EKS NodeGroup

Role

const nodeGroupRoleName = "eks-ng-role";
const nodeGroupRole = new aws.iam.Role(
  nodeGroupRoleName,
  {
    namePrefix: `${nodeGroupRoleName}-`,
    assumeRolePolicy: {
      Version: "2012-10-17",
      Statement: [
        {
          Action: "sts:AssumeRole",
          Effect: "Allow",
          Principal: {
            Service: "ec2.amazonaws.com",
          },
        },
      ],
    },
    tags: {
      Name: nodeGroupRoleName,
      "loliot.net/stack": variable.stackName,
    },
  },
  { protect: true }
);

const nodeGroupInstanceProfileName = "eks-ng-instacne-profile";
const nodeGroupInstanceProfile = new aws.iam.InstanceProfile(
  nodeGroupInstanceProfileName,
  {
    namePrefix: `${nodeGroupInstanceProfileName}-`,
    role: nodeGroupRole.name,
    tags: {
      Name: nodeGroupInstanceProfileName,
      "loliot.net/stack": variable.stackName,
    },
  },
  { protect: true }
);

const nodeGroupPolicyARNs = {
  "0": "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
  "1": "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly",
  "2": "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
  "3": "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore", // Karpenter
};

const nodeGroupRpas = Object.entries(nodeGroupPolicyARNs).map(
  ([i, arn]) =>
    new aws.iam.RolePolicyAttachment(
      `eks-ng-rpa-${i}`,
      {
        policyArn: arn,
        role: nodeGroupRole.name,
      },
      { protect: true }
    )
);

NodeGroup

const nodeGroupName = "eks-ng";
const nodeGroup = new aws.eks.NodeGroup(
  nodeGroupName,
  {
    nodeGroupNamePrefix: `${nodeGroupName}-`,
    clusterName: cluster.name,
    nodeRoleArn: nodeGroupRole.arn,
    instanceTypes: ["m6a.large"],
    diskSize: 30,
    scalingConfig: {
      minSize: 1,
      maxSize: 1,
      desiredSize: 1,
    },
    subnetIds: [vpc.privateSubnet1.id],
    labels: {
      "node-group": "eks-ng",
    },
    taints: [
      {
        key: "node-group",
        value: "eks-ng",
        effect: "NO_SCHEDULE",
      },
    ],
    tags: {
      Name: nodeGroupName,
      "loliot.net/stack": variable.stackName,
    },
  },
  { protect: true }
);