-
Notifications
You must be signed in to change notification settings - Fork 100
/
__main__.py
111 lines (96 loc) · 5.08 KB
/
__main__.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
import pulumi
from pulumi_aws import ec2, get_availability_zones
stack_name = pulumi.get_stack()
project_name = pulumi.get_project()
config = pulumi.Config('vpc')
vpc = ec2.Vpc(resource_name=f"eks-{project_name}-{stack_name}",
cidr_block="10.100.0.0/16",
enable_dns_support=True,
enable_dns_hostnames=True,
instance_tenancy='default',
tags={"Project": project_name,
"Stack": stack_name})
igw = ec2.InternetGateway(resource_name=f'vpc-ig-{project_name}-{stack_name}',
vpc_id=vpc.id,
tags={"Project": project_name,
"Stack": stack_name})
route_table = ec2.RouteTable(resource_name=f'vpc-route-table-{project_name}-{stack_name}',
vpc_id=vpc.id,
routes=[ec2.RouteTableRouteArgs(
cidr_block='0.0.0.0/0',
gateway_id=igw.id)],
tags={"Project": project_name,
"Stack": stack_name})
# Use availability zones defined in the configuration file if available
if config.get('azs'):
azs = config.get_object('azs')
else:
azs = get_availability_zones(state="available").names
public_subnets = []
private_subnets = []
# If you wanted to double the number of subnets because you have few
# availability zones, you can redefine the variable below to something
# like: list(itertools.chain(azs, azs)) which would just repeat the
# same list of AZs twice. The iteration logic will pick it up for
# subnet creation and create unique names.
azs_for_subnets = list(azs)
if len(azs) <= 0:
raise ValueError("There are no usable availability zones")
if len(azs) == 1:
pulumi.log.warn("There is only a single usable availability zone")
elif len(azs) == 2:
pulumi.log.warn("There are only two usable availability zones")
for i, az in enumerate(azs_for_subnets):
if not isinstance(az, str):
raise f'availability zone specified [{i}] is not a valid string value: [{az}]'
if az.strip() == "":
raise f'availability zone specified [{i}] is an empty string'
public_subnet_addr = i
resource_name = f'{az}-k8s-public-{project_name}-{stack_name}-{i}'
subnet = ec2.Subnet(resource_name=resource_name,
availability_zone=az,
vpc_id=vpc.id,
cidr_block=f"10.100.{public_subnet_addr}.0/24",
map_public_ip_on_launch=True,
tags={"Project": project_name,
"Stack": stack_name,
"kubernetes.io/role/elb": "1"})
ec2.RouteTableAssociation(f"route-table-assoc-public-{az}-{i}",
route_table_id=route_table.id,
subnet_id=subnet.id)
public_subnets.append(subnet)
for i, az in enumerate(azs_for_subnets):
private_subnet_addr = (i + 1) * 16
resource_name = f"{az}-k8s-private-{project_name}-{stack_name}-{i}"
subnet = ec2.Subnet(resource_name=resource_name,
availability_zone=az,
vpc_id=vpc.id,
cidr_block=f"10.100.{private_subnet_addr}.0/20",
tags={"Project": project_name,
"Stack": stack_name,
"kubernetes.io/role/internal-elb": "1"},
map_public_ip_on_launch=False)
ec2.RouteTableAssociation(resource_name=f"route-table-assoc-private-{az}-{project_name}-{stack_name}-{i}",
route_table_id=route_table.id,
subnet_id=subnet.id)
private_subnets.append(subnet)
eks_security_group = ec2.SecurityGroup(resource_name=f'eks-cluster-sg-{project_name}-{stack_name}',
vpc_id=vpc.id,
description="Allow all HTTP(s) traffic to EKS Cluster",
tags={"Project": project_name,
"Stack": stack_name},
ingress=[
ec2.SecurityGroupIngressArgs(
cidr_blocks=['0.0.0.0/0'],
from_port=443,
to_port=443,
protocol='tcp',
description='Allow pods to communicate with the cluster API Server.'),
ec2.SecurityGroupIngressArgs(
cidr_blocks=['0.0.0.0/0'],
from_port=80,
to_port=80,
protocol='tcp',
description='Allow internet access to pods')])
pulumi.export("azs", azs)
pulumi.export("vpc", vpc)