getKubeconfig

profileName

import * as aws from "@pulumi/aws";
import * as eks from "@pulumi/eks";
import * as pulumi from "@pulumi/pulumi";

import { ORG } from "./constants";
import {
  stack,
  defaultVpcSubnetsIds,
  defaultSecurityGroupId,
  defaultVpcId,
} from "./stackRef";
import * as config from "./config";

const securityGroup = aws.ec2.SecurityGroup.get(
  "default",
  defaultSecurityGroupId
);

const awsAccountId = aws
  .getCallerIdentity()
  .then((current) => current.accountId);

const eksMasterRole = new aws.iam.Role(`${ORG}-eks-${stack}-master-role`, {
  assumeRolePolicy: pulumi.interpolate`{
      "Version": "2012-10-17",
      "Statement":[
        {
          "Sid": "",
          "Effect": "Allow",
          "Principal": {
            "AWS": "arn:aws:iam::${awsAccountId}:root"
          },
          "Action": "sts:AssumeRole"
        }
      ]
     }
  `,
});

// TODO: Remove this line when deploying to AWS
if (stack == "dev") {
  process.env.AWS_PROFILE = "brainfish-dev"; // Make it compatible with local deployment
}
if (stack == "prod" || stack == "eu" || stack == "au") {
  process.env.AWS_PROFILE = "brainfish-prod"; // Make it compatible with local deployment
}

const cluster = new eks.Cluster(`${ORG}-${stack}`, {
  vpcId: defaultVpcId,
  subnetIds: defaultVpcSubnetsIds,
  deployDashboard: false,
  nodeGroupOptions: {
    minSize: config.EKS_MIN_WORKER_NODE_NUMBER,
    maxSize: config.EKS_MAX_WORKER_NODE_NUMBER,
    desiredCapacity: config.EKS_DESIRED_WORKER_NODE_NUMBER,
    nodeRootVolumeEncrypted: true,
    amiId: config.EKS_NODE_AMI_ID, // pin Amazon EKS-optimized Amazon Linux 2 AMI to avoid accidental nodes destruction
    nodeRootVolumeSize: 100, // 100GB, reasonable default
    extraNodeSecurityGroups: [securityGroup],
    instanceType: config.EKS_NODE_INSTANCE_TYPE,
    nodeRootVolumeType: config.EKS_NODE_ROOT_VOLUME_TYPE as
      | "standard"
      | "gp2"
      | "gp3"
      | "st1"
      | "sc1"
      | "io1",
  },
  roleMappings: [
    // Provides full administrator cluster access to the k8s cluster
    {
      groups: ["system:masters"],
      roleArn: eksMasterRole.arn,
      username: "pulumi:master-role-user", // not used but required
    },
  ],
});

if (stack == "prod" || stack == "dev" || stack == "eu" || stack == "au") {
  process.env.AWS_PROFILE = ""; // Reset the AWS_PROFILE
}

export const clusterKubeconfigOrigin = pulumi.secret(cluster.kubeconfig);

export const clusterKubeconfig = pulumi.secret(
  cluster.getKubeconfig({
    roleArn: eksMasterRole.arn,
  })
);

// This is the security group created by @pulumi/eks (Pulumi AWS Crosswalk) for the self-managed node groups; this is also added to the AWS EKS cluster's additional security groups field.
export const clusterNodeSecurityGroupId = cluster.nodeSecurityGroup.id;

// This is the security group that is created by AWS by default for all new EKS clusters. This is an EKS created security group that applied to ENI that is attached to EKS Control Plane master nodes, as well as any managed workloads.
export const clusterSecurityGroupId = cluster.clusterSecurityGroup.id;

getKubeconfig

profileName