Terraform を利用した Amazon EKS の構築

$ sudo apt-get update && sudo apt-get install -y gnupg software-properties-common

# HashiCorp repository の GPG key を import
$ wget -O- https://apt.releases.hashicorp.com/gpg | \
gpg --dearmor | \
sudo tee /usr/share/keyrings/hashicorp-archive-keyring.gpg > /dev/null

# GPG キーの確認
$ gpg --no-default-keyring \
--keyring /usr/share/keyrings/hashicorp-archive-keyring.gpg \
--fingerprint

$ echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] \
https://apt.releases.hashicorp.com $(lsb_release -cs) main" | \
sudo tee /etc/apt/sources.list.d/hashicorp.list

# terraform package の install
$ sudo apt update
$ sudo apt-get -y install terraform

# tab key の自動補完機能を install
$ terraform -install-autocomplete
$ complete -C /usr/bin/terraform terraform

# terraform version の確認
$ terraform -version
Terraform v1.9.2
on linux_amd64

$ cat << EOF > providers.tf
provider "random" {}

# https://registry.terraform.io/providers/hashicorp/aws/latest/docs#aws-configuration-reference
# 環境変数でも設定は可能です。ここでは Terraform に直接設定を入れてます。
provider "aws" {
  region = var.region
}
EOF

$ cat << EOF > backend.tf
terraform {
  backend "local" {
    path = "terraform.tfstate"
  }
}
EOF

$ cat << EOF > versions.tf
terraform {
  # required Terraform version
  required_version = ">= 1.9.2"

  required_providers {
    random = {
      source = "hashicorp/random"
      version = ">= 3.6.1"
    }
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.48.0"
    }
  }
}
EOF

$ cat << EOF > main.tf

# 共通で使う変数の設定
locals {
  azs = slice(data.aws_availability_zones.available.names, 0, 3)

  tags = {
    project    = var.name_prefix
    managed_by = "Terraform"
  }
}

# data を利用して現在のリージョンから使える aws availability zones を取得します。
# この手法を使えば様々なリソースを Dynamic に生成できます。
# 他によく使われている例としてたとえば、Amazon Linux や Ubuntu の AMI の取得が挙がられます。
data "aws_availability_zones" "available" {}

# VPC 関連のリソースを構築
module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 5.0"

  name                  = var.name_prefix
  cidr                  = var.vpc_cidr
  secondary_cidr_blocks = var.secondary_cidr_blocks

  azs = local.azs

  private_subnets = [for k, v in local.azs : cidrsubnet(var.vpc_cidr, 2, k)]
  public_subnets  = [for k, v in local.azs : cidrsubnet(var.secondary_cidr_blocks.0, 2, k)]
  intra_subnets   = [for k, v in local.azs : cidrsubnet(var.secondary_cidr_blocks.1, 2, k)]

  map_public_ip_on_launch = true
  enable_nat_gateway      = true
  single_nat_gateway      = true
  create_egress_only_igw  = true
  
  public_subnet_tags = {
    "subnet-type"            = "public"
    
    # 外向けの ELB はこちらの Subnet を利用
    "kubernetes.io/role/elb" = 1
  }

  private_subnet_tags = {
    "subnet-type"                     = "private"
    
    # 内向けの ELB はこちらの Subnet を利用
    "kubernetes.io/role/internal-elb" = 1
  }

  tags = local.tags
}

$ cat << EOF > variables.tf
variable "eks_version" {
  type = string
  description = "The EKS version to use"
}

variable "vpc_cidr" {
  type = string
  description = "The CIDR block for the VPC"
}

variable "secondary_cidr_blocks" {
  type = list(string)
  description = "The secondary CIDR blocks for the VPC"
}

variable "name_prefix" {
  type = string
  description = "The prefix to use for all resources"
}

variable "region" {
  type = string
  description = "The AWS region to deploy to"
}
EOF

$ cat << EOF > terraform.tfvars
eks_version           = "1.29"
name_prefix           = "terraform-eks-example"
vpc_cidr              = "10.0.0.0/16"
secondary_cidr_blocks = ["10.1.0.0/16", "10.2.0.0/16"]
region                = "ap-northeast-1"
EOF

$ terraform init
$ terraform plan -out ./plan
$ terraform apply ./plan