Skip to content

Commit c90ada0

Browse files
ranjeet-pivotchainranjeet-pivotchain
committed
aws ingress controller
1 parent 230e67f commit c90ada0

40 files changed

+2607
-323
lines changed

‎Jenkinsfile

Whitespace-only changes.

‎aws-devops/aws-eks/terra-eks/aws-load-balancer-controller-service-account.yaml

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
labels:
5+
app.kubernetes.io/component: controller
6+
app.kubernetes.io/name: aws-load-balancer-controller
7+
name: aws-load-balancer-controller
8+
namespace: kube-system
9+
annotations:
10+
eks.amazonaws.com/role-arn: arn:aws:iam::888887582627:role/AmazonEKSLoadBalancerControllerRole

‎aws-devops/aws-eks/terra-eks/deployment.yaml

+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
---
2+
apiVersion: v1
3+
kind: Namespace
4+
metadata:
5+
name: game-2048
6+
---
7+
apiVersion: apps/v1
8+
kind: Deployment
9+
metadata:
10+
namespace: game-2048
11+
name: deployment-2048
12+
spec:
13+
selector:
14+
matchLabels:
15+
app.kubernetes.io/name: app-2048
16+
replicas: 2
17+
template:
18+
metadata:
19+
labels:
20+
app.kubernetes.io/name: app-2048
21+
spec:
22+
containers:
23+
- image: public.ecr.aws/l6m2t8p7/docker-2048:latest
24+
imagePullPolicy: Always
25+
name: app-2048
26+
ports:
27+
- containerPort: 80
28+
---
29+
apiVersion: v1
30+
kind: Service
31+
metadata:
32+
namespace: game-2048
33+
name: service-2048
34+
spec:
35+
ports:
36+
- port: 80
37+
targetPort: 80
38+
protocol: TCP
39+
type: NodePort
40+
selector:
41+
app.kubernetes.io/name: app-2048

‎aws-devops/aws-eks/terra-eks/doc

-7
This file was deleted.

‎aws-devops/aws-eks/terra-eks/eks.tf

+6-1
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,11 @@ resource "aws_iam_role_policy_attachment" "AmazonEKSClusterPolicy" {
2424
}
2525

2626

27+
resource "aws_iam_role_policy_attachment" "AmazonEKSVPCResourceController" {
28+
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSVPCResourceController"
29+
role = aws_iam_role.eks_cluster-terra.name
30+
}
31+
2732
resource "aws_iam_role_policy_attachment" "AmazonEKSServicePolicy" {
2833
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
2934
role = aws_iam_role.eks_cluster-terra.name
@@ -92,7 +97,7 @@ resource "aws_eks_node_group" "node" {
9297

9398
scaling_config {
9499
desired_size = 1
95-
max_size = 1
100+
max_size = 3
96101
min_size = 1
97102
}
98103

‎aws-devops/aws-eks/terra-eks/iam_policy.json

+241
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,241 @@
1+
{
2+
"Version": "2012-10-17",
3+
"Statement": [
4+
{
5+
"Effect": "Allow",
6+
"Action": [
7+
"iam:CreateServiceLinkedRole"
8+
],
9+
"Resource": "*",
10+
"Condition": {
11+
"StringEquals": {
12+
"iam:AWSServiceName": "elasticloadbalancing.amazonaws.com"
13+
}
14+
}
15+
},
16+
{
17+
"Effect": "Allow",
18+
"Action": [
19+
"ec2:DescribeAccountAttributes",
20+
"ec2:DescribeAddresses",
21+
"ec2:DescribeAvailabilityZones",
22+
"ec2:DescribeInternetGateways",
23+
"ec2:DescribeVpcs",
24+
"ec2:DescribeVpcPeeringConnections",
25+
"ec2:DescribeSubnets",
26+
"ec2:DescribeSecurityGroups",
27+
"ec2:DescribeInstances",
28+
"ec2:DescribeNetworkInterfaces",
29+
"ec2:DescribeTags",
30+
"ec2:GetCoipPoolUsage",
31+
"ec2:DescribeCoipPools",
32+
"elasticloadbalancing:DescribeLoadBalancers",
33+
"elasticloadbalancing:DescribeLoadBalancerAttributes",
34+
"elasticloadbalancing:DescribeListeners",
35+
"elasticloadbalancing:DescribeListenerCertificates",
36+
"elasticloadbalancing:DescribeSSLPolicies",
37+
"elasticloadbalancing:DescribeRules",
38+
"elasticloadbalancing:DescribeTargetGroups",
39+
"elasticloadbalancing:DescribeTargetGroupAttributes",
40+
"elasticloadbalancing:DescribeTargetHealth",
41+
"elasticloadbalancing:DescribeTags"
42+
],
43+
"Resource": "*"
44+
},
45+
{
46+
"Effect": "Allow",
47+
"Action": [
48+
"cognito-idp:DescribeUserPoolClient",
49+
"acm:ListCertificates",
50+
"acm:DescribeCertificate",
51+
"iam:ListServerCertificates",
52+
"iam:GetServerCertificate",
53+
"waf-regional:GetWebACL",
54+
"waf-regional:GetWebACLForResource",
55+
"waf-regional:AssociateWebACL",
56+
"waf-regional:DisassociateWebACL",
57+
"wafv2:GetWebACL",
58+
"wafv2:GetWebACLForResource",
59+
"wafv2:AssociateWebACL",
60+
"wafv2:DisassociateWebACL",
61+
"shield:GetSubscriptionState",
62+
"shield:DescribeProtection",
63+
"shield:CreateProtection",
64+
"shield:DeleteProtection"
65+
],
66+
"Resource": "*"
67+
},
68+
{
69+
"Effect": "Allow",
70+
"Action": [
71+
"ec2:AuthorizeSecurityGroupIngress",
72+
"ec2:RevokeSecurityGroupIngress"
73+
],
74+
"Resource": "*"
75+
},
76+
{
77+
"Effect": "Allow",
78+
"Action": [
79+
"ec2:CreateSecurityGroup"
80+
],
81+
"Resource": "*"
82+
},
83+
{
84+
"Effect": "Allow",
85+
"Action": [
86+
"ec2:CreateTags"
87+
],
88+
"Resource": "arn:aws:ec2:*:*:security-group/*",
89+
"Condition": {
90+
"StringEquals": {
91+
"ec2:CreateAction": "CreateSecurityGroup"
92+
},
93+
"Null": {
94+
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
95+
}
96+
}
97+
},
98+
{
99+
"Effect": "Allow",
100+
"Action": [
101+
"ec2:CreateTags",
102+
"ec2:DeleteTags"
103+
],
104+
"Resource": "arn:aws:ec2:*:*:security-group/*",
105+
"Condition": {
106+
"Null": {
107+
"aws:RequestTag/elbv2.k8s.aws/cluster": "true",
108+
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
109+
}
110+
}
111+
},
112+
{
113+
"Effect": "Allow",
114+
"Action": [
115+
"ec2:AuthorizeSecurityGroupIngress",
116+
"ec2:RevokeSecurityGroupIngress",
117+
"ec2:DeleteSecurityGroup"
118+
],
119+
"Resource": "*",
120+
"Condition": {
121+
"Null": {
122+
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
123+
}
124+
}
125+
},
126+
{
127+
"Effect": "Allow",
128+
"Action": [
129+
"elasticloadbalancing:CreateLoadBalancer",
130+
"elasticloadbalancing:CreateTargetGroup"
131+
],
132+
"Resource": "*",
133+
"Condition": {
134+
"Null": {
135+
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
136+
}
137+
}
138+
},
139+
{
140+
"Effect": "Allow",
141+
"Action": [
142+
"elasticloadbalancing:CreateListener",
143+
"elasticloadbalancing:DeleteListener",
144+
"elasticloadbalancing:CreateRule",
145+
"elasticloadbalancing:DeleteRule"
146+
],
147+
"Resource": "*"
148+
},
149+
{
150+
"Effect": "Allow",
151+
"Action": [
152+
"elasticloadbalancing:AddTags",
153+
"elasticloadbalancing:RemoveTags"
154+
],
155+
"Resource": [
156+
"arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
157+
"arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
158+
"arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
159+
],
160+
"Condition": {
161+
"Null": {
162+
"aws:RequestTag/elbv2.k8s.aws/cluster": "true",
163+
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
164+
}
165+
}
166+
},
167+
{
168+
"Effect": "Allow",
169+
"Action": [
170+
"elasticloadbalancing:AddTags",
171+
"elasticloadbalancing:RemoveTags"
172+
],
173+
"Resource": [
174+
"arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*",
175+
"arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*",
176+
"arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
177+
"arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*"
178+
]
179+
},
180+
{
181+
"Effect": "Allow",
182+
"Action": [
183+
"elasticloadbalancing:ModifyLoadBalancerAttributes",
184+
"elasticloadbalancing:SetIpAddressType",
185+
"elasticloadbalancing:SetSecurityGroups",
186+
"elasticloadbalancing:SetSubnets",
187+
"elasticloadbalancing:DeleteLoadBalancer",
188+
"elasticloadbalancing:ModifyTargetGroup",
189+
"elasticloadbalancing:ModifyTargetGroupAttributes",
190+
"elasticloadbalancing:DeleteTargetGroup"
191+
],
192+
"Resource": "*",
193+
"Condition": {
194+
"Null": {
195+
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
196+
}
197+
}
198+
},
199+
{
200+
"Effect": "Allow",
201+
"Action": [
202+
"elasticloadbalancing:AddTags"
203+
],
204+
"Resource": [
205+
"arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
206+
"arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
207+
"arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
208+
],
209+
"Condition": {
210+
"StringEquals": {
211+
"elasticloadbalancing:CreateAction": [
212+
"CreateTargetGroup",
213+
"CreateLoadBalancer"
214+
]
215+
},
216+
"Null": {
217+
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
218+
}
219+
}
220+
},
221+
{
222+
"Effect": "Allow",
223+
"Action": [
224+
"elasticloadbalancing:RegisterTargets",
225+
"elasticloadbalancing:DeregisterTargets"
226+
],
227+
"Resource": "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"
228+
},
229+
{
230+
"Effect": "Allow",
231+
"Action": [
232+
"elasticloadbalancing:SetWebAcl",
233+
"elasticloadbalancing:ModifyListener",
234+
"elasticloadbalancing:AddListenerCertificates",
235+
"elasticloadbalancing:RemoveListenerCertificates",
236+
"elasticloadbalancing:ModifyRule"
237+
],
238+
"Resource": "*"
239+
}
240+
]
241+
}

‎aws-devops/aws-eks/terra-eks/ingress-object.yaml

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: Ingress
3+
metadata:
4+
namespace: game-2048
5+
name: ingress-2048
6+
annotations:
7+
kubernetes.io/ingress.class: "alb" # Specify the desired Ingress class here
8+
alb.ingress.kubernetes.io/group.name: nginx-group
9+
alb.ingress.kubernetes.io/group.order: "10"
10+
alb.ingress.kubernetes.io/healthcheck-path: /
11+
alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}]'
12+
alb.ingress.kubernetes.io/scheme: internet-facing
13+
alb.ingress.kubernetes.io/target-type: ip
14+
spec:
15+
ingressClassName: alb
16+
rules:
17+
- http:
18+
paths:
19+
- path: /
20+
pathType: Prefix
21+
backend:
22+
service:
23+
name: service-2048
24+
port:
25+
number: 80
26+
27+
---
28+
apiVersion: networking.k8s.io/v1
29+
kind: Ingress
30+
metadata:
31+
namespace: default
32+
name: nginx-app
33+
annotations:
34+
kubernetes.io/ingress.class: "alb" # Specify the desired Ingress class here
35+
alb.ingress.kubernetes.io/group.name: nginx-group
36+
alb.ingress.kubernetes.io/group.order: "10"
37+
alb.ingress.kubernetes.io/healthcheck-path: /
38+
alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}]'
39+
alb.ingress.kubernetes.io/scheme: internet-facing
40+
alb.ingress.kubernetes.io/target-type: ip
41+
spec:
42+
ingressClassName: alb
43+
rules:
44+
- http:
45+
paths:
46+
- path: /
47+
pathType: Prefix
48+
backend:
49+
service:
50+
name: nginx
51+
port:
52+
number: 80
53+

‎aws-devops/aws-eks/terra-eks/ingress.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
apiVersion: networking.k8s.io/v1
2+
kind: Ingress
3+
metadata:
4+
namespace: game-2048
5+
name: ingress-2048
6+
annotations:
7+
alb.ingress.kubernetes.io/scheme: internet-facing
8+
alb.ingress.kubernetes.io/target-type: ip
9+
spec:
10+
ingressClassName: alb
11+
rules:
12+
- http:
13+
paths:
14+
- path: /
15+
pathType: Prefix
16+
backend:
17+
service:
18+
name: service-2048
19+
port:
20+
number: 80

0 commit comments

Comments
 (0)