Skip to content

cluster resource

Description

ClusterResource manages an Amazon EKS control plane and its mutable cluster configuration.

Source: internal/service/eks/cluster_types.go:5

Example usage:

imports: {
  aws-eks: 'github.com/cloudboss/unobin-library-aws//service/eks'
}

resources: {
  example: aws-eks.cluster {
    # Set input fields here.
  }
}

Inputs

name

string

required

role-arn

string

required

vpc-config

object 
object({
  subnet-ids: list(string)
  security-group-ids: optional(list(string))
  endpoint-private-access: boolean
  endpoint-public-access: boolean
  public-access-cidrs: optional(list(string))
  control-plane-egress-mode: optional(string)
})

required

version

optional(string)

force-update-version

optional(boolean)

bootstrap-self-managed-addons

boolean

default true

access-config

optional(object) 
optional(
  object({
    authentication-mode: optional(string)
    bootstrap-cluster-creator-admin-permissions: optional(boolean)
  })
)

compute-config

optional(object) 
optional(
  object({
    enabled: boolean
    node-pools: optional(list(string))
    node-role-arn: optional(string)
  })
)

control-plane-scaling-config

optional(object) 
optional(
  object({
    tier: optional(string)
  })
)

deletion-protection

optional(boolean)

enabled-cluster-log-types

optional(list(string))

encryption-config

optional(object) 
optional(
  object({
    provider: object({
      key-arn: string
    })
    resources: list(string)
  })
)

kubernetes-network-config

optional(object) 
optional(
  object({
    elastic-load-balancing: optional(
      object({
        enabled: boolean
      })
    )
    ip-family: optional(string)
    service-ipv4-cidr: optional(string)
  })
)

outpost-config

optional(object) 
optional(
  object({
    control-plane-instance-type: string
    control-plane-placement: optional(
      object({
        group-name: optional(string)
        spread-level: optional(string)
      })
    )
    etcd-instance-type: optional(string)
    etcd-placement: optional(
      object({
        spread-level: optional(string)
      })
    )
    outpost-arns: list(string)
  })
)

remote-network-config

optional(object) 
optional(
  object({
    remote-node-networks: optional(
      list(
        object({
          cidrs: list(string)
        })
      )
    )
    remote-pod-networks: optional(
      list(
        object({
          cidrs: list(string)
        })
      )
    )
  })
)

storage-config

optional(object) 
optional(
  object({
    block-storage: optional(
      object({
        enabled: boolean
      })
    )
  })
)

upgrade-policy

optional(object) 
optional(
  object({
    support-type: optional(string)
  })
)

zonal-shift-config

optional(object) 
optional(
  object({
    enabled: boolean
  })
)

tags

optional(map(string))

Input Constraints

Field combinations

encryption-config conflicts with outpost-config.

kubernetes-network-config conflicts with outpost-config.

Compute config rules

Auto Mode requires all capabilities enabled and bootstrap add-ons disabled.

Rule logic
When
input.compute-config.enabled == true
Require
input.kubernetes-network-config.elastic-load-balancing.enabled == true
&& input.storage-config.block-storage.enabled == true
&& input.bootstrap-self-managed-addons == false

Conditional requirement.

Rule logic
For each
input.compute-config.node-pools ?? []
Require
@each.value == 'general-purpose'
|| @each.value == 'system'

Kubernetes network config rules

Auto Mode requires all capabilities enabled and bootstrap add-ons disabled.

Rule logic
When
input.kubernetes-network-config.elastic-load-balancing.enabled == true
Require
input.compute-config.enabled == true
&& input.storage-config.block-storage.enabled == true
&& input.bootstrap-self-managed-addons == false

Conditional requirement.

Rule logic
When
input.kubernetes-network-config.ip-family != null
Require
input.kubernetes-network-config.ip-family == 'ipv4'
|| input.kubernetes-network-config.ip-family == 'ipv6'

Storage config rules

Auto Mode requires all capabilities enabled and bootstrap add-ons disabled.

Rule logic
When
input.storage-config.block-storage.enabled == true
Require
input.compute-config.enabled == true
&& input.kubernetes-network-config.elastic-load-balancing.enabled == true
&& input.bootstrap-self-managed-addons == false

Access config rules

Conditional requirement.

Rule logic
When
input.access-config.authentication-mode != null
Require
input.access-config.authentication-mode == 'CONFIG_MAP'
|| input.access-config.authentication-mode == 'API'
|| input.access-config.authentication-mode == 'API_AND_CONFIG_MAP'

Control plane scaling config rules

Conditional requirement.

Rule logic
When
input.control-plane-scaling-config.tier != null
Require
input.control-plane-scaling-config.tier == 'standard'
|| input.control-plane-scaling-config.tier == 'tier-xl'
|| input.control-plane-scaling-config.tier == 'tier-2xl'
|| input.control-plane-scaling-config.tier == 'tier-4xl'
|| input.control-plane-scaling-config.tier == 'tier-8xl'
|| input.control-plane-scaling-config.tier == 'tier-ultra'

Enabled cluster log types rules

Conditional requirement.

Rule logic
For each
input.enabled-cluster-log-types ?? []
Require
@each.value == 'api'
|| @each.value == 'audit'
|| @each.value == 'authenticator'
|| @each.value == 'controllerManager'
|| @each.value == 'scheduler'

Encryption config rules

Conditional requirement.

Rule logic
For each
input.encryption-config.resources ?? []
Require
@each.value == 'secrets'

Upgrade policy rules

Conditional requirement.

Rule logic
When
input.upgrade-policy.support-type != null
Require
input.upgrade-policy.support-type == 'STANDARD'
|| input.upgrade-policy.support-type == 'EXTENDED'

Vpc config rules

Conditional requirement.

Rule logic
When
input.vpc-config.control-plane-egress-mode != null
Require
input.vpc-config.control-plane-egress-mode == 'AWS_MANAGED'
|| input.vpc-config.control-plane-egress-mode == 'CUSTOMER_ROUTED'

Conditional requirement.

Rule logic
When
input.vpc-config.public-access-cidrs != null
Require
@core.length(input.vpc-config.public-access-cidrs) >= 1

Remote network config rules

Conditional requirement.

Rule logic
When
input.remote-network-config.remote-node-networks != null
Require
@core.length(input.remote-network-config.remote-node-networks) >= 1

Conditional requirement.

Rule logic
When
input.remote-network-config.remote-pod-networks != null
Require
@core.length(input.remote-network-config.remote-pod-networks) >= 1

Outputs

name

string

arn

string

certificate-authority-data

string

cluster-id

optional(string)

created-at

string

endpoint

string

oidc-issuer

optional(string)

platform-version

string

status

string

version

string

ip-family

string

service-ipv4-cidr

string

service-ipv6-cidr

optional(string)

cluster-security-group-id

string

vpc-id

string