How to Create EKS Cluster Using Terraform + IAM Roles for Service Accounts & EKS Cluster Autoscaler

[@AntonPutra]

🔴 - To support my channel, I’d like to offer Mentorship/On-the-Job Support/Consulting - [e-mail] 👉 [UPDATED] AWS EKS Kubernetes Tutorial [NEW]: kzbin.info/aero/PLiMWaCMwGJXnKY6XmeifEpjIfkWRo9v2l&si=wc6LIC5V2tD-Tzwl

[@AntonPutra]

🔴UPDATED🔴 How to create EKS Cluster using Terraform MODULES (AWS Load Balancer Controller + Autoscaler + IRSA) - kzbin.info/www/bejne/oYOunpaPeJxkgJY Monitor EKS & EC2 instances with MANAGED Prometheus - kzbin.info/www/bejne/Y5-4goF8dr1oiqs Native EKS Ingress: AWS Load Balancer Controller - kzbin.info/www/bejne/g4vco6uwl5ysd7c How to Add IAM User and IAM Role to AWS EKS Cluster? - kzbin.info/www/bejne/e3jHf2Vne5d9nNk How to Create EKS Cluster Using eksctl? - kzbin.info/www/bejne/a2fFmJ2qfLqtfac

[@AntonPutra]

🟢 [New] Terragrunt Tutorial: Create VPC, EKS from Scratch! (Step-by-Step) - kzbin.info/www/bejne/r5XYeZSFn5iLg8k

[@AntonPutra]

👉 How to Manage Secrets in Terraform - kzbin.info/www/bejne/aX-TpXqBrNt1mqM 👉 Terraform Tips & Tricks - kzbin.info/www/bejne/bYScZaKLid5lsJY 👉 ArgoCD Tutorial - kzbin.info/www/bejne/sHjRlZqafMZkisU

[@AntonPutra]

Get Full-Length High-Quality DevOps Tutorials for Free - Subscribe Now! - kzbin.info

[@roshankeram7460]

I am not able to find github link for above project I found it for modules one

[@craigrodrigues3435]

Excellent! In my opinion, using terraform to create EKS clusters is better than depending on CloudFormation or eksctl

[@AntonPutra]

agree

[@TigranAndonian]

Anton, very good, one of the best explanation I saw! Thank you!

[@13bhanuprakash]

Excellent Start to EKS via Terraform -- Many Thanks for this ....

[@AntonPutra]

You're very welcome!

[@MrEdinaldolaroque]

спасибо большое, Антон Путра! Thank you for sharing your knowledge!

[@AntonPutra]

welcome =)

[@AbdullaJandali]

amazing tutorial, i encountered issue with the route table syntax tho had to troubleshoot it for few hours , i ended up using a different module , but other than that, its working smooth , thanks a lot

[@pikaa-si9ie]

Do u mind providing source code that?

[@zhilin6068]

simple but very clear, like this course

[@AntonPutra]

Glad to hear that!

[@rehantayyab82]

this is first video in series , should'nt it be gradually go from basic towards advanced .....great work indeed

[@AntonPutra]

Thank you! I've created so many tutorials about EKS that I don't even remember what's in them, lol.

[@VinothRajkumar]

Excellent video. Keep rocking with more videos

[@AntonPutra]

Thanks!

[@nckillada8839]

Awesome! Well explained, thanks!!

[@AntonPutra]

You're welcome!

[@davystrain7217]

brilliant workshop well done and thank you :)

[@israel8707]

@Anton Putra thanks very much for shared this amazing tutorial, I did it complete step by step and only I did small changes, but everithing is work ok, thanks again :)

[@AntonPutra]

welcome!

[@zakariamansouri351]

thank you so much Anton for providing such a content , subscribed 👌

[@AntonPutra]

My plreasure!

[@unixbashscript9586]

Excellent stuff!

[@AntonPutra]

Glad you liked it!

[@viniciuscordeiro1360]

thank you very much!

[@AntonPutra]

Welcome!

[@brahmaiahboddu5762]

Super👍

[@AntonPutra]

Thank you 👍

[@albertoporras3341]

Great video, learning a lot. Thanks a lot 5 stars video.

[@AntonPutra]

Thanks Alberto!

[@albertoporras3341]

@@AntonPutra Quick question! how I can SSH to EKS Worker Nodes, which variables I need to add and if I need to add it to 7-nodes.tf or in 0-provider.tf file?

[@Randych]

@@albertoporras3341 out of curiosity, WHY on earth would you do that

[@david2358]

Thank you, learned a lot and subscribed!! 👍

[@AntonPutra]

Welcome aboard! :)

[@christianibiri]

Great video!!!

[@AntonPutra]

Thank you!!

[@675FresH]

Спасибо большое за гайд, очень помогло!

[@AntonPutra]

pojaluysta =)

[@Whitegatellc1]

Great Video Anton! For-Self Managed K8S clusters using EKS but using " worker-groups" as worker nodes with Auto-Scaling, will the same policies you attached to your IAM role be the same? Looking forward to more great stuff from you!

[@AntonPutra]

Thanks Abimbola! I haven't tested, but should be the same.

[@yusranad]

Awesome video. I have been automated my deployment EKS using terraform since I watch your video it make me to practice it. I have question is the terraform can execute a script since I'm using rancher inside the kubernetes for manage my Kubernetes using EKS.

[@AntonPutra]

Thanks, yes terraform can execute local script and/or remote script. Frequently it is used with configuration management tools such as Ansible, Puppet, etc. Here is a reference www.terraform.io/language/resources/provisioners/local-exec www.terraform.io/language/resources/provisioners/remote-exec

[@felipealvarez1982]

thanks for uploading the video. I found the instructions to be a little too quick, and pasting some of the code examples were hard to follow because they were too large/long, and the video pace was a bit quick.

[@AntonPutra]

Thanks for the feedback, you can find the source code in the github repo

[@MB982010]

Hey Anton, thanks for this video it is awsome! Could you please do another one withTerraform but with ArgoCD included? Thanks again.

[@AntonPutra]

Sure!

[@mehmetnuricetin4104]

Thanks Anton for great video. I try to create CI-CD pipeline for github action. There is some code exemple that I can use?

[@AntonPutra]

Sure, 1. GitHub Actions Self Hosted Runner (Autoscaling with Kubernetes) 2. How to Create Your Own GitHub Actions? kzbin.info/www/bejne/oKjHeGl6YqZ1Z80 3. Build a Docker Image and Publish It to GCP GCR & Artifact Registry using Github Actions - kzbin.info/www/bejne/bJWveZakobWclbc 4. Build a Docker Image and Publish It to AWS ECR using Github Actions kzbin.info/www/bejne/fqeYhpZ4jtiYq9U

[@mehmetnuricetin4104]

And I am really junior :) I mean also if there is some repository for using terraform to create github action for eks! Thanks again

[@rehantayyab82]

u did not tell about vpcendpoint which are required when we deploy app on nodegroup in private subnets and some security group settings as well , please can you clarify on this ?

[@AntonPutra]

Security Group is managed by the EKS, not sure what do you mean.. You can expose app using private or public service of type load balancer.

[@amittaywade8753]

Nice video and explaination, I have tried everything. JFYI cluster-autoscaler.yaml code is missing in your DOC

[@AntonPutra]

Thanks

[@nforlife]

Great video as usual Anton. could you add HPA ?

[@AntonPutra]

Thanks, I already have 2 Horizontal Pod Autoscaler CUSTOM METRICS & PROMETHEUS - kzbin.info/www/bejne/n6DHomBqqNeLd5o Kubernetes Horizontal Pod Autoscaler - kzbin.info/www/bejne/pnrCoYCpqsatp9k

[@supreethashetty7493]

Could please show create eks node using launch template

[@AntonPutra]

Sure, here - github.com/antonputra/tutorials/blob/b09834856cc27ad8aa2fde45fbcd655a9a1425dd/lessons/150/terraform/7-nodes.tf#L129-L139

[@lawrenceobrero4228]

Great tutorial! Thanks for the video. I'm curious why there is no security groups in the terraform files?

[@AntonPutra]

Thanks, as far as I remember EKS will generate them for you.

[@ajadavis2000]

hello! thank u v much this is v informational. was wondering how to limit public network access through inbound rules/security groups like an ec2 - currently the loadbalancer is accessible anywhere

[@AntonPutra]

It depends on the load balancer. Network load balancer does not have security groups and inherit rules from ec2 instances. Application load balancer needs it's own security group. If you can explain your use case i can give more specific recommendation.

[@ajadavis2000]

@@AntonPutra thanks so much for getting back. so i use the hasura graphql engine in a container, and if i deploy with a load balancer, i can reach the UI via a call to the dns. The graphql also has to be accessible to rds and an app in cloudfront. so it appears that maybe the ec2 security group is best to manage public accessibility of the hasura UI, and an application load balancer is the best solution to manager the graphql engine and its connections to the rds and cloudfront application - does this sound right?

[@mantikoragio6555]

Thanks a lot! Could you tell how you made VS Code folder icons prettier & what's the terminal Theme? Looks beautiful! :)

[@AntonPutra]

I believe I used "this extension - marketplace.visualstudio.com/items?itemName=vscode-icons-team.vscode-icons. For the terminal it's item2 + ohmyz.sh/

[@kossei8096]

How do you pass aws credential to the pod? Because i get an error "unable to locate credential. You can configure credentials by running aws configure"

[@kossei8096]

Turns out i just miss indentation 😅

[@AntonPutra]

@@kossei8096 ok :)

[@leo5946]

do we need to create an iam role demo explicitly ? u did not create one in the video, or do you have one already ?

[@AntonPutra]

It's in the terraform code. Yes, you need 1 role for control plane and another one for node pool.

[@ariskaraiskos8079]

Hi Anton, great video mate, may i ask, can we set up autoscaler to scale automatically based on the load? and if yes, how? thanks!

[@AntonPutra]

Sure, i have few tutorials on my channel how to scale based on cpu & memory as well as custom metrics defined using prometheus

[@andreykaparulin9214]

Thanks

[@AntonPutra]

Welcome

[@vimaladeshmukh4017]

Hey awesome video sir.. one request, u havent attached service account,cluster role and binding related to autoscaler group in the link you provided. Could you please add that in your notes.🙏 Whole cluster-autoscaler.yaml file is missing in the given link.

[@AntonPutra]

this one? github.com/antonputra/tutorials/blob/main/lessons/102/k8s/cluster-autoscaler.yaml

[@kiranshelke1627]

Nice video Anton. Could you please share terraform script using EKS fargate?

[@AntonPutra]

Thanks, here - github.com/antonputra/tutorials/tree/main/lessons/102

[@rellimcire]

Your videos have helped me a lot. However, I'm still confused about load balancing. Somehow your cluster knows to create a load balancer when you create a LoadBalancer service. My cluster does not do that. Is there some setting or policy I need to add somewhere to make that work?

[@AntonPutra]

Kubernetes project have intree controllers that responsible for creating load balancers in different supported clouds. If you on premise or even bare metal try to install metallb. Otherwise just kubectl describe svc to get error message

[@rellimcire]

@@AntonPutra I'm in EKS. But your reply helped a lot. I'm tracing error now.

[@shulyakav]

Скажи, а у тебя было время посмотреть в сторону Karpenter? я вот глянул, крутая штука, вроде бы.

[@AntonPutra]

Poka net, sdelay video pro karpenter navernoe cherez nedelyu.

[@crimson27271]

does the code for the autoscaler need to be updated? the pod keeps crashing for me, at firts i though it was the amount of memory but after raising it it keeps crashing and the logs are way to many to make sense, when i use describe pod i just get Back-off restarting failed container

[@AntonPutra]

make sure you match autoscaler version to your k8s as close as possible

[@crimson27271]

@@AntonPutra I change the image version to 1.22.1 but still gave me problems, then i notice that the problem was that i did not change the account number on my rol, and after doing the change seens to be running just fine.

[@AntonPutra]

@@crimson27271 good to know, need to put a warning there =)

[@arindamghosh3299]

How do you tackle the situation when the cluster autoscaler has changed the cluster scaling from 1 to 2 (and terraform won't know this) and then you need to perform a terraform deployment? In that case the scaling config will show the desired size of the cluster node has been changed and will try to put it back to 1, isn't it?

[@AntonPutra]

It should not happen. How do you manage your node pool? (managed, unmanaged, or separate autoscaling group)

[@david2358]

Quick question: why didn't you also add add-ons in your eks.tf file? Will the cluster work without add-ons?

[@AntonPutra]

It will work with and without adonds. Do you have any specific addon in mind?

[@aryadiadi6888]

@@AntonPutra EFS

[@Randych]

@@aryadiadi6888 ew fargate

[@jinkahari]

Hi Anton, I am getting errror " │ Inappropriate value for attribute "route": element 0: attribute "core_network_arn" is required." in route tables creation.

[@AntonPutra]

if i get the same error will provide a feedback

[@fenilshah7310]

What if I don't want to use elastic IP? Is there another way to configure this?

[@AntonPutra]

elastic ip for what? nat? well use public subnets with igw

[@rritsoftwaresolutions9566]

super all the best keep it up , i like yours video , great super amazing video , PLEASE DO MAKING SAME REAL TIME EKS CLUSTER VIDEOS , i appreciate you /////

[@George-mk7lp]

what terraform version did you use in this tutorial?

[@AntonPutra]

I don't remember the exact version but higher 1.1.x. Next time will commit terraform lock file.

[@james-mo2pk]

Why did you use only one nat gateway in this section?

[@AntonPutra]

Well, the general recommendation by AWS to use nat gateway per availability zone. But for the last five years, I have never had issues with nat gateways. It's cost vs. ha balance that you need to decide for yourself. AWS will always try to convince you to use multi az and multi-region :)

[@james-mo2pk]

Thank you for the good video and kind reply😁

[@nulops]

Do you implement vpc_cni ?

[@AntonPutra]

Yes, EKS supports native VPC networking (via CNI plugin)

[@miv_cleric]

How do I test the private load balancer?

[@AntonPutra]

Test? You can open it in AWS console and find scheme property.

[@rajenthapa4178]

Thank you very much for the video Anton. It was really awesome and helpful. How can we setup the aws load balancer controller for eks ingress via Terraform?

[@AntonPutra]

Thanks, I usually configure only AWS staff using terraform such as IAM permissions for controller. Deployment itself (YAML) is managed by other tools such as flux. You could however to use Terraform Kubernetes Provider - registry.terraform.io/providers/hashicorp/kubernetes/latest/docs

[@JP-qx6tw]

Hi Anton, If we deploy an ALB how can we reuse the ALB for other services/ingress?

[@AntonPutra]

There is a way with AWS Load Balancer Controller.You need to create TargetGroupBinding. It is a custom resource (CR) that can expose your pods using an existing ALB TargetGroup or NLB TargetGroup. I'm. going to create tutorial soon, here is a link for official doc - kubernetes-sigs.github.io/aws-load-balancer-controller/v2.3/guide/targetgroupbinding/targetgroupbinding/

[@mum0l57]

Very nice, but you could speak more slowly.. ;)

[@AntonPutra]

Thank, noted!

[@qizhang5749]

Lol had to check my playback speed

[@sobankhan7517]

SIr thanks

[@AntonPutra]

welcome!

[@George-mk7lp]

Why do we use cluster autoscaler as deployment if we already have node autoscaling in the nodes.tf file ? I mean this one: resource "aws_eks_node_group" "private-nodes" { cluster_name = aws_eks_cluster.demo.name node_group_name = "private-nodes" node_role_arn = aws_iam_role.nodes.arn subnet_ids = [ aws_subnet.private-us-east-1a.id, aws_subnet.private-us-east-1b.id ] capacity_type = "ON_DEMAND" instance_types = ["t3.small"] scaling_config { desired_size = 2 max_size = 5 min_size = 2 } update_config { max_unavailable = 1 }

[@AntonPutra]

Autoscaling block in terraform only configures AWS autoscaling group with min, max and desired size. Job of autoscaler deployed in K8s is to adjust desired size based on the load.

[@Randych]

I don't understand: - why public subnets are REQUIRED - why are you forced to connect private subnets to internet - why do you use private LB if it's same as public LB since private subnets are connected to internet

[@AntonPutra]

- only if you want to expose your apps to internet - typically we have 3 types of subnets: 1. public with internet gateway 2. private with nat gateway 3. isolated without access to internet, usually used for databases - it's not the same. Private LB only accessible within VPC, public LBs accessible from the internet

[@Randych]

@@AntonPutra oh right, DB subnets, thanks for reminder, I'll go over it. Also your tutorial is shallow on launch template topic. You do know that slightest wrong in mandatory user data results in "instances failed to join cluster" yet you skipped it. Why user data? How about 99 max pods on t3.small?

[@suganthselvan]

Good content, but too fast making it less effective

[@pravinkhot8626]

Very fast

[@AntonPutra]

noted

[@cryptographbd1176]

Hi sir, This is really helpfull videos for me, I faces some issues here on route.tf file, when I press terraform apply then its shows this issues- 1. Error: Incorrect attribute value type │ │ on routes.tf line 4, in resource "aws_route_table" "private": │ 4: route = [ │ 5: { │ 6: cidr_block = "0.0.0.0/0" │ 7: nat_gateway_id = aws_nat_gateway.nat.id │ 8: carrier_gateway_id = "" 2. Inappropriate value for attribute "route": element 0: attribute "core_network_arn" is required 3. Error: Incorrect attribute value type │ │ on routes.tf line 30, in resource "aws_route_table" "public": │ 30: route = [ │ 31: { │ 32: cidr_block = "0.0.0.0/0" │ 33: gateway_id = aws_internet_gateway.igw.id │ 34: nat_gateway_id = "" │ 35: carrier_gateway_id = "" help me to solve this issues.

[@Randych]

Why? Because.