Home

Awesome

Amazon EKS Blueprints Addons

Terraform module to deploy Kubernetes addons on Amazon EKS clusters.

Usage

module "eks_blueprints_addons" {
  source = "aws-ia/eks-blueprints-addons/aws"
  version = "~> 1.0" #ensure to update this to the latest/desired version

  cluster_name      = module.eks.cluster_name
  cluster_endpoint  = module.eks.cluster_endpoint
  cluster_version   = module.eks.cluster_version
  oidc_provider_arn = module.eks.oidc_provider_arn

  eks_addons = {
    aws-ebs-csi-driver = {
      most_recent = true
    }
    coredns = {
      most_recent = true
    }
    vpc-cni = {
      most_recent = true
    }
    kube-proxy = {
      most_recent = true
    }
  }

  enable_aws_load_balancer_controller    = true
  enable_cluster_proportional_autoscaler = true
  enable_karpenter                       = true
  enable_kube_prometheus_stack           = true
  enable_metrics_server                  = true
  enable_external_dns                    = true
  enable_cert_manager                    = true
  cert_manager_route53_hosted_zone_arns  = ["arn:aws:route53:::hostedzone/XXXXXXXXXXXXX"]

  tags = {
    Environment = "dev"
  }
}

module "eks" {
  source = "terraform-aws-modules/eks/aws"

  cluster_name    = "my-cluster"
  cluster_version = "1.29"

  ... truncated for brevity
}

Support & Feedback

[!IMPORTANT] EKS Blueprints for Terraform is maintained by AWS Solution Architects. It is not part of an AWS service and support is provided as a best-effort by the EKS Blueprints community. To provide feedback, please use the issues templates provided. If you are interested in contributing to EKS Blueprints, see the Contribution guide.

<!-- BEGIN_TF_DOCS -->

Requirements

NameVersion
<a name="requirement_terraform"></a> terraform>= 1.0
<a name="requirement_aws"></a> aws>= 5.0
<a name="requirement_helm"></a> helm>= 2.9
<a name="requirement_kubernetes"></a> kubernetes>= 2.20
<a name="requirement_random"></a> random>= 3.6
<a name="requirement_time"></a> time>= 0.9

Providers

NameVersion
<a name="provider_aws"></a> aws>= 5.0
<a name="provider_helm"></a> helm>= 2.9
<a name="provider_kubernetes"></a> kubernetes>= 2.20
<a name="provider_random"></a> random>= 3.6
<a name="provider_time"></a> time>= 0.9

Modules

NameSourceVersion
<a name="module_argo_events"></a> argo_eventsaws-ia/eks-blueprints-addon/aws1.1.1
<a name="module_argo_rollouts"></a> argo_rolloutsaws-ia/eks-blueprints-addon/aws1.1.1
<a name="module_argo_workflows"></a> argo_workflowsaws-ia/eks-blueprints-addon/aws1.1.1
<a name="module_argocd"></a> argocdaws-ia/eks-blueprints-addon/aws1.1.1
<a name="module_aws_cloudwatch_metrics"></a> aws_cloudwatch_metricsaws-ia/eks-blueprints-addon/aws1.1.1
<a name="module_aws_efs_csi_driver"></a> aws_efs_csi_driveraws-ia/eks-blueprints-addon/aws1.1.1
<a name="module_aws_for_fluentbit"></a> aws_for_fluentbitaws-ia/eks-blueprints-addon/aws1.1.1
<a name="module_aws_fsx_csi_driver"></a> aws_fsx_csi_driveraws-ia/eks-blueprints-addon/aws1.1.1
<a name="module_aws_gateway_api_controller"></a> aws_gateway_api_controlleraws-ia/eks-blueprints-addon/aws1.1.1
<a name="module_aws_load_balancer_controller"></a> aws_load_balancer_controlleraws-ia/eks-blueprints-addon/aws1.1.1
<a name="module_aws_node_termination_handler"></a> aws_node_termination_handleraws-ia/eks-blueprints-addon/aws1.1.1
<a name="module_aws_node_termination_handler_sqs"></a> aws_node_termination_handler_sqsterraform-aws-modules/sqs/aws4.0.1
<a name="module_aws_privateca_issuer"></a> aws_privateca_issueraws-ia/eks-blueprints-addon/aws1.1.1
<a name="module_bottlerocket_shadow"></a> bottlerocket_shadowaws-ia/eks-blueprints-addon/aws~> 1.1.1
<a name="module_bottlerocket_update_operator"></a> bottlerocket_update_operatoraws-ia/eks-blueprints-addon/aws~> 1.1.1
<a name="module_cert_manager"></a> cert_manageraws-ia/eks-blueprints-addon/aws1.1.1
<a name="module_cluster_autoscaler"></a> cluster_autoscaleraws-ia/eks-blueprints-addon/aws1.1.1
<a name="module_cluster_proportional_autoscaler"></a> cluster_proportional_autoscaleraws-ia/eks-blueprints-addon/aws1.1.1
<a name="module_external_dns"></a> external_dnsaws-ia/eks-blueprints-addon/aws1.1.1
<a name="module_external_secrets"></a> external_secretsaws-ia/eks-blueprints-addon/aws1.1.1
<a name="module_gatekeeper"></a> gatekeeperaws-ia/eks-blueprints-addon/aws1.1.1
<a name="module_ingress_nginx"></a> ingress_nginxaws-ia/eks-blueprints-addon/aws1.1.1
<a name="module_karpenter"></a> karpenteraws-ia/eks-blueprints-addon/aws1.1.1
<a name="module_karpenter_sqs"></a> karpenter_sqsterraform-aws-modules/sqs/aws4.0.1
<a name="module_kube_prometheus_stack"></a> kube_prometheus_stackaws-ia/eks-blueprints-addon/aws1.1.1
<a name="module_metrics_server"></a> metrics_serveraws-ia/eks-blueprints-addon/aws1.1.1
<a name="module_secrets_store_csi_driver"></a> secrets_store_csi_driveraws-ia/eks-blueprints-addon/aws1.1.1
<a name="module_secrets_store_csi_driver_provider_aws"></a> secrets_store_csi_driver_provider_awsaws-ia/eks-blueprints-addon/aws1.1.1
<a name="module_velero"></a> veleroaws-ia/eks-blueprints-addon/aws1.1.1
<a name="module_vpa"></a> vpaaws-ia/eks-blueprints-addon/aws1.1.1

Resources

NameType
aws_autoscaling_group_tag.aws_node_termination_handlerresource
aws_autoscaling_lifecycle_hook.aws_node_termination_handlerresource
aws_cloudformation_stack.usage_telemetryresource
aws_cloudwatch_event_rule.aws_node_termination_handlerresource
aws_cloudwatch_event_rule.karpenterresource
aws_cloudwatch_event_target.aws_node_termination_handlerresource
aws_cloudwatch_event_target.karpenterresource
aws_cloudwatch_log_group.aws_for_fluentbitresource
aws_cloudwatch_log_group.fargate_fluentbitresource
aws_eks_addon.thisresource
aws_iam_instance_profile.karpenterresource
aws_iam_policy.fargate_fluentbitresource
aws_iam_role.karpenterresource
aws_iam_role_policy_attachment.additionalresource
aws_iam_role_policy_attachment.karpenterresource
helm_release.thisresource
kubernetes_config_map_v1.aws_loggingresource
kubernetes_config_map_v1_data.aws_for_fluentbit_containerinsightsresource
kubernetes_namespace_v1.aws_observabilityresource
random_bytes.thisresource
time_sleep.thisresource
aws_caller_identity.currentdata source
aws_eks_addon_version.thisdata source
aws_iam_policy_document.aws_efs_csi_driverdata source
aws_iam_policy_document.aws_for_fluentbitdata source
aws_iam_policy_document.aws_fsx_csi_driverdata source
aws_iam_policy_document.aws_gateway_api_controllerdata source
aws_iam_policy_document.aws_load_balancer_controllerdata source
aws_iam_policy_document.aws_node_termination_handlerdata source
aws_iam_policy_document.aws_privateca_issuerdata source
aws_iam_policy_document.cert_managerdata source
aws_iam_policy_document.cluster_autoscalerdata source
aws_iam_policy_document.external_dnsdata source
aws_iam_policy_document.external_secretsdata source
aws_iam_policy_document.fargate_fluentbitdata source
aws_iam_policy_document.karpenterdata source
aws_iam_policy_document.karpenter_assume_roledata source
aws_iam_policy_document.velerodata source
aws_partition.currentdata source
aws_region.currentdata source

Inputs

NameDescriptionTypeDefaultRequired
<a name="input_argo_events"></a> argo_eventsArgo Events add-on configuration valuesany{}no
<a name="input_argo_rollouts"></a> argo_rolloutsArgo Rollouts add-on configuration valuesany{}no
<a name="input_argo_workflows"></a> argo_workflowsArgo Workflows add-on configuration valuesany{}no
<a name="input_argocd"></a> argocdArgoCD add-on configuration valuesany{}no
<a name="input_aws_cloudwatch_metrics"></a> aws_cloudwatch_metricsCloudwatch Metrics add-on configuration valuesany{}no
<a name="input_aws_efs_csi_driver"></a> aws_efs_csi_driverEFS CSI Driver add-on configuration valuesany{}no
<a name="input_aws_for_fluentbit"></a> aws_for_fluentbitAWS Fluentbit add-on configurationsany{}no
<a name="input_aws_for_fluentbit_cw_log_group"></a> aws_for_fluentbit_cw_log_groupAWS Fluentbit CloudWatch Log Group configurationsany{}no
<a name="input_aws_fsx_csi_driver"></a> aws_fsx_csi_driverFSX CSI Driver add-on configuration valuesany{}no
<a name="input_aws_gateway_api_controller"></a> aws_gateway_api_controllerAWS Gateway API Controller add-on configuration valuesany{}no
<a name="input_aws_load_balancer_controller"></a> aws_load_balancer_controllerAWS Load Balancer Controller add-on configuration valuesany{}no
<a name="input_aws_node_termination_handler"></a> aws_node_termination_handlerAWS Node Termination Handler add-on configuration valuesany{}no
<a name="input_aws_node_termination_handler_asg_arns"></a> aws_node_termination_handler_asg_arnsList of Auto Scaling group ARNs that AWS Node Termination Handler will monitor for EC2 eventslist(string)[]no
<a name="input_aws_node_termination_handler_sqs"></a> aws_node_termination_handler_sqsAWS Node Termination Handler SQS queue configuration valuesany{}no
<a name="input_aws_privateca_issuer"></a> aws_privateca_issuerAWS PCA Issuer add-on configurationsany{}no
<a name="input_bottlerocket_shadow"></a> bottlerocket_shadowBottlerocket Update Operator CRDs configuration valuesany{}no
<a name="input_bottlerocket_update_operator"></a> bottlerocket_update_operatorBottlerocket Update Operator add-on configuration valuesany{}no
<a name="input_cert_manager"></a> cert_managercert-manager add-on configuration valuesany{}no
<a name="input_cert_manager_route53_hosted_zone_arns"></a> cert_manager_route53_hosted_zone_arnsList of Route53 Hosted Zone ARNs that are used by cert-manager to create DNS recordslist(string)<pre>[<br/> "arn:aws:route53:::hostedzone/*"<br/>]</pre>no
<a name="input_cluster_autoscaler"></a> cluster_autoscalerCluster Autoscaler add-on configuration valuesany{}no
<a name="input_cluster_endpoint"></a> cluster_endpointEndpoint for your Kubernetes API serverstringn/ayes
<a name="input_cluster_name"></a> cluster_nameName of the EKS clusterstringn/ayes
<a name="input_cluster_proportional_autoscaler"></a> cluster_proportional_autoscalerCluster Proportional Autoscaler add-on configurationsany{}no
<a name="input_cluster_version"></a> cluster_versionKubernetes <major>.<minor> version to use for the EKS cluster (i.e.: 1.24)stringn/ayes
<a name="input_create_delay_dependencies"></a> create_delay_dependenciesDependency attribute which must be resolved before starting the create_delay_durationlist(string)[]no
<a name="input_create_delay_duration"></a> create_delay_durationThe duration to wait before creating resourcesstring"30s"no
<a name="input_create_kubernetes_resources"></a> create_kubernetes_resourcesCreate Kubernetes resource with Helm or Kubernetes providerbooltrueno
<a name="input_eks_addons"></a> eks_addonsMap of EKS add-on configurations to enable for the cluster. Add-on name can be the map keys or set with nameany{}no
<a name="input_eks_addons_timeouts"></a> eks_addons_timeoutsCreate, update, and delete timeout configurations for the EKS add-onsmap(string){}no
<a name="input_enable_argo_events"></a> enable_argo_eventsEnable Argo Events add-onboolfalseno
<a name="input_enable_argo_rollouts"></a> enable_argo_rolloutsEnable Argo Rollouts add-onboolfalseno
<a name="input_enable_argo_workflows"></a> enable_argo_workflowsEnable Argo workflows add-onboolfalseno
<a name="input_enable_argocd"></a> enable_argocdEnable Argo CD Kubernetes add-onboolfalseno
<a name="input_enable_aws_cloudwatch_metrics"></a> enable_aws_cloudwatch_metricsEnable AWS Cloudwatch Metrics add-on for Container Insightsboolfalseno
<a name="input_enable_aws_efs_csi_driver"></a> enable_aws_efs_csi_driverEnable AWS EFS CSI Driver add-onboolfalseno
<a name="input_enable_aws_for_fluentbit"></a> enable_aws_for_fluentbitEnable AWS for FluentBit add-onboolfalseno
<a name="input_enable_aws_fsx_csi_driver"></a> enable_aws_fsx_csi_driverEnable AWS FSX CSI Driver add-onboolfalseno
<a name="input_enable_aws_gateway_api_controller"></a> enable_aws_gateway_api_controllerEnable AWS Gateway API Controller add-onboolfalseno
<a name="input_enable_aws_load_balancer_controller"></a> enable_aws_load_balancer_controllerEnable AWS Load Balancer Controller add-onboolfalseno
<a name="input_enable_aws_node_termination_handler"></a> enable_aws_node_termination_handlerEnable AWS Node Termination Handler add-onboolfalseno
<a name="input_enable_aws_privateca_issuer"></a> enable_aws_privateca_issuerEnable AWS PCA Issuerboolfalseno
<a name="input_enable_bottlerocket_update_operator"></a> enable_bottlerocket_update_operatorEnable Bottlerocket Update Operator add-onboolfalseno
<a name="input_enable_cert_manager"></a> enable_cert_managerEnable cert-manager add-onboolfalseno
<a name="input_enable_cluster_autoscaler"></a> enable_cluster_autoscalerEnable Cluster autoscaler add-onboolfalseno
<a name="input_enable_cluster_proportional_autoscaler"></a> enable_cluster_proportional_autoscalerEnable Cluster Proportional Autoscalerboolfalseno
<a name="input_enable_eks_fargate"></a> enable_eks_fargateIdentifies whether or not respective addons should be modified to support deployment on EKS Fargateboolfalseno
<a name="input_enable_external_dns"></a> enable_external_dnsEnable external-dns operator add-onboolfalseno
<a name="input_enable_external_secrets"></a> enable_external_secretsEnable External Secrets operator add-onboolfalseno
<a name="input_enable_fargate_fluentbit"></a> enable_fargate_fluentbitEnable Fargate FluentBit add-onboolfalseno
<a name="input_enable_gatekeeper"></a> enable_gatekeeperEnable Gatekeeper add-onboolfalseno
<a name="input_enable_ingress_nginx"></a> enable_ingress_nginxEnable Ingress Nginxboolfalseno
<a name="input_enable_karpenter"></a> enable_karpenterEnable Karpenter controller add-onboolfalseno
<a name="input_enable_kube_prometheus_stack"></a> enable_kube_prometheus_stackEnable Kube Prometheus Stackboolfalseno
<a name="input_enable_metrics_server"></a> enable_metrics_serverEnable metrics server add-onboolfalseno
<a name="input_enable_secrets_store_csi_driver"></a> enable_secrets_store_csi_driverEnable CSI Secrets Store Providerboolfalseno
<a name="input_enable_secrets_store_csi_driver_provider_aws"></a> enable_secrets_store_csi_driver_provider_awsEnable AWS CSI Secrets Store Providerboolfalseno
<a name="input_enable_velero"></a> enable_veleroEnable Kubernetes Dashboard add-onboolfalseno
<a name="input_enable_vpa"></a> enable_vpaEnable Vertical Pod Autoscaler add-onboolfalseno
<a name="input_external_dns"></a> external_dnsexternal-dns add-on configuration valuesany{}no
<a name="input_external_dns_route53_zone_arns"></a> external_dns_route53_zone_arnsList of Route53 zones ARNs which external-dns will have access to create/manage records (if using Route53)list(string)[]no
<a name="input_external_secrets"></a> external_secretsExternal Secrets add-on configuration valuesany{}no
<a name="input_external_secrets_kms_key_arns"></a> external_secrets_kms_key_arnsList of KMS Key ARNs that are used by Secrets Manager that contain secrets to mount using External Secretslist(string)<pre>[<br/> "arn:aws:kms:::key/*"<br/>]</pre>no
<a name="input_external_secrets_secrets_manager_arns"></a> external_secrets_secrets_manager_arnsList of Secrets Manager ARNs that contain secrets to mount using External Secretslist(string)<pre>[<br/> "arn:aws:secretsmanager:::secret:*"<br/>]</pre>no
<a name="input_external_secrets_ssm_parameter_arns"></a> external_secrets_ssm_parameter_arnsList of Systems Manager Parameter ARNs that contain secrets to mount using External Secretslist(string)<pre>[<br/> "arn:aws:ssm:::parameter/*"<br/>]</pre>no
<a name="input_fargate_fluentbit"></a> fargate_fluentbitFargate fluentbit add-on configany{}no
<a name="input_fargate_fluentbit_cw_log_group"></a> fargate_fluentbit_cw_log_groupAWS Fargate Fluentbit CloudWatch Log Group configurationsany{}no
<a name="input_gatekeeper"></a> gatekeeperGatekeeper add-on configurationany{}no
<a name="input_helm_releases"></a> helm_releasesA map of Helm releases to create. This provides the ability to pass in an arbitrary map of Helm chart definitions to createany{}no
<a name="input_ingress_nginx"></a> ingress_nginxIngress Nginx add-on configurationsany{}no
<a name="input_karpenter"></a> karpenterKarpenter add-on configuration valuesany{}no
<a name="input_karpenter_enable_instance_profile_creation"></a> karpenter_enable_instance_profile_creationDetermines whether Karpenter will be allowed to create the IAM instance profile (v1beta1) or if Terraform will (v1alpha1)booltrueno
<a name="input_karpenter_enable_spot_termination"></a> karpenter_enable_spot_terminationDetermines whether to enable native node termination handlingbooltrueno
<a name="input_karpenter_node"></a> karpenter_nodeKarpenter IAM role and IAM instance profile configuration valuesany{}no
<a name="input_karpenter_sqs"></a> karpenter_sqsKarpenter SQS queue for native node termination handling configuration valuesany{}no
<a name="input_kube_prometheus_stack"></a> kube_prometheus_stackKube Prometheus Stack add-on configurationsany{}no
<a name="input_metrics_server"></a> metrics_serverMetrics Server add-on configurationsany{}no
<a name="input_observability_tag"></a> observability_tagTag to identify EKS Blueprints usage within observability toolsstring"qs-1ubotj5kl"no
<a name="input_oidc_provider_arn"></a> oidc_provider_arnThe ARN of the cluster OIDC Providerstringn/ayes
<a name="input_secrets_store_csi_driver"></a> secrets_store_csi_driverCSI Secrets Store Provider add-on configurationsany{}no
<a name="input_secrets_store_csi_driver_provider_aws"></a> secrets_store_csi_driver_provider_awsCSI Secrets Store Provider add-on configurationsany{}no
<a name="input_tags"></a> tagsA map of tags to add to all resourcesmap(string){}no
<a name="input_velero"></a> veleroVelero add-on configuration valuesany{}no
<a name="input_vpa"></a> vpaVertical Pod Autoscaler add-on configuration valuesany{}no

Outputs

NameDescription
<a name="output_argo_events"></a> argo_eventsMap of attributes of the Helm release created
<a name="output_argo_rollouts"></a> argo_rolloutsMap of attributes of the Helm release created
<a name="output_argo_workflows"></a> argo_workflowsMap of attributes of the Helm release created
<a name="output_argocd"></a> argocdMap of attributes of the Helm release created
<a name="output_aws_cloudwatch_metrics"></a> aws_cloudwatch_metricsMap of attributes of the Helm release and IRSA created
<a name="output_aws_efs_csi_driver"></a> aws_efs_csi_driverMap of attributes of the Helm release and IRSA created
<a name="output_aws_for_fluentbit"></a> aws_for_fluentbitMap of attributes of the Helm release and IRSA created
<a name="output_aws_fsx_csi_driver"></a> aws_fsx_csi_driverMap of attributes of the Helm release and IRSA created
<a name="output_aws_gateway_api_controller"></a> aws_gateway_api_controllerMap of attributes of the Helm release and IRSA created
<a name="output_aws_load_balancer_controller"></a> aws_load_balancer_controllerMap of attributes of the Helm release and IRSA created
<a name="output_aws_node_termination_handler"></a> aws_node_termination_handlerMap of attributes of the Helm release and IRSA created
<a name="output_aws_privateca_issuer"></a> aws_privateca_issuerMap of attributes of the Helm release and IRSA created
<a name="output_bottlerocket_update_operator"></a> bottlerocket_update_operatorMap of attributes of the Helm release and IRSA created
<a name="output_cert_manager"></a> cert_managerMap of attributes of the Helm release and IRSA created
<a name="output_cluster_autoscaler"></a> cluster_autoscalerMap of attributes of the Helm release and IRSA created
<a name="output_cluster_proportional_autoscaler"></a> cluster_proportional_autoscalerMap of attributes of the Helm release and IRSA created
<a name="output_eks_addons"></a> eks_addonsMap of attributes for each EKS addons enabled
<a name="output_external_dns"></a> external_dnsMap of attributes of the Helm release and IRSA created
<a name="output_external_secrets"></a> external_secretsMap of attributes of the Helm release and IRSA created
<a name="output_fargate_fluentbit"></a> fargate_fluentbitMap of attributes of the configmap and IAM policy created
<a name="output_gatekeeper"></a> gatekeeperMap of attributes of the Helm release and IRSA created
<a name="output_gitops_metadata"></a> gitops_metadataGitOps Bridge metadata
<a name="output_helm_releases"></a> helm_releasesMap of attributes of the Helm release created
<a name="output_ingress_nginx"></a> ingress_nginxMap of attributes of the Helm release and IRSA created
<a name="output_karpenter"></a> karpenterMap of attributes of the Helm release and IRSA created
<a name="output_kube_prometheus_stack"></a> kube_prometheus_stackMap of attributes of the Helm release and IRSA created
<a name="output_metrics_server"></a> metrics_serverMap of attributes of the Helm release and IRSA created
<a name="output_secrets_store_csi_driver"></a> secrets_store_csi_driverMap of attributes of the Helm release and IRSA created
<a name="output_secrets_store_csi_driver_provider_aws"></a> secrets_store_csi_driver_provider_awsMap of attributes of the Helm release and IRSA created
<a name="output_velero"></a> veleroMap of attributes of the Helm release and IRSA created
<a name="output_vpa"></a> vpaMap of attributes of the Helm release and IRSA created
<!-- END_TF_DOCS -->