eks-cluster

Creates an EKS control plane with IAM roles, add-ons, OIDC, secrets encryption, and access entries.

Provisions an EKS cluster with a dedicated cluster IAM role, control plane logging to CloudWatch, optional KMS secrets encryption, private-only API access, core add-ons (VPC CNI, CoreDNS, kube-proxy, EBS CSI driver), and access entries with policy associations using the EKS API authentication mode. OIDC issuer URL is output for IRSA via the identity/iam-identity-provider module.

Usage

module "eks" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/compute/eks-cluster/aws"
  version = "0.1.0"

  cluster_name                   = "prod-eks"
  kubernetes_version             = "1.30"
  subnet_ids                     = module.vpc.private_subnet_id_list
  secrets_encryption_kms_key_arn = module.kms.key_arn
}

Requirements

Name	Version
terraform	~> 1.5
aws	~> 6.50

Providers

Name	Version
aws	6.50.0

Resources

Name	Type
aws_cloudwatch_log_group.cluster	resource
aws_eks_access_entry.this	resource
aws_eks_access_policy_association.this	resource
aws_eks_addon.this	resource
aws_eks_cluster.this	resource
aws_iam_role.cluster	resource
aws_iam_role_policy_attachment.cluster	resource

Inputs

Name	Description	Type	Default	Required
cluster_name	EKS cluster name	`string`	n/a	yes
subnet_ids	Subnet IDs for the cluster control plane ENIs	`list(string)`	n/a	yes
access_entries	Map of IAM principal ARNs to cluster access entry configurations	map(object({ principal_arn = string type = optional(string, "STANDARD") kubernetes_groups = optional(list(string), []) policy_associations = optional(list(object({ policy_arn = string access_scope = optional(string, "cluster") namespaces = optional(list(string), []) })), []) }))	`{}`	no
cluster_addons	Map of EKS add-ons to install	map(object({ version = optional(string, null) resolve_conflicts = optional(string, "OVERWRITE") service_account_role_arn = optional(string, null) }))	{ "aws-ebs-csi-driver": {}, "coredns": {}, "kube-proxy": {}, "vpc-cni": {}}	no
cluster_log_types	Control plane log types to enable	`list(string)`	[ "api", "audit", "authenticator", "controllerManager", "scheduler"]	no
endpoint_private_access	Enable private API server endpoint	`bool`	`true`	no
endpoint_public_access	Enable public API server endpoint	`bool`	`false`	no
kubernetes_version	Kubernetes version	`string`	`"1.30"`	no
public_access_cidrs	CIDR blocks for public API access (requires endpoint_public_access = true)	`list(string)`	`[]`	no
secrets_encryption_kms_key_arn	KMS key ARN for encrypting Kubernetes secrets	`string`	`null`	no
security_group_ids	Additional security group IDs for the cluster	`list(string)`	`[]`	no
tags	Resource tags to apply to all resources	`map(string)`	`{}`	no

Outputs

Name	Description
addon_ids	Map of add-on name to add-on ID
arn	EKS cluster ARN
certificate_authority	Base64-encoded cluster CA certificate
cluster_role_arn	ARN of the cluster IAM role
cluster_security_group_id	Cluster security group ID created by EKS
endpoint	Kubernetes API server endpoint
id	EKS cluster name (ID)
oidc_issuer_url	OIDC issuer URL for IRSA (without https://)