetes Cluster Role Binding Kubernetes Role Kubernetes Role Binding EKS Developer IAM User A Developer requesting full access to a namespace (dev) in EKS Cluster and in addition, also asking for read-only access to EKS Cluster
  • 194. StackSimplify © Kalyan Reddy Daida Provision EKS Developer Users using IAM Roles & IAM Groups kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy EKS ReadOnly Access ACCESS GRANTED IAM Trust Policy STS Assume Role IAM User eksdeveloper1 IAM Role IAM Group Developer IAM Group Policy IAM User eksdeveloper2 DEV namespace Cluster Role Cluster Role Binding Role Binding Role Kubernetes RBAC
  • 195. StackSimplify © Kalyan Reddy Daida aws-auth ConfigMap EKS Admins with IAM Users, Groups and Roles Section- 22, 23 Section-24 Section-25 Section- 19, 20, 21 EKS ReadOnly Access with IAM Users, Groups, Roles & k8s ClusterRole & ClusterRoleBinding EKS Developer Access with IAM Users, Groups, Roles & k8s ClusterRole, ClusterRoleBinding & Role, RoleBinding IAM Users as EKS Admins
  • 196. StackSimplify © Kalyan Reddy Daida AWS EKS Identity & Access Management using AWS IAM VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling EKS Cluster Creator User EKS IAM IAM IAM Policy Kubernetes Config Map IAM User
  • 197. StackSimplify © Kalyan Reddy Daida AWS EKS Cluster Creator User kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy Administrator Access IAM User kalyandev User: kalyandev AWS CLI aws configure with Security Credentials Terraform to create EKS cluster kalyandev becomes the EKS Cluster Creator User The user with which we create the EKS Cluster is called Cluster_Creator_User This user information is not stored in AWS EKS Cluster aws-auth configmap If we face any issues with `k8s aws-auth configmap` and if we lost access to EKS Cluster we need the `cluster_creator` user to restore the stuff ALWAYS REMEMBER WITH WHICH USER EKS CLUSTER IS CREATED EKS Cluster Creator User
  • 198. StackSimplify © Kalyan Reddy Daida AWS EKS Identity & Access Management using AWS IAM VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling Provision AWS Admins as EKS Admins Section-19 IAM IAM Policy Kubernetes Config Map IAM User
  • 199. StackSimplify © Kalyan Reddy Daida Provision AWS Admins as EKS Admins kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy Administrator Access IAM User eksadmin1 NO ACCESS
  • 200. StackSimplify © Kalyan Reddy Daida EKS Authentication & Authorization - Admin User EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM K8s API Server Role Binding Role Cluster Role Binding Cluster Role Authorization Authentication kubectl client aws-iam-authenticator Server Kubernetes Role-based Access Control (RBAC) Verify IAM Identity IAM Identity Kubernetes User Check IAM Identity Token Decline IAM Identity Token Kubernetes Action Deny 1 2 3 IAM Policy IAM Role 4 5 6 NO ACCESS
  • 201. StackSimplify © Kalyan Reddy Daida AWS EKS - Default ConfigMap
  • 202. StackSimplify © Kalyan Reddy Daida Provision AWS Admins as EKS Admins kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy Administrator Access IAM User eksadmin1 ACCESS GRANTED
  • 203. StackSimplify © Kalyan Reddy Daida EKS Authentication & Authorization - Admin User EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM K8s API Server Role Binding Role Cluster Role Binding Cluster Role Authorization Authentication kubectl client aws-iam-authenticator Server Kubernetes Role-based Access Control (RBAC) Verify IAM Identity IAM Identity Kubernetes User Check IAM Identity Token Approve IAM Identity Token Kubernetes Action Allow 1 2 3 IAM Policy IAM Role 4 5 6 ACCESS GRANTED
  • 204. StackSimplify © Kalyan Reddy Daida AWS EKS - ConfigMap with mapUsers
  • 205. StackSimplify © Kalyan Reddy Daida AWS EKS Identity & Access Management using AWS IAM VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling Provision AWS Basic User as EKS Admin using IAM EKS Full Access Policy Section-20 IAM IAM Policy Kubernetes Config Map IAM User
  • 206. StackSimplify © Kalyan Reddy Daida Provision AWS Basic User as EKS Admin You want to give FULL ACCESS to AWS EKS Cluster but for other AWS Services NO ACCESS Usecase Step-1: Create IAM Basic User Step-2: Create IAM Policy with EKS Full Access and associate to IAM User Step-3: Update user information in EKS Cluster aws-auth ConfigMap
  • 207. StackSimplify © Kalyan Reddy Daida Provision AWS Basic User as EKS Admin kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy EKS Full Access IAM User eksadmin2 ACCESS GRANTED IAM Policy Administrator Access IAM User eksadmin1
  • 208. StackSimplify © Kalyan Reddy Daida EKS Authentication & Authorization - Basic User EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM K8s API Server Role Binding Role Cluster Role Binding Cluster Role Authorization Authentication kubectl client aws-iam-authenticator Server Kubernetes Role-based Access Control (RBAC) Verify IAM Identity IAM Identity Kubernetes User Check IAM Identity Token Approve IAM Identity Token Kubernetes Action Allow 1 2 3 IAM Policy IAM Role 4 5 6 ACCESS GRANTED EKS Full Access IAM Policy
  • 209. StackSimplify © Kalyan Reddy Daida AWS EKS - ConfigMap with mapUsers
  • 210. StackSimplify © Kalyan Reddy Daida AWS IAM Policy - EKS Full Access AWS IAM IAM Policy EKS Full Access Policy IAM User eksadmin2
  • 211. StackSimplify © Kalyan Reddy Daida AWS EKS Identity & Access Management using AWS IAM VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling Section-19 & Section-20 Automate using Terraform Section-21 IAM IAM Policy Kubernetes Config Map IAM User
  • 212. StackSimplify © Kalyan Reddy Daida Provision AWS Basic User as EKS Admin kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy EKS Full Access IAM User eksadmin2 ACCESS GRANTED IAM Policy Administrator Access IAM User eksadmin1
  • 213. StackSimplify © Kalyan Reddy Daida Provision EKS Admins with IAM Users Task-1: Create IAM User with Admin Access Policy Task-2: Create IAM User with EKS Full Access policy Task-3: Define Terraform Kubernetes Provider Task-4: Define aws_caller_identity to get AWS Account ID Task-5: Create locals block to define k8s config map roles and users Task-6: Create Kubernetes Config Map Resource aws- auth Task-7: Update EKS Node Group resource to get created only after Config Map aws-auth is created EKS Admins with IAM Users
  • 214. StackSimplify © Kalyan Reddy Daida What are we going to learn ? c7-01 Create Terraform Kubernetes Provider c7-02 Create Kubernetes ConfigMap Resource c8-01 Create IAM Admin User with Admin Access Policy c8-02 Create IAM Basic User with EKS Full Access Policy Terraform Manifests ……………. ……………. c5-07 Add depends_on Meta-argument to ensure EKS Node Group gets created only after aws-auth ConfigMap is created
  • 215. StackSimplify © Kalyan Reddy Daida AWS EKS Identity & Access Management using AWS IAM VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling Provision EKS Admins with IAM Roles & IAM Groups Section-22 IAM IAM Policy IAM Role Kubernetes Config Map IAM User IAM Group
  • 216. StackSimplify © Kalyan Reddy Daida Usecase - Multiple EKS Admin Users IAM Users AWS IAM Adding all these users in aws-auth ConfigMap is not a feasible Option from maintenance perspective Complexity increases If we need to add many IAM Users as EKS Admins (20, 30, 40, 50) what should we do ? Option-1: Add those User ARNs in mapUsers section of aws-auth ConfigMap Every time we add a new user, we need to update the Kubernetes aws-auth ConfigMap in EKS Cluster
  • 217. StackSimplify © Kalyan Reddy Daida Usecase - Multiple EKS Admin Users IAM Users AWS IAM IAM Group: eksadmins Can we use IAM Groups to simplify this EKS Admin Access Process ? YES Setting up the whole base for this is complex, many things like below are involved 1. STS Assume Role Trust Policy 2. IAM Policy 3. IAM Role 4. IAM Group Policy 5. IAM Groups After all steps are completed, provisioning EKS Admins becomes so so easy Step-1: Create IAM User Step-2: Associate that User to IAM Group: eksadmins. (User gets access to EKS Cluster)
  • 218. StackSimplify © Kalyan Reddy Daida Provision EKS Admins using IAM Roles & IAM Groups kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy EKS Full Access ACCESS GRANTED IAM Trust Policy STS Assume Role IAM User eksadmin3 IAM Role IAM Group eksadmins IAM Group Policy IAM User eksadmin4 IAM User eksadmin5
  • 219. StackSimplify © Kalyan Reddy Daida AWS EKS - ConfigMap with mapRoles
  • 220. StackSimplify © Kalyan Reddy Daida Section-22 Implement with manual steps Section-23 Automate using Terraform Provision EKS Admins using IAM Roles & IAM Groups
  • 221. StackSimplify © Kalyan Reddy Daida AWS EKS Identity & Access Management using AWS IAM VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling Provision EKS Admins with IAM Roles & IAM Groups Automate with Terraform Section-23 IAM IAM Policy IAM Role Kubernetes Config Map IAM User IAM Group
  • 222. StackSimplify © Kalyan Reddy Daida Provision EKS Admins using IAM Roles & IAM Groups kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy EKS Full Access ACCESS GRANTED IAM Trust Policy STS Assume Role IAM User eksadmin1 IAM Role IAM Group eksadmins IAM Group Policy IAM User eksadmin2 IAM User eksadmin3
  • 223. StackSimplify © Kalyan Reddy Daida Provision EKS Admins using IAM Roles & IAM Groups Task-1: Define Terraform Kubernetes Provider Task-2: Create locals block to define k8s config map roles and users Task-3: Define aws_caller_identity to get AWS Account ID Task-4: Create IAM Role with STS Assume Role Policy and EKS full access policy Task-5: Create IAM Group Policy and IAM Group Task-6: Create IAM users and associate to IAM Group EKS Admins with IAM Roles & IAM Groups
  • 224. StackSimplify © Kalyan Reddy Daida What are we going to learn ? c7-01 Create Terraform Kubernetes Provider c7-02 Create Kubernetes ConfigMap Resource + UPDATE with mapRoles changes c8-01 Create IAM Admin User with Admin Access Policy c8-02 Create IAM Basic User with EKS Full Access Policy c9-01 Create IAM Role with STS Assume Role Policy and EKS Full Access Policy Terraform Manifests ……………. c9-02 Create IAM Group and IAM Users and associate IAM Users to IAM Group
  • 225. StackSimplify © Kalyan Reddy Daida Sample Output of aws-auth ConfigMap after creating EKS Cluster using Terraform
  • 226. StackSimplify © Kalyan Reddy Daida AWS EKS Identity & Access Management using AWS IAM VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling Kubernetes RBAC Fundamentals Section-24 IAM IAM Policy IAM Role Kubernetes Config Map IAM User IAM Group Kubernetes Cluster Role Kubernetes Cluster Role Binding
  • 227. StackSimplify © Kalyan Reddy Daida Kubernetes RBAC Subjects API Groups Verbs Users or processes that need access to the Kubernetes API The k8s API objects that we grant access to List of actions that can be taken on a resource Kind: Group, User Kind: Service Account core extensions apps batch Create List Watch Delete Patch get Replace Read Kubernetes RBAC - Fundamentals Pods Deployments Services StatefulSets Resources Kubernetes API Reference: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/ API Groups Reference: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.22/#-strong-api- groups-strong-
  • 228. StackSimplify © Kalyan Reddy Daida Kubernetes RBAC A ClusterRole can be used to grant the same permissions as a Role, but because they are cluster-scoped, access will be granted across cluster A Cluster Role Binding is used to tie the Cluster Role and Subject together A Role can only be used to grant access to resources within a single namespace. A Role Binding is used to tie the Role and Subject together Section-24 Demo Section-25 Demo
  • 229. StackSimplify © Kalyan Reddy Daida Kubernetes RBAC Role Create (Verb) Pod (Resource) Namespace: DEV Role Binding User / Group (Subject) Role Create (Verb) Pod (Resource) Namespace: QA Role Binding User / Group (Subject) Cluster Role Create (Verb) Cluster Role Binding User / Group (Subject) Kubernetes Cluster RBAC
  • 230. StackSimplify © Kalyan Reddy Daida Cluster Role
  • 231. StackSimplify © Kalyan Reddy Daida Cluster Role Binding
  • 232. StackSimplify © Kalyan Reddy Daida AWS EKS Identity & Access Management using AWS IAM VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling Provision EKS Read-Only Users with IAM Roles & IAM Groups Automate with Terraform Section-24 IAM IAM Policy IAM Role Kubernetes Config Map IAM User IAM Group Kubernetes Cluster Role Kubernetes Cluster Role Binding
  • 233. StackSimplify © Kalyan Reddy Daida Provision EKS ReadOnly Users using IAM Roles & IAM Groups kube-system namespace EKS Cluster k8s ConfigMap aws-auth AWS Cloud AWS IAM IAM Policy EKS Read- Only Access ACCESS GRANTED IAM Trust Policy STS Assume Role IAM User eksread1 IAM Role IAM Group eksreadon ly IAM Group Policy IAM User eksread2 IAM User eksread3 Kubernetes RBAC
  • 234. StackSimplify © Kalyan Reddy Daida aws-auth ConfigMap
  • 235. StackSimplify © Kalyan Reddy Daida Cluster Role
  • 236. StackSimplify © Kalyan Reddy Daida Cluster Role Binding
  • 237. StackSimplify © Kalyan Reddy Daida ClusterRoleBinding & aws-auth ConfigMap How does the aws-auth ConfigMap enforce the Kubernetes RBAC permissions defined in ClusterRole & ClusterRoleBinding? Subject Name in ClusterRoleBinding should match the groups value in aws-auth ConfigMap
  • 238. StackSimplify © Kalyan Reddy Daida Provision EKS ReadOnly Users using IAM Roles, IAM Groups with Kubernetes RBAC (Cluster Role & Cluster Role Binding) Task-1: Define Terraform Kubernetes Provider Task-2: Create locals block to define k8s config map roles and users Task-3: Define aws_caller_identity to get AWS Account ID Task-4: Create IAM Role with STS Assume Role Policy and EKS Read-Only access policy Task-5: Create IAM Group Policy and IAM Group (eksreadonly) Task-6: Create IAM users and associate to IAM Group (eksreaduser1) EKS Read-Only Users with IAM Roles & IAM Groups Task-7: Create Cluster Role and Cluster Role Binding k8s RBAC Resources Task-8: update aws- auth ConfigMap
  • 239. StackSimplify © Kalyan Reddy Daida What are we going to learn ? c7-01 Create Terraform Kubernetes Provider c7-02 Create Kubernetes ConfigMap Resource + UPDATE with mapRoles changes c8 & c9 Create IAM Admin User with mapUsers in aws-auth Create EKS Admins with IAM Roles & mapRoles c10-01 Create IAM Role with STS Assume Role Policy and EKS READONLY Access Policy c10-02 Create IAM Group and IAM Users and associate IAM Users to IAM Group Terraform Manifests ……………. c10-03 Create Kubernetes RBAC ClusterRole & ClusterRoleBinding Resources
  • 240. StackSimplify © Kalyan Reddy Daida AWS EKS Identity & Access Management using AWS IAM VPC Internet gateway NAT gateway Elastic IP address Route table Public Subnet Private Subnet EC2 VM EKS Cluster AWS S3 DynamoDB Autoscaling Provision EKS Developer Users with IAM Roles & IAM Groups Automate with Terraform Section-25 IAM IAM Policy IAM Role Kubernetes Config Map IAM User IAM Group Kubernetes Cluster Role Kubernetes Cluster Role Binding Kubernetes Role Kubernetes Role Binding
  • 241. StackSimplify © Kalyan Reddy Daida Usecase EKS Cluster Read-Only Access EKS Dev Namespace Full Access (All Verbs – Create , Apply, Get, List, Delete Resources) Kubernetes Cluster Role Kubernetes Cluster Role Binding Kubernetes Role Kubernetes Role Binding EKS Developer IAM User A Developer requesting full access to a namespace (dev) in EKS Cluster and in addition, also asking for read-only access to EKS Cluster