Initial commit.

modules/eks-ingress-controller/data.tf

@@ -0,0 +1,15 @@
+data "aws_lb" "public" {
+  depends_on = [helm_release.nginx_ingress_contoller]
+
+  tags = merge(var.tags, { scheme = "internet-facing" })
+}
+
+data "aws_lb" "internal" {
+  depends_on = [helm_release.nginx_ingress_contoller]
+
+  tags = merge(var.tags, { scheme = "internal" })
+}
+
+data "aws_eks_cluster_auth" "self" {
+  name = var.cluster_id
+}

modules/eks-ingress-controller/main.tf

@@ -0,0 +1,52 @@
+locals {
+  string_list_tags = join(",", [for key, value in var.tags : "${key}=${value}"])
+  template_vars    = merge(var.load_balancer_config, var.ingress_config, { "tags" = local.string_list_tags })
+}
+
+resource "helm_release" "nginx_ingress_contoller" {
+  name             = "nginx-ingress-controller"
+  repository       = "https://kubernetes.github.io/ingress-nginx"
+  chart            = "ingress-nginx"
+  version          = "4.0.18"
+  namespace        = var.namespace
+  create_namespace = var.create_namespace
+
+  values = [
+    "${templatefile("values.yaml", local.template_vars)}"
+  ]
+
+  set {
+    name  = "controller.ingressClass"
+    value = var.ingress_class
+  }
+
+  set {
+    name  = "controller.service.internal.enabled"
+    value = var.enable_internal_lb
+  }
+
+  set {
+    name  = "controller.ingressClassResource.default"
+    value = var.is_default_ingress_class
+  }
+}
+
+resource "aws_route53_record" "public" {
+  zone_id = var.public_dns_record.zone_id
+  name    = var.public_dns_record.name
+  type    = "CNAME"
+  ttl     = "60"
+  records = [
+    data.aws_lb.public.dns_name
+  ]
+}
+
+resource "aws_route53_record" "internal" {
+  zone_id = var.internal_dns_record.zone_id
+  name    = var.internal_dns_record.name
+  type    = "CNAME"
+  ttl     = "60"
+  records = [
+    data.aws_lb.internal.dns_name
+  ]
+}

modules/eks-ingress-controller/outputs.tf

@@ -0,0 +1,9 @@
+output "public_ingress_load_balancer" {
+  description = "The internet facing Load Balancer object created by the ingress controller deployment"
+  value       = data.aws_lb.public
+}
+
+output "internal_ingress_load_balancer" {
+  description = "The internal Load Balancer object created by the ingress controller deployment"
+  value       = data.aws_lb.internal
+}

modules/eks-ingress-controller/provider.tf

@@ -0,0 +1,7 @@
+provider "helm" {
+  kubernetes {
+    host                   = var.cluster_endpoint
+    cluster_ca_certificate = base64decode(var.cluster_certificate_authority_data)
+    token                  = data.aws_eks_cluster_auth.self.token
+  }
+}

modules/eks-ingress-controller/values.yaml

@@ -0,0 +1,39 @@
+---
+controller:
+  config:
+    use-proxy-protocol: ${use-proxy-protocol}
+    proxy-real-ip-cidr: ${proxy-real-ip-cidr}
+    use-forwarded-headers: ${use-forwarded-headers}
+    compute-full-forwarded-for: ${compute-full-forwarded-for}
+  service:
+    annotations:
+      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ${public.backend-protocol}
+      service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: '${public.connection-idle-timeout}'
+      service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: '${public.cross-zone-load-balancing-enabled}'
+      service.beta.kubernetes.io/aws-load-balancer-type: ${public.type}
+      service.beta.kubernetes.io/aws-load-balancer-additional-resource-tags: "scheme=internet-facing,${tags}"
+      service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "${public.proxy-protocol}"
+      service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: "${public.nlb-target-type}"
+      service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing"
+    internal:
+      annotations:
+        service.beta.kubernetes.io/aws-load-balancer-internal: "true"
+        service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ${internal.backend-protocol}
+        service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: '${internal.connection-idle-timeout}'
+        service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: '${internal.cross-zone-load-balancing-enabled}'
+        service.beta.kubernetes.io/aws-load-balancer-type: ${internal.type}
+        service.beta.kubernetes.io/aws-load-balancer-additional-resource-tags: "scheme=internal,${tags}"
+        service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "${internal.proxy-protocol}"
+        service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: "${public.nlb-target-type}"
+        service.beta.kubernetes.io/aws-load-balancer-scheme: "internal"
+        service.beta.kubernetes.io/aws-load-balancer-target-group-attributes: preserve_client_ip.enabled=false
+
+#  metrics:
+#    enabled: true
+#    serviceMonitor:
+#      enabled: true
+#      additionalLabels:
+#        release: prometheus-community
+#      namespaceSelector:
+#        any: true
+...

modules/eks-ingress-controller/variables.tf

@@ -0,0 +1,101 @@
+variable "load_balancer_config" {
+  type = map(object({
+    backend-protocol                  = string
+    connection-idle-timeout           = string
+    cross-zone-load-balancing-enabled = bool
+    type                              = string
+    dns_record                        = string
+    proxy-protocol                    = string
+    nlb-target-type                   = string
+  }))
+  description = "The AWS Load Balancer(s) configuration. Map keys shall be 'public' and/or 'internal'"
+}
+
+variable "ingress_config" {
+  type = object({
+    use-proxy-protocol         = bool
+    proxy-real-ip-cidr         = string
+    use-forwarded-headers      = bool
+    compute-full-forwarded-for = bool
+  })
+  description = "Ingress level configuration"
+  default = {
+    use-proxy-protocol         = false
+    proxy-real-ip-cidr         = "0.0.0.0/0"
+    use-forwarded-headers      = false
+    compute-full-forwarded-for = false
+  }
+}
+
+variable "cluster_id" {
+  type        = string
+  description = "The name/id of the EKS cluster. Will block on cluster creation until the cluster is really ready"
+}
+
+variable "cluster_endpoint" {
+  type        = string
+  description = "Endpoint for your Kubernetes API server"
+}
+
+variable "cluster_certificate_authority_data" {
+  type        = string
+  description = "Base64 encoded certificate data required to communicate with the cluster"
+}
+
+variable "ingress_class" {
+  type        = string
+  default     = "nginx"
+  description = "A class for the Ingress controller"
+}
+
+variable "is_default_ingress_class" {
+  type        = bool
+  description = "Flag allowing to define this ingress controller ingress class as the default one"
+  default     = true
+}
+
+variable "enable_internal_lb" {
+  type    = bool
+  default = false
+}
+
+variable "namespace" {
+  type        = string
+  description = "The namespace where the ingress controller is deployed"
+  default     = "nginx-ingress"
+}
+
+variable "create_namespace" {
+  type        = bool
+  description = "Flag allowing to create the namespace if it does not exists"
+  default     = true
+}
+
+variable "public_dns_record" {
+  type = object({
+    zone_id = string
+    name    = string
+  })
+  default = {
+    zone_id = ""
+    name    = ""
+  }
+  description = "Public DNS zone and record name where to register the ingress load balancer"
+}
+
+variable "internal_dns_record" {
+  type = object({
+    zone_id = string
+    name    = string
+  })
+  default = {
+    zone_id = ""
+    name    = ""
+  }
+  description = "Private DNS zone and record name where to register the ingress load balancer"
+}
+
+variable "tags" {
+  type    = map(string)
+  default = {}
+}

modules/eks-ingress-controller/versions.tf

@@ -0,0 +1,12 @@
+terraform {
+  required_providers {
+    helm = {
+      source  = "hashicorp/helm"
+      version = "2.4.1"
+    }
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 4.4.0"
+    }
+  }
+}