Advanced Terraform for AWS EKS and VPC (TF v1.5. K8s v.1.27)

Explore the three-layer Terraform architecture—competition, infrastructure module, and resource modules—to structure scalable AWS EKS and VPC deployments with abstraction and encapsulation.

Explore a three-tier Terraform architecture for a remote backend, assembling local resource modules, a façade infrastructure module, and a consumer module to manage remote state storage and module integration.

Replicate remote terraform modules as local resource modules, organizing by category (storage, compute, database, security/identity) and externalizing variables, attributes, and outputs to enable reusable code.

Create infrastructure modules and consume resource modules through a facade layer, exposing a unified interface for storage, DynamoDB, and variable-driven configuration.

Define the composition layer inputs and pass top-level variables to the infra module via terraform.tfvars. Configure three buckets, dynamo db, and bucket policies, then view outputs after plan and apply.

Replicate remote terraform modules for VPC and security group by copy-pasting all files into local resource modules, without edits. Learn from examples the input variables and data versus computed concepts.

Step two expands infrastructure as code by wrapping multiple VPC subcomponents into a reusable facade, externalizing inputs, and reusing security group modules for public, private, and database subnets.

Design a VPC with public, private, and database subnets using a three-tier Terraform architecture. Reuse modules, configure security and compute groups, and expose a VPC facade for deployment.

Create the composition layer and define required inputs in terraform.tfvars for VPC, security groups, and subnets, and bubble up module inputs and outputs with clear comments.

Explore the EKS architecture overview in tf v1.5, for AWS EKS and VPC, building a three-zone VPC with public, private, and database subnets, and configuring worker nodes and security groups.

Replicate remote Terraform modules for EKS into local resource modules, copy all necessary files, modify worker naming and variable handling, and prepare key names and volume types.

Create infrastructure modules for EKS and VPC, reuse resource modules, and wire subnets, worker groups, and secret encryption to build scalable clusters.

Create a composition layer in terraform.tfvars for the X cluster, wiring inputs such as VPC subnet IDs and worker group settings. Enable conditional profile assignment for authentication and deployment.

Configure your local kubeconfig to access the EKS cluster using Terraform output, populate the kubeconfig file, and export the kubeconfig environment variable. Validate authentication with kubectl.

Enable encryption for EBS volumes attached to EKS worker nodes by creating a KMS key, setting the volume encryption flag to true, and provisioning the key ID across modules.

Set the root volume encryption flag to true in the composition layer using a top-level configuration map to propagate the encrypted setting through the resource module.

Create an AWS KMS key module to encrypt root EBS volumes in the infra module, and define an EBS decryption policy with access rules for encryption and decryption.

Create the AWS KMS module in the resource layer and apply Terraform to update and potentially replace a security group, launch config, and encrypted EBS volumes.

Verify the root EBS volume encryption and confirm the volume's encrypted status. Update the large config to enable encryption and rebuild the instance to apply the change, noting production downtime.

Explore how Kubernetes authenticates via an authenticator and authorizes actions through cluster roles, role bindings, and groups, using kubeconfig and a config map to grant cluster access.

Learn to configure aws-auth configmap for aws iam identities in kubernetes using terraform, avoiding manual edits; pass users, roles, and accounts as a reusable data map encoded into the configmap.

define local variable map_roles in data.tf using a top-down approach, cascade roles from input uproars to a hardcoded list when raw authentication is true, and pass to the module.

Execute step five by applying Terraform changes, review the plan output, and describe the changes, then configure roles, groups, and cluster bindings.

Test the developer role in a kubernetes cluster by configuring authentication and authorization, creating assume-role policies and cluster role bindings, and validating access across users.

Pass down the map_roles input from the infrastructure module to the resource layer, defining it in infra and root modules; verify the cube-system config map before applying to avoid conflicts.

Learn how to inspect and manage taints and labels on Kubernetes worker nodes using kubectl, verify default node state, and prepare Terraform-managed EKS nodes.

Learn to add taints and labels to EKS nodes with Terraform, compare unmanaged and managed node groups, and use bootstrap user data to propagate labels and taints for scalable scheduling.

Restart the EC2 instance to apply the updated userdata script that taints and labels the new node for Kubernetes, ensuring the updated config is used for future deployments.

Enable control plane logging for master components—API server, controller manager, audit, scheduler, and authenticator—by configuring logging, noting defaults are disabled and assessing costs and who is authenticating.

Define the cluster_enabled_log_types input variable in terraform.tfvars to enable all log types, pass them into the top-layer configuration, and set log retention days with a default of 90.

Pass the enabled_cluster_log_types input variable from the infrastructure layer to the resource, illustrating cascading values, defining necessary variables, and ensuring proper propagation across Terraform modules.

Apply terraform changes to enable control plane logs, observe in-place updates to logging configuration, and verify the control plane logs are enabled from the console.

recap of pod authentication and authorization with IRSA in a Kubernetes cluster, detailing service accounts, token exchange to assume AWS IAM roles, and emphasizing per-pod least-privilege permissions.

Understand the requirements for IRSA by completing three steps: creating a dedicated role with permissions, attaching a policy, and associating the IAM role with a service account via YAML annotation.

Create an OpenID Connect provider for your EKS cluster using Terraform, enable IRSA, configure module inputs, and apply to provision the provider and related IAM roles.

Create a new IAM role and attach a policy for service accounts using Terraform, following IRSA-style patterns. Test by binding the role to a test service account in default namespace.

Create iam assumable role and iam policy modules in infrastructure layer using terraform, leverage OpenID Connect for authentication, and configure read-only policy with namespace inputs.

Copy the AWS Terraform IAM module into the resource module layer, migrate remote modules to local modules, and provision a role with Operator Connect for web identity access.

Apply terraform configurations to provision and modify iam roles and policies, review provider setup, role creation, policy attachments, and trust relationships, using modules and incremental apply steps.

Verify AWS IAM role includes the k8s namespace and service account by checking the trust relationship and restricting assume permissions to Testarossa and SIRC namespaces to enforce least privilege.

Associate an IAM role with a Kubernetes service account to enable IRSA, annotate the account, apply the YAML, and verify role assumption in a pod.