# eks-cluster

Creates an EKS control plane with IAM roles, add-ons, OIDC, secrets encryption, and access entries.

Provisions an EKS cluster with a dedicated cluster IAM role, control plane logging to CloudWatch, optional KMS secrets encryption, private-only API access, core add-ons (VPC CNI, CoreDNS, kube-proxy, EBS CSI driver), and access entries with policy associations using the EKS API authentication mode. OIDC issuer URL is output for IRSA via the `identity/iam-identity-provider` module.

## Usage

```hcl
module "eks" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/compute/eks-cluster/aws"
  version = "0.1.0"

  cluster_name                   = "prod-eks"
  kubernetes_version             = "1.30"
  subnet_ids                     = module.vpc.private_subnet_id_list
  secrets_encryption_kms_key_arn = module.kms.key_arn
}
```

<!-- BEGIN_TF_DOCS — DO NOT EDIT BELOW THIS LINE -->
## Requirements

| Name | Version |
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement_terraform) | ~> 1.5 |
| <a name="requirement_aws"></a> [aws](#requirement_aws) | ~> 6.50 |

## Providers

| Name | Version |
| ---- | ------- |
| <a name="provider_aws"></a> [aws](#provider_aws) | 6.50.0 |

## Resources

| Name | Type |
| ---- | ---- |
| [aws_cloudwatch_log_group.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
| [aws_eks_access_entry.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_access_entry) | resource |
| [aws_eks_access_policy_association.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_access_policy_association) | resource |
| [aws_eks_addon.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_addon) | resource |
| [aws_eks_cluster.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_cluster) | resource |
| [aws_iam_role.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
| [aws_iam_role_policy_attachment.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |

## Inputs

| Name | Description | Type | Default | Required |
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_cluster_name"></a> [cluster_name](#input_cluster_name) | EKS cluster name | `string` | n/a | yes |
| <a name="input_subnet_ids"></a> [subnet_ids](#input_subnet_ids) | Subnet IDs for the cluster control plane ENIs | `list(string)` | n/a | yes |
| <a name="input_access_entries"></a> [access_entries](#input_access_entries) | Map of IAM principal ARNs to cluster access entry configurations | <pre>map(object({<br/>    principal_arn     = string<br/>    type              = optional(string, "STANDARD")<br/>    kubernetes_groups = optional(list(string), [])<br/>    policy_associations = optional(list(object({<br/>      policy_arn   = string<br/>      access_scope = optional(string, "cluster")<br/>      namespaces   = optional(list(string), [])<br/>    })), [])<br/>  }))</pre> | `{}` | no |
| <a name="input_cluster_addons"></a> [cluster_addons](#input_cluster_addons) | Map of EKS add-ons to install | <pre>map(object({<br/>    version                  = optional(string, null)<br/>    resolve_conflicts        = optional(string, "OVERWRITE")<br/>    service_account_role_arn = optional(string, null)<br/>  }))</pre> | <pre>{<br/>  "aws-ebs-csi-driver": {},<br/>  "coredns": {},<br/>  "kube-proxy": {},<br/>  "vpc-cni": {}<br/>}</pre> | no |
| <a name="input_cluster_log_types"></a> [cluster_log_types](#input_cluster_log_types) | Control plane log types to enable | `list(string)` | <pre>[<br/>  "api",<br/>  "audit",<br/>  "authenticator",<br/>  "controllerManager",<br/>  "scheduler"<br/>]</pre> | no |
| <a name="input_endpoint_private_access"></a> [endpoint_private_access](#input_endpoint_private_access) | Enable private API server endpoint | `bool` | `true` | no |
| <a name="input_endpoint_public_access"></a> [endpoint_public_access](#input_endpoint_public_access) | Enable public API server endpoint | `bool` | `false` | no |
| <a name="input_kubernetes_version"></a> [kubernetes_version](#input_kubernetes_version) | Kubernetes version | `string` | `"1.30"` | no |
| <a name="input_public_access_cidrs"></a> [public_access_cidrs](#input_public_access_cidrs) | CIDR blocks for public API access (requires endpoint_public_access = true) | `list(string)` | `[]` | no |
| <a name="input_secrets_encryption_kms_key_arn"></a> [secrets_encryption_kms_key_arn](#input_secrets_encryption_kms_key_arn) | KMS key ARN for encrypting Kubernetes secrets | `string` | `null` | no |
| <a name="input_security_group_ids"></a> [security_group_ids](#input_security_group_ids) | Additional security group IDs for the cluster | `list(string)` | `[]` | no |
| <a name="input_tags"></a> [tags](#input_tags) | Resource tags to apply to all resources | `map(string)` | `{}` | no |

## Outputs

| Name | Description |
| ---- | ----------- |
| <a name="output_addon_ids"></a> [addon_ids](#output_addon_ids) | Map of add-on name to add-on ID |
| <a name="output_arn"></a> [arn](#output_arn) | EKS cluster ARN |
| <a name="output_certificate_authority"></a> [certificate_authority](#output_certificate_authority) | Base64-encoded cluster CA certificate |
| <a name="output_cluster_role_arn"></a> [cluster_role_arn](#output_cluster_role_arn) | ARN of the cluster IAM role |
| <a name="output_cluster_security_group_id"></a> [cluster_security_group_id](#output_cluster_security_group_id) | Cluster security group ID created by EKS |
| <a name="output_endpoint"></a> [endpoint](#output_endpoint) | Kubernetes API server endpoint |
| <a name="output_id"></a> [id](#output_id) | EKS cluster name (ID) |
| <a name="output_oidc_issuer_url"></a> [oidc_issuer_url](#output_oidc_issuer_url) | OIDC issuer URL for IRSA (without https://) |
<!-- END_TF_DOCS — DO NOT EDIT ABOVE THIS LINE -->