Permalink
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| AWSTemplateFormatVersion: "2010-09-09" | |
| Description: Deploys an EKS cluster in a new VPC (qs-1p7nknoht) | |
| Metadata: | |
| AutoInstance: | |
| NodeInstanceType: | |
| InstanceFilters: | |
| - [['PV'], "!=", "SupportedVirtualizationTypes"] | |
| QuickStartDocumentation: | |
| EntrypointName: "Launch into a new VPC" | |
| Order: Index a | |
| LintSpellExclude: | |
| - Kubernetes | |
| - ARNs | |
| - Resource Names | |
| - autoscaler | |
| - IOPS | |
| - EfsStorageClass | |
| - Lambda | |
| - maxIO | |
| - Resource Name | |
| - Enabled | |
| - Disabled | |
| - Prometheus | |
| - Encrypt | |
| - Fargate | |
| - namespace | |
| - Snyk | |
| - Security | |
| - New Relic | |
| - APN | |
| - '"No"' | |
| - Windows | |
| - '"Config ' | |
| - '(Optional)' | |
| - Unmanaged | |
| - Node | |
| - NewRelicIntegration | |
| - Integration | |
| - Auto Scaling | |
| - Partner | |
| - Vault | |
| - Consul | |
| - HashiCorp | |
| - CalicoIntegration | |
| - RafaySysIntegration | |
| - RafaySysProject | |
| - RafaySysBootstrapBucket | |
| - RafaySysBootstrapKey | |
| - RafaySysApiKey | |
| - RafaySysApiSecret | |
| - RafaySysFirstName | |
| - RafaySysLastName | |
| - RafaySysOrganizationName | |
| - RafaySysEmail | |
| - Rafay Systems | |
| - Rafay | |
| - Rancher | |
| - yaml | |
| - rafay | |
| - DomainName | |
| - Hosted | |
| - Domain Name | |
| - Domain name | |
| - Grafana | |
| AWS::CloudFormation::Interface: | |
| ParameterGroups: | |
| - Label: | |
| default: Basic configuration | |
| Parameters: | |
| - AvailabilityZones | |
| - RemoteAccessCIDR | |
| - KeyPairName | |
| - ConfigSetName | |
| - PerAccountSharedResources | |
| - PerRegionSharedResources | |
| - Label: | |
| default: VPC network configuration | |
| Parameters: | |
| - NumberOfAZs | |
| - VPCCIDR | |
| - PrivateSubnet1CIDR | |
| - PrivateSubnet2CIDR | |
| - PrivateSubnet3CIDR | |
| - PublicSubnet1CIDR | |
| - PublicSubnet2CIDR | |
| - PublicSubnet3CIDR | |
| - Label: | |
| default: Amazon EC2 configuration | |
| Parameters: | |
| - ProvisionBastionHost | |
| - Label: | |
| default: Amazon EKS configuration | |
| Parameters: | |
| - EKSClusterName | |
| - EKSPublicAccessEndpoint | |
| - AdditionalEKSAdminUserArn | |
| - AdditionalEKSAdminRoleArn | |
| - FargateNamespaces | |
| - FargateLabels | |
| - Label: | |
| default: Default EKS node group configuration | |
| Parameters: | |
| - NodeInstanceType | |
| - NumberOfNodes | |
| - MaxNumberOfNodes | |
| - NodeGroupOS | |
| - NodeGroupType | |
| - NodeInstanceFamily | |
| - Label: | |
| default: Snyk monitor (AWS Partner security) | |
| Parameters: | |
| - SnykIntegration | |
| - SnykIntegrationId | |
| - Label: | |
| default: New Relic infrastructure (AWS Partner monitoring) | |
| Parameters: | |
| - NewRelicIntegration | |
| - NewRelicLicenseKey | |
| - Label: | |
| default: Calico policy [APN security partner] | |
| Parameters: | |
| - CalicoIntegration | |
| - Label: | |
| default: Rafay Systems [APN software & internet partner] | |
| Parameters: | |
| - RafaySysIntegration | |
| - RafaySysProject | |
| - RafaySysBootstrapBucket | |
| - RafaySysBootstrapKey | |
| - RafaySysApiKey | |
| - RafaySysApiSecret | |
| - RafaySysFirstName | |
| - RafaySysLastName | |
| - RafaySysOrganizationName | |
| - RafaySysEmail | |
| - Label: | |
| default: HashiCorp Vault (AWS Partner security) | |
| Parameters: | |
| - VaultIntegration | |
| - VaultUIACMSSLCertificateArn | |
| - VaultUIHostedZoneID | |
| - VaultUIDomainName | |
| - Label: | |
| default: HashiCorp Consul (AWS Partner containers) | |
| Parameters: | |
| - ConsulIntegration | |
| - ConsulUIACMSSLCertificateArn | |
| - ConsulUIHostedZoneID | |
| - ConsulUIDomainName | |
| - Label: | |
| default: Rancher management (AWS Partner management) | |
| Parameters: | |
| - RancherIntegration | |
| - RancherDomainName | |
| - Label: | |
| default: Kubernetes add-ins | |
| Parameters: | |
| - ALBIngressController | |
| - ClusterAutoScaler | |
| - EfsStorageClass | |
| - PrometheusIntegration | |
| - GrafanaIntegration | |
| - MonitoringStack | |
| - Label: | |
| default: AWS Quick Start configuration | |
| Parameters: | |
| - QSS3BucketName | |
| - QSS3KeyPrefix | |
| - QSS3BucketRegion | |
| - TestSuite | |
| ParameterLabels: | |
| AvailabilityZones: | |
| default: Availability Zones | |
| KeyPairName: | |
| default: SSH key name | |
| PrivateSubnet1CIDR: | |
| default: Private subnet 1 CIDR | |
| PrivateSubnet2CIDR: | |
| default: Private subnet 2 CIDR | |
| PrivateSubnet3CIDR: | |
| default: Private subnet 3 CIDR | |
| PublicSubnet1CIDR: | |
| default: Public subnet 1 CIDR | |
| PublicSubnet2CIDR: | |
| default: Public subnet 2 CIDR | |
| PublicSubnet3CIDR: | |
| default: Public subnet 3 CIDR | |
| QSS3BucketName: | |
| default: Quick Start S3 bucket name | |
| QSS3KeyPrefix: | |
| default: Quick Start S3 key prefix | |
| QSS3BucketRegion: | |
| default: Quick Start S3 bucket Region | |
| RemoteAccessCIDR: | |
| default: Allowed external access CIDR | |
| VPCCIDR: | |
| default: VPC CIDR | |
| NodeInstanceType: | |
| default: Instance type | |
| NumberOfNodes: | |
| default: Number of nodes | |
| MaxNumberOfNodes: | |
| default: Maximum number of nodes | |
| AdditionalEKSAdminUserArn: | |
| default: Additional EKS admin ARN (IAM user) | |
| AdditionalEKSAdminRoleArn: | |
| default: Additional EKS admin ARN (IAM role) | |
| ClusterAutoScaler: | |
| default: Cluster autoscaler | |
| EfsStorageClass: | |
| default: EFS storage class | |
| MonitoringStack: | |
| default: Monitoring stack | |
| NumberOfAZs: | |
| default: Number of Availability Zones | |
| ProvisionBastionHost: | |
| default: Provision bastion host | |
| EKSPublicAccessEndpoint: | |
| default: EKS public access endpoint | |
| ALBIngressController: | |
| default: AWS load balancer controller | |
| FargateNamespaces: | |
| default: Fargate namespaces | |
| FargateLabels: | |
| default: Fargate labels | |
| EKSClusterName: | |
| default: EKS cluster name | |
| SnykIntegrationId: | |
| default: Integration ID | |
| SnykIntegration: | |
| default: Security monitoring integration | |
| NewRelicIntegration: | |
| default: Infrastructure monitoring integration | |
| NewRelicLicenseKey: | |
| default: License key | |
| CalicoIntegration: | |
| default: Calico policy integration | |
| RafaySysIntegration: | |
| default: Rafay Systems integration | |
| RafaySysProject: | |
| default: Rafay project | |
| RafaySysFirstName: | |
| default: First name | |
| RafaySysLastName: | |
| default: Last name | |
| RafaySysOrganizationName: | |
| default: Organization name | |
| RafaySysEmail: | |
| default: Email | |
| RafaySysApiKey: | |
| default: API key | |
| RafaySysApiSecret: | |
| default: API secret | |
| RafaySysBootstrapBucket: | |
| default: Bootstrap S3 bucket | |
| RafaySysBootstrapKey: | |
| default: Bootstrap S3 key | |
| PerAccountSharedResources: | |
| default: Per-account shared resources | |
| PerRegionSharedResources: | |
| default: Per-Region shared resources | |
| ConfigSetName: | |
| default: Config set name | |
| TestSuite: | |
| default: Test suite | |
| NodeGroupType: | |
| default: Node group type | |
| NodeInstanceFamily: | |
| default: Node instance family | |
| NodeGroupOS: | |
| default: Node group OS | |
| VaultIntegration: | |
| default: HashiCorp Vault integration | |
| VaultUIACMSSLCertificateArn: | |
| default: Vault UI ACM SSL certificate ARN | |
| VaultUIHostedZoneID: | |
| default: Route 53 hosted zone id | |
| VaultUIDomainName: | |
| default: Vault UI load balancer DNS name | |
| ConsulIntegration: | |
| default: HashiCorp Consul integration | |
| ConsulUIACMSSLCertificateArn: | |
| default: ACM SSL certificate ARN | |
| ConsulUIHostedZoneID: | |
| default: Route 53 hosted zone id | |
| ConsulUIDomainName: | |
| default: Consul UI load balancer DNS name | |
| RancherIntegration: | |
| default: Rancher management integration | |
| RancherDomainName: | |
| default: Rancher domain name | |
| PrometheusIntegration: | |
| default: Prometheus integration | |
| GrafanaIntegration: | |
| default: Grafana integration | |
| Parameters: | |
| AvailabilityZones: | |
| Description: List of Availability Zones to use for the subnets in the VPC. Three | |
| Availability Zones are used for this deployment. | |
| Type: List<AWS::EC2::AvailabilityZone::Name> | |
| KeyPairName: | |
| Description: Name of an existing key pair, which allows you | |
| to securely connect to your instance after it launches. | |
| Type: String | |
| Default: "" | |
| PrivateSubnet1CIDR: | |
| AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$ | |
| ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16–28 | |
| Default: 10.0.0.0/19 | |
| Description: CIDR block for private subnet 1, located in Availability Zone 1. | |
| Type: String | |
| PrivateSubnet2CIDR: | |
| AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$ | |
| ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16–28 | |
| Default: 10.0.32.0/19 | |
| Description: CIDR block for private subnet 2, located in Availability Zone 2. | |
| Type: String | |
| PrivateSubnet3CIDR: | |
| AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$ | |
| ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16–28 | |
| Default: 10.0.64.0/19 | |
| Description: CIDR block for private subnet 3, located in Availability Zone 3. | |
| Type: String | |
| PublicSubnet1CIDR: | |
| AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$ | |
| ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16–28 | |
| Default: 10.0.128.0/20 | |
| Description: CIDR block for the public (DMZ) subnet 1, located in Availability | |
| Zone 1. | |
| Type: String | |
| PublicSubnet2CIDR: | |
| AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$ | |
| ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16–28 | |
| Default: 10.0.144.0/20 | |
| Description: CIDR block for the public (DMZ) subnet 2, located in Availability | |
| Zone 2. | |
| Type: String | |
| PublicSubnet3CIDR: | |
| AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$ | |
| ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16–28 | |
| Default: 10.0.160.0/20 | |
| Description: CIDR block for the public (DMZ) subnet 3, located in Availability | |
| Zone 3. | |
| Type: String | |
| QSS3BucketName: | |
| AllowedPattern: ^[0-9a-zA-Z]+([0-9a-zA-Z-]*[0-9a-zA-Z])*$ | |
| ConstraintDescription: Quick Start bucket name can include numbers, lowercase | |
| letters, uppercase letters, and hyphens (-). It cannot start or end with a hyphen | |
| (-). | |
| Default: aws-quickstart | |
| Description: S3 bucket name for the Quick Start assets. This string can include | |
| numbers, lowercase letters, uppercase letters, and hyphens (-). It cannot start | |
| or end with a hyphen (-). | |
| Type: String | |
| QSS3KeyPrefix: | |
| AllowedPattern: ^[0-9a-zA-Z-/.]*$ | |
| ConstraintDescription: Quick Start key prefix can include numbers, lowercase letters, | |
| uppercase letters, hyphens (-), periods (.) and forward slash (/). | |
| Default: quickstart-amazon-eks/ | |
| Description: S3 key prefix for the Quick Start assets. Quick Start key prefix | |
| can include numbers, lowercase letters, uppercase letters, hyphens (-), periods (.) and | |
| forward slash (/). | |
| Type: String | |
| QSS3BucketRegion: | |
| Default: 'us-east-1' | |
| Description: Region where the Quick Start S3 bucket (QSS3BucketName) is | |
| hosted. When using your own bucket, you must specify this value. | |
| Type: String | |
| RemoteAccessCIDR: | |
| AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/([0-9]|[1-2][0-9]|3[0-2]))$ | |
| ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/x | |
| Description: CIDR IP range that is permitted to access the instances. We recommend | |
| that you set this value to a trusted IP range. | |
| Type: String | |
| EKSPublicAccessEndpoint: | |
| Type: String | |
| AllowedValues: [Enabled, Disabled] | |
| Default: Disabled | |
| Description: Configure access to the Kubernetes API server endpoint from outside of your VPC. | |
| VPCCIDR: | |
| AllowedPattern: ^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])(\/(1[6-9]|2[0-8]))$ | |
| ConstraintDescription: CIDR block parameter must be in the form x.x.x.x/16–28 | |
| Default: 10.0.0.0/16 | |
| Description: CIDR block for the VPC. | |
| Type: String | |
| AdditionalEKSAdminUserArn: | |
| Default: "" | |
| AllowedPattern: '^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:.*|^$' | |
| Description: "(Optional) IAM user ARN to be granted administrative access to the EKS cluster." | |
| Type: String | |
| AdditionalEKSAdminRoleArn: | |
| Default: "" | |
| AllowedPattern: '^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:.*|^$' | |
| Description: "(Optional) IAM role ARN to be granted administrative access to the EKS cluster." | |
| Type: String | |
| NodeInstanceType: | |
| Default: t3.medium | |
| AllowedValues: | |
| - a1.medium | |
| - a1.large | |
| - a1.xlarge | |
| - a1.2xlarge | |
| - a1.4xlarge | |
| - a1.metal | |
| - c1.medium | |
| - c1.xlarge | |
| - c3.large | |
| - c3.xlarge | |
| - c3.2xlarge | |
| - c3.4xlarge | |
| - c3.8xlarge | |
| - c4.large | |
| - c4.xlarge | |
| - c4.2xlarge | |
| - c4.4xlarge | |
| - c4.8xlarge | |
| - c5.large | |
| - c5.xlarge | |
| - c5.2xlarge | |
| - c5.4xlarge | |
| - c5.9xlarge | |
| - c5.12xlarge | |
| - c5.18xlarge | |
| - c5.24xlarge | |
| - c5.metal | |
| - c5a.large | |
| - c5a.xlarge | |
| - c5a.2xlarge | |
| - c5a.4xlarge | |
| - c5a.8xlarge | |
| - c5a.12xlarge | |
| - c5a.16xlarge | |
| - c5a.24xlarge | |
| - c5ad.large | |
| - c5ad.xlarge | |
| - c5ad.2xlarge | |
| - c5ad.4xlarge | |
| - c5ad.8xlarge | |
| - c5ad.12xlarge | |
| - c5ad.16xlarge | |
| - c5ad.24xlarge | |
| - c5d.large | |
| - c5d.xlarge | |
| - c5d.2xlarge | |
| - c5d.4xlarge | |
| - c5d.9xlarge | |
| - c5d.12xlarge | |
| - c5d.18xlarge | |
| - c5d.24xlarge | |
| - c5d.metal | |
| - c5n.large | |
| - c5n.xlarge | |
| - c5n.2xlarge | |
| - c5n.4xlarge | |
| - c5n.9xlarge | |
| - c5n.18xlarge | |
| - c5n.metal | |
| - c6a.large | |
| - c6a.xlarge | |
| - c6a.2xlarge | |
| - c6a.4xlarge | |
| - c6a.8xlarge | |
| - c6a.12xlarge | |
| - c6a.16xlarge | |
| - c6a.24xlarge | |
| - c6a.32xlarge | |
| - c6a.48xlarge | |
| - c6a.metal | |
| - c6g.medium | |
| - c6g.large | |
| - c6g.xlarge | |
| - c6g.2xlarge | |
| - c6g.4xlarge | |
| - c6g.8xlarge | |
| - c6g.12xlarge | |
| - c6g.16xlarge | |
| - c6g.metal | |
| - c6gd.medium | |
| - c6gd.large | |
| - c6gd.xlarge | |
| - c6gd.2xlarge | |
| - c6gd.4xlarge | |
| - c6gd.8xlarge | |
| - c6gd.12xlarge | |
| - c6gd.16xlarge | |
| - c6gd.metal | |
| - c6gn.medium | |
| - c6gn.large | |
| - c6gn.xlarge | |
| - c6gn.2xlarge | |
| - c6gn.4xlarge | |
| - c6gn.8xlarge | |
| - c6gn.12xlarge | |
| - c6gn.16xlarge | |
| - c6gn.metal | |
| - c7g.medium | |
| - c7g.large | |
| - c7g.xlarge | |
| - c7g.2xlarge | |
| - c7g.4xlarge | |
| - c7g.8xlarge | |
| - c7g.12xlarge | |
| - c7g.16xlarge | |
| - c6i.large | |
| - c6i.xlarge | |
| - c6i.2xlarge | |
| - c6i.4xlarge | |
| - c6i.8xlarge | |
| - c6i.12xlarge | |
| - c6i.16xlarge | |
| - c6i.24xlarge | |
| - c6i.32xlarge | |
| - c6i.metal | |
| - c6id.medium | |
| - c6id.large | |
| - c6id.xlarge | |
| - c6id.2xlarge | |
| - c6id.4xlarge | |
| - c6id.8xlarge | |
| - c6id.12xlarge | |
| - c6id.16xlarge | |
| - c6id.24xlarge | |
| - c6id.32xlarge | |
| - c6id.metal | |
| - cc2.8xlarge | |
| - d2.xlarge | |
| - d2.2xlarge | |
| - d2.4xlarge | |
| - d2.8xlarge | |
| - d3.xlarge | |
| - d3.2xlarge | |
| - d3.4xlarge | |
| - d3.8xlarge | |
| - d3en.xlarge | |
| - d3en.2xlarge | |
| - d3en.4xlarge | |
| - d3en.6xlarge | |
| - d3en.8xlarge | |
| - d3en.12xlarge | |
| - f1.2xlarge | |
| - f1.4xlarge | |
| - f1.16xlarge | |
| - g2.2xlarge | |
| - g2.8xlarge | |
| - g3.4xlarge | |
| - g3.8xlarge | |
| - g3.16xlarge | |
| - g3s.xlarge | |
| - g4ad.xlarge | |
| - g4ad.2xlarge | |
| - g4ad.4xlarge | |
| - g4ad.8xlarge | |
| - g4ad.12xlarge | |
| - g4ad.16xlarge | |
| - g4ad.metal | |
| - g4dn.xlarge | |
| - g4dn.2xlarge | |
| - g4dn.4xlarge | |
| - g4dn.8xlarge | |
| - g4dn.12xlarge | |
| - g4dn.16xlarge | |
| - g4dn.metal | |
| - g5.xlarge | |
| - g5.2xlarge | |
| - g5.4xlarge | |
| - g5.8xlarge | |
| - g5.12xlarge | |
| - g5.16xlarge | |
| - g5.24xlarge | |
| - g5.48xlarge | |
| - g5g.xlarge | |
| - g5g.2xlarge | |
| - g5g.4xlarge | |
| - g5g.8xlarge | |
| - g5g.16xlarge | |
| - g5g.metal | |
| - h1.2xlarge | |
| - h1.4xlarge | |
| - h1.8xlarge | |
| - h1.16xlarge | |
| - i2.xlarge | |
| - i2.2xlarge | |
| - i2.4xlarge | |
| - i2.8xlarge | |
| - i3.large | |
| - i3.xlarge | |
| - i3.2xlarge | |
| - i3.4xlarge | |
| - i3.8xlarge | |
| - i3.16xlarge | |
| - i3.metal | |
| - i3en.large | |
| - i3en.xlarge | |
| - i3en.2xlarge | |
| - i3en.3xlarge | |
| - i3en.6xlarge | |
| - i3en.12xlarge | |
| - i3en.24xlarge | |
| - i3en.metal | |
| - i4i.large | |
| - i4i.xlarge | |
| - i4i.2xlarge | |
| - i4i.4xlarge | |
| - i4i.8xlarge | |
| - i4i.16xlarge | |
| - i4i.32xlarge | |
| - i4i.metal | |
| - im4gn.large | |
| - im4gn.xlarge | |
| - im4gn.2xlarge | |
| - im4gn.4xlarge | |
| - im4gn.8xlarge | |
| - im4gn.16xlarge | |
| - inf1.xlarge | |
| - inf1.2xlarge | |
| - inf1.6xlarge | |
| - inf1.24xlarge | |
| - is4gen.medium | |
| - is4gen.large | |
| - is4gen.xlarge | |
| - is4gen.2xlarge | |
| - is4gen.4xlarge | |
| - is4gen.8xlarge | |
| - m1.small | |
| - m1.medium | |
| - m1.large | |
| - m1.xlarge | |
| - m2.xlarge | |
| - m2.2xlarge | |
| - m2.4xlarge | |
| - m3.medium | |
| - m3.large | |
| - m3.xlarge | |
| - m3.2xlarge | |
| - m4.large | |
| - m4.xlarge | |
| - m4.2xlarge | |
| - m4.4xlarge | |
| - m4.10xlarge | |
| - m4.16xlarge | |
| - m5.large | |
| - m5.xlarge | |
| - m5.2xlarge | |
| - m5.4xlarge | |
| - m5.8xlarge | |
| - m5.12xlarge | |
| - m5.16xlarge | |
| - m5.24xlarge | |
| - m5.metal | |
| - m5a.large | |
| - m5a.xlarge | |
| - m5a.2xlarge | |
| - m5a.4xlarge | |
| - m5a.8xlarge | |
| - m5a.12xlarge | |
| - m5a.16xlarge | |
| - m5a.24xlarge | |
| - m5ad.large | |
| - m5ad.xlarge | |
| - m5ad.2xlarge | |
| - m5ad.4xlarge | |
| - m5ad.8xlarge | |
| - m5ad.12xlarge | |
| - m5ad.16xlarge | |
| - m5ad.24xlarge | |
| - m5d.large | |
| - m5d.xlarge | |
| - m5d.2xlarge | |
| - m5d.4xlarge | |
| - m5d.8xlarge | |
| - m5d.12xlarge | |
| - m5d.16xlarge | |
| - m5d.24xlarge | |
| - m5d.metal | |
| - m5dn.large | |
| - m5dn.xlarge | |
| - m5dn.2xlarge | |
| - m5dn.4xlarge | |
| - m5dn.8xlarge | |
| - m5dn.12xlarge | |
| - m5dn.16xlarge | |
| - m5dn.24xlarge | |
| - m5dn.metal | |
| - m5n.large | |
| - m5n.xlarge | |
| - m5n.2xlarge | |
| - m5n.4xlarge | |
| - m5n.8xlarge | |
| - m5n.12xlarge | |
| - m5n.16xlarge | |
| - m5n.24xlarge | |
| - m5n.metal | |
| - m5zn.large | |
| - m5zn.xlarge | |
| - m5zn.2xlarge | |
| - m5zn.4xlarge | |
| - m5zn.8xlarge | |
| - m5zn.12xlarge | |
| - m5zn.16xlarge | |
| - m5zn.24xlarge | |
| - m5zn.metal | |
| - m6a.large | |
| - m6a.xlarge | |
| - m6a.2xlarge | |
| - m6a.4xlarge | |
| - m6a.8xlarge | |
| - m6a.12xlarge | |
| - m6a.16xlarge | |
| - m6a.24xlarge | |
| - m6a.32xlarge | |
| - m6a.48xlarge | |
| - m6a.metal | |
| - m6g.medium | |
| - m6g.large | |
| - m6g.xlarge | |
| - m6g.2xlarge | |
| - m6g.4xlarge | |
| - m6g.8xlarge | |
| - m6g.12xlarge | |
| - m6g.16xlarge | |
| - m6g.metal | |
| - m6gd.medium | |
| - m6gd.large | |
| - m6gd.xlarge | |
| - m6gd.2xlarge | |
| - m6gd.4xlarge | |
| - m6gd.8xlarge | |
| - m6gd.12xlarge | |
| - m6gd.16xlarge | |
| - m6gd.metal | |
| - m6i.large | |
| - m6i.xlarge | |
| - m6i.2xlarge | |
| - m6i.4xlarge | |
| - m6i.8xlarge | |
| - m6i.12xlarge | |
| - m6i.16xlarge | |
| - m6i.24xlarge | |
| - m6i.32xlarge | |
| - m6i.metal | |
| - m6id.large | |
| - m6id.xlarge | |
| - m6id.2xlarge | |
| - m6id.4xlarge | |
| - m6id.8xlarge | |
| - m6id.12xlarge | |
| - m6id.16xlarge | |
| - m6id.24xlarge | |
| - m6id.32xlarge | |
| - m6id.metal | |
| - p2.xlarge | |
| - p2.8xlarge | |
| - p2.16xlarge | |
| - p3.2xlarge | |
| - p3.8xlarge | |
| - p3.16xlarge | |
| - p3dn.24xlarge | |
| - p4d.24xlarge | |
| - r3.large | |
| - r3.xlarge | |
| - r3.2xlarge | |
| - r3.4xlarge | |
| - r3.8xlarge | |
| - r4.large | |
| - r4.xlarge | |
| - r4.2xlarge | |
| - r4.4xlarge | |
| - r4.8xlarge | |
| - r4.16xlarge | |
| - r5.large | |
| - r5.xlarge | |
| - r5.2xlarge | |
| - r5.4xlarge | |
| - r5.8xlarge | |
| - r5.12xlarge | |
| - r5.16xlarge | |
| - r5.24xlarge | |
| - r5.metal | |
| - r5a.large | |
| - r5a.xlarge | |
| - r5a.2xlarge | |
| - r5a.4xlarge | |
| - r5a.8xlarge | |
| - r5a.12xlarge | |
| - r5a.16xlarge | |
| - r5a.24xlarge | |
| - r5ad.large | |
| - r5ad.xlarge | |
| - r5ad.2xlarge | |
| - r5ad.4xlarge | |
| - r5ad.8xlarge | |
| - r5ad.12xlarge | |
| - r5ad.16xlarge | |
| - r5ad.24xlarge | |
| - r5b.large | |
| - r5b.xlarge | |
| - r5b.2xlarge | |
| - r5b.4xlarge | |
| - r5b.8xlarge | |
| - r5b.12xlarge | |
| - r5b.16xlarge | |
| - r5b.24xlarge | |
| - r5b.metal | |
| - r5d.large | |
| - r5d.xlarge | |
| - r5d.2xlarge | |
| - r5d.4xlarge | |
| - r5d.8xlarge | |
| - r5d.12xlarge | |
| - r5d.16xlarge | |
| - r5d.24xlarge | |
| - r5d.metal | |
| - r5dn.large | |
| - r5dn.xlarge | |
| - r5dn.2xlarge | |
| - r5dn.4xlarge | |
| - r5dn.8xlarge | |
| - r5dn.12xlarge | |
| - r5dn.16xlarge | |
| - r5dn.24xlarge | |
| - r5dn.metal | |
| - r5n.large | |
| - r5n.xlarge | |
| - r5n.2xlarge | |
| - r5n.4xlarge | |
| - r5n.8xlarge | |
| - r5n.12xlarge | |
| - r5n.16xlarge | |
| - r5n.24xlarge | |
| - r5n.metal | |
| - r6g.medium | |
| - r6g.large | |
| - r6g.xlarge | |
| - r6g.2xlarge | |
| - r6g.4xlarge | |
| - r6g.8xlarge | |
| - r6g.12xlarge | |
| - r6g.16xlarge | |
| - r6g.metal | |
| - r6gd.medium | |
| - r6gd.large | |
| - r6gd.xlarge | |
| - r6gd.2xlarge | |
| - r6gd.4xlarge | |
| - r6gd.8xlarge | |
| - r6gd.12xlarge | |
| - r6gd.16xlarge | |
| - r6gd.metal | |
| - r6i.large | |
| - r6i.xlarge | |
| - r6i.2xlarge | |
| - r6i.4xlarge | |
| - r6i.8xlarge | |
| - r6i.12xlarge | |
| - r6i.16xlarge | |
| - r6i.24xlarge | |
| - r6i.32xlarge | |
| - r6i.metal | |
| - r6id.large | |
| - r6id.xlarge | |
| - r6id.2xlarge | |
| - r6id.4xlarge | |
| - r6id.8xlarge | |
| - r6id.12xlarge | |
| - r6id.16xlarge | |
| - r6id.24xlarge | |
| - r6id.32xlarge | |
| - r6id.metal | |
| - t1.micro | |
| - t2.nano | |
| - t2.micro | |
| - t2.small | |
| - t2.medium | |
| - t2.large | |
| - t2.xlarge | |
| - t2.2xlarge | |
| - t3.nano | |
| - t3.micro | |
| - t3.small | |
| - t3.medium | |
| - t3.large | |
| - t3.xlarge | |
| - t3.2xlarge | |
| - t3a.nano | |
| - t3a.micro | |
| - t3a.small | |
| - t3a.medium | |
| - t3a.large | |
| - t3a.xlarge | |
| - t3a.2xlarge | |
| - t4g.nano | |
| - t4g.micro | |
| - t4g.small | |
| - t4g.medium | |
| - t4g.large | |
| - t4g.xlarge | |
| - t4g.2xlarge | |
| - x1.16xlarge | |
| - x1.32xlarge | |
| - x1e.xlarge | |
| - x1e.2xlarge | |
| - x1e.4xlarge | |
| - x1e.8xlarge | |
| - x1e.16xlarge | |
| - x1e.32xlarge | |
| - x2gd.medium | |
| - x2gd.large | |
| - x2gd.xlarge | |
| - x2gd.2xlarge | |
| - x2gd.4xlarge | |
| - x2gd.8xlarge | |
| - x2gd.12xlarge | |
| - x2gd.16xlarge | |
| - x2gd.metal | |
| - x2idn.16xlarge | |
| - x2idn.24xlarge | |
| - x2idn.32xlarge | |
| - x2idn.metal | |
| - x2iedn.xlarge | |
| - x2iedn.2xlarge | |
| - x2iedn.4xlarge | |
| - x2iedn.8xlarge | |
| - x2iedn.16xlarge | |
| - x2iedn.24xlarge | |
| - x2iedn.32xlarge | |
| - x2iedn.metal | |
| - x2iezn.2xlarge | |
| - x2iezn.4xlarge | |
| - x2iezn.6xlarge | |
| - x2iezn.8xlarge | |
| - x2iezn.12xlarge | |
| - x2iezn.metal | |
| - z1d.large | |
| - z1d.xlarge | |
| - z1d.2xlarge | |
| - z1d.3xlarge | |
| - z1d.6xlarge | |
| - z1d.12xlarge | |
| - z1d.metal | |
| ConstraintDescription: Must be a valid EC2 instance type | |
| Description: EC2 instance type. | |
| Type: String | |
| NumberOfNodes: | |
| Default: 3 | |
| MinValue: 0 | |
| MaxValue: 450 | |
| Description: Number of Amazon EKS node instances. The default is one for each of the three Availability Zones. | |
| Type: Number | |
| MaxNumberOfNodes: | |
| Default: 3 | |
| MinValue: 0 | |
| MaxValue: 450 | |
| Description: Maximum number of Amazon EKS node instances. The default is three. | |
| Type: Number | |
| ClusterAutoScaler: | |
| Type: String | |
| AllowedValues: [ Enabled, Disabled ] | |
| Default: Disabled | |
| Description: 'Choose "Enabled" to enable Kubernetes cluster autoscaler.' | |
| EfsStorageClass: | |
| Type: String | |
| AllowedValues: [ Enabled, Disabled ] | |
| Default: Disabled | |
| Description: 'Choose "Enabled" to enable EFS storage class.' | |
| MonitoringStack: | |
| Type: String | |
| AllowedValues: [ "Prometheus + Grafana", "None" ] | |
| Default: "None" | |
| Description: 'Enable monitoring stack with "Prometheus+Grafana." Warning: this is a legacy parameter and will be dropped from the next version of this Quick Start. Please use the "Grafana integration" and "Prometheus integration" parameters instead.' | |
| GrafanaIntegration: | |
| Type: String | |
| AllowedValues: [ Enabled, Disabled ] | |
| Default: Disabled | |
| Description: 'Grafana requires "Prometheus integration" to be enabled. For more information see https://www.grafana.com/ .' | |
| PrometheusIntegration: | |
| Type: String | |
| AllowedValues: [ Enabled, Disabled ] | |
| Default: Disabled | |
| Description: 'For more information see https://prometheus.io/ .' | |
| NumberOfAZs: | |
| Type: String | |
| AllowedValues: ["2", "3"] | |
| Default: "3" | |
| Description: Number of Availability Zones to use in the VPC. This must match the value entered for the AvailabilityZones parameter. | |
| ProvisionBastionHost: | |
| Type: String | |
| AllowedValues: [ "Enabled", "Disabled" ] | |
| Default: "Enabled" | |
| Description: Skip creating a bastion host by choosing "Disabled." | |
| # This parameter name is inaccurate to preserve backward compatibility, and will be changed to ALBIngressController in the next release | |
| ALBIngressController: | |
| Type: String | |
| AllowedValues: [ "Enabled", "Disabled" ] | |
| Default: "Enabled" | |
| Description: Choose "Disabled" to skip deploying the AWS load balancer controller. | |
| FargateNamespaces: | |
| Type: String | |
| Default: "" | |
| Description: "(Optional) Comma-separated list of namespaces for which Fargate should be enabled." | |
| FargateLabels: | |
| Type: String | |
| Default: "" | |
| Description: >- | |
| Requires at least one Fargate namespace to be specified. This is a comma-separated list of key-value pod labels. | |
| For a pod to run on Fargate, all of the labels must match, and it must run in a namespace defined by | |
| "Fargate namespaces." | |
| EKSClusterName: | |
| Type: String | |
| Default: "" | |
| Description: "(Optional) Name for the EKS cluster. If left blank, one is auto-generated. This must be unique within the Region." | |
| SnykIntegrationId: | |
| Type: String | |
| AllowedPattern: '^[a-z0-9-]{36}$|^$' | |
| Default: "" | |
| Description: 'If the SnykIntegration parameter is set to "Enabled," a value must be provided. For more information, see https://support.snyk.io/hc/en-us/articles/360003916158-Install-the-Snyk-controller-with-Helm.' | |
| SnykIntegration: | |
| Type: String | |
| AllowedValues: [Enabled, Disabled] | |
| Default: Disabled | |
| Description: "For more information, see https://github.com/aws-quickstart/quickstart-eks-snyk/." | |
| NewRelicLicenseKey: | |
| Type: String | |
| Default: "" | |
| NoEcho: true | |
| Description: 'If the NewRelicIntegration parameter is set to "Enabled," a value must be provided. For more information see https://docs.newrelic.com/docs/accounts/install-new-relic/account-setup/license-key/.' | |
| NewRelicIntegration: | |
| Type: String | |
| AllowedValues: [Enabled, Disabled] | |
| Default: Disabled | |
| Description: For more information, see https://github.com/aws-quickstart/quickstart-eks-newrelic-infrastructure/." | |
| CalicoIntegration: | |
| Type: String | |
| AllowedValues: [ Enabled, Disabled ] | |
| Default: Disabled | |
| Description: "For more information see https://www.projectcalico.org/ ." | |
| RafaySysIntegration: | |
| Type: String | |
| AllowedValues: [ Enabled, Disabled ] | |
| Default: Disabled | |
| Description: "For more information see https://aws-quickstart.github.io/quickstart-eks-rafay-systems/ ." | |
| RafaySysProject: | |
| Type: String | |
| Description: "This is the name you want to use for you Rafay deployment." | |
| Default: "defaultproject" | |
| RafaySysBootstrapBucket: | |
| Type: String | |
| Description: "(Optional) S3 bucket to place the the Rafay bootstrap yaml file. If left blank the EKS Quick Start bucket will be used." | |
| Default: "" | |
| RafaySysBootstrapKey: | |
| Type: String | |
| Description: "(Optional) S3 key to place the the Rafay bootstrap yaml file. If left blank the key will be rafay/<CLUSTER_NAME>/cluster-bootstrap.yaml." | |
| Default: "" | |
| RafaySysApiKey: | |
| Type: String | |
| Description: Required if using an existing Rafay account. | |
| Default: "" | |
| RafaySysApiSecret: | |
| Type: String | |
| Description: Required if using an existing Rafay account. | |
| Default: "" | |
| NoEcho: true | |
| RafaySysFirstName: | |
| Type: String | |
| Description: Required if registering a new Rafay account. | |
| Default: "" | |
| RafaySysLastName: | |
| Type: String | |
| Description: Required if registering a new Rafay account. | |
| Default: "" | |
| RafaySysOrganizationName: | |
| Type: String | |
| Description: Required if registering a new Rafay account. | |
| Default: "" | |
| RafaySysEmail: | |
| Type: String | |
| Description: Required if registering a new Rafay account. | |
| Default: "" | |
| PerAccountSharedResources: | |
| Type: String | |
| AllowedValues: ['AutoDetect', 'Yes', 'No'] | |
| Default: 'AutoDetect' | |
| Description: Choose "No" if you already deployed another EKS Quick Start stack in your AWS account. | |
| PerRegionSharedResources: | |
| Type: String | |
| AllowedValues: ['AutoDetect', 'Yes', 'No'] | |
| Default: 'AutoDetect' | |
| Description: Choose "No" if you already deployed another EKS Quick Start stack in your Region. | |
| ConfigSetName: | |
| Type: String | |
| Default: "" | |
| Description: >- | |
| (Optional) Name used to map advanced parameters to an EKS cluster. If you launched an advanced | |
| configuration stack and want to apply its values to this cluster, this name must match the ConfigSetName parameter | |
| for the stack. If left blank, a new config set is created using default values. | |
| TestSuite: | |
| Type: String | |
| AllowedValues: [Enabled, Disabled] | |
| Default: Disabled | |
| Description: Deploys a test stack that tests Quick Start components. | |
| NodeInstanceFamily: | |
| Default: Standard | |
| AllowedValues: ['Standard', 'ARM', 'GPU'] | |
| Type: String | |
| Description: Choose the instance family to match the value of "Node instance type." | |
| NodeGroupType: | |
| Type: String | |
| AllowedValues: [ Managed, Unmanaged ] | |
| Default: Managed | |
| Description: Choose "Unmanaged" to create an Auto Scaling group without using the EKS-managed node groups feature. | |
| NodeGroupOS: | |
| AllowedValues: | |
| - 'Amazon Linux 2' | |
| - 'Bottlerocket' | |
| - 'Windows' | |
| Default: 'Amazon Linux 2' | |
| Description: Operating system to use for node instances. Choose "Bottlerocket" for the Amazon purpose-built container OS | |
| (unmanaged node groups only). Note that if you choose "Windows," an additional Amazon Linux node group is created. | |
| Type: String | |
| VaultIntegration: | |
| Type: String | |
| AllowedValues: [Enabled, Disabled] | |
| Default: Disabled | |
| Description: "For more information, see https://github.com/aws-quickstart/quickstart-eks-hashicorp-vault/." | |
| VaultUIDomainName: | |
| Type: String | |
| Description: >- | |
| Fully qualified DNS name for the vault-ui service load balancer. | |
| If you don't provide a value for "ACM SSL certificate ARN", use the HostedZoneID. | |
| MaxLength: 128 | |
| Default: "" | |
| VaultUIHostedZoneID: | |
| Type: String | |
| Description: >- | |
| Route 53-hosted zone ID of the domain name. If you don't provide an ACMSSLCertificateArn value, the Quick Start | |
| creates an ACM certificate for you using HostedZoneID in conjunction with DomainName. | |
| Default: "" | |
| VaultUIACMSSLCertificateArn: | |
| Description: >- | |
| ARN of the load balancer's ACM SSL certificate. If you don't provide values for "Domain name" and | |
| "Hosted zone id", provide a value for "ACM SSL certificate ARN". | |
| Type: String | |
| AllowedPattern: '^arn:(aws|aws-cn|aws-us-gov):acm:.*:[0-9]{12}:certificate.*|^$' | |
| Default: "" | |
| ConsulIntegration: | |
| Type: String | |
| AllowedValues: [Enabled, Disabled] | |
| Default: Disabled | |
| Description: "For more information, see https://github.com/aws-quickstart/quickstart-eks-hashicorp-consul/." | |
| ConsulUIDomainName: | |
| Type: String | |
| Description: >- | |
| Fully qualified DNS name for the consul-ui service load balancer. | |
| If you don't provide a value for "ACM SSL certificate ARN", use the HostedZoneID. | |
| MaxLength: 128 | |
| Default: "" | |
| ConsulUIHostedZoneID: | |
| Type: String | |
| Description: >- | |
| Route 53-hosted zone ID of the domain name. If you don't provide an ACMSSLCertificateArn value, the Quick Start | |
| creates an ACM certificate for you using HostedZoneID in conjunction with DomainName. | |
| Default: "" | |
| ConsulUIACMSSLCertificateArn: | |
| Description: >- | |
| ARN of the load balancer's ACM SSL certificate. If you don't provide values for "Domain name" and | |
| "Hosted zone id", provide a value for "ACM SSL certificate ARN". | |
| Type: String | |
| AllowedPattern: '^arn:(aws|aws-cn|aws-us-gov):acm:.*:[0-9]{12}:certificate.*|^$' | |
| Default: "" | |
| RancherIntegration: | |
| Type: String | |
| AllowedValues: [Enabled, Disabled] | |
| Default: Disabled | |
| Description: "For more information, see https://github.com/aws-quickstart/quickstart-eks-rancher/." | |
| RancherDomainName: | |
| Description: DNS domain name that users can use to access the Rancher console. | |
| Type: String | |
| Default: aws.private | |
| Conditions: | |
| EnablePrometheus: !Or | |
| - !Equals [!Ref PrometheusIntegration, "Enabled"] | |
| - !Equals [!Ref MonitoringStack, "Prometheus + Grafana"] | |
| EnableGrafana: !Or | |
| - !Equals [!Ref GrafanaIntegration, "Enabled"] | |
| - !Equals [!Ref MonitoringStack, "Prometheus + Grafana"] | |
| DetectSharedStacks: !And | |
| - !Equals [!Ref PerAccountSharedResources, 'AutoDetect'] | |
| - !Equals [!Ref PerRegionSharedResources, 'AutoDetect'] | |
| CreateAdvancedConfigWithDefaults: !Equals [!Ref ConfigSetName, ''] | |
| CreatePerAccountSharedResources: !Equals [!Ref PerAccountSharedResources, 'Yes'] | |
| CreatePerRegionSharedResources: !Equals [!Ref PerRegionSharedResources, 'Yes'] | |
| 3AZDeployment: !Equals [!Ref NumberOfAZs, "3"] | |
| 2AZDeployment: !Or | |
| - !Equals [!Ref NumberOfAZs, "2"] | |
| - !Equals [!Ref NumberOfAZs, "3"] | |
| UsingDefaultBucket: !Equals [!Ref QSS3BucketName, 'aws-quickstart'] | |
| WindowsNodes: !Equals [!Ref NodeGroupOS, 'Windows'] | |
| VaultEnabled: !Equals [!Ref VaultIntegration, 'Enabled'] | |
| Mappings: | |
| Config: | |
| Prefix: { Value: 'eks-quickstart' } | |
| Resources: | |
| AdvancedConfigDefaultsStack: | |
| Type: AWS::CloudFormation::Stack | |
| Condition: CreateAdvancedConfigWithDefaults | |
| Metadata: { cfn-lint: { config: { ignore_checks: [E9902, W9901] } } } | |
| Properties: | |
| TemplateURL: !Sub | |
| - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}templates/amazon-eks-advanced-configuration.template.yaml' | |
| - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion] | |
| S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName] | |
| Parameters: | |
| ConfigSetName: !Ref AWS::StackName | |
| NodeVolumeSize: !If [WindowsNodes, 50, !Ref 'AWS::NoValue'] | |
| # As of 08/03/2021 there are no eks optimized ami's for eks 1.21 | |
| # TODO: remove forcing windows clusters to 1.20 once ami's are available https://github.com/aws/containers-roadmap/issues/1461 | |
| KubernetesVersion: !If [VaultEnabled, '1.17', !If [WindowsNodes, '1.20', !Ref 'AWS::NoValue']] | |
| ConsulUIAccessCIDR: !Ref RemoteAccessCIDR | |
| VaultUIAccessCIDR: !Ref RemoteAccessCIDR | |
| AutoDetectSharedResources: | |
| Type: AWS::CloudFormation::Stack | |
| Condition: DetectSharedStacks | |
| Properties: | |
| TemplateURL: !Sub | |
| - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}templates/amazon-eks-prerequisites.template.yaml' | |
| - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion] | |
| S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName] | |
| Parameters: | |
| Version: "1.0.0" | |
| AccountTemplateUri: !Sub | |
| - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}templates/amazon-eks-per-account-resources.template.yaml' | |
| - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion] | |
| S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName] | |
| RegionalTemplateUri: !Sub | |
| - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}templates/amazon-eks-per-region-resources.template.yaml' | |
| - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion] | |
| S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName] | |
| AccountSharedResources: | |
| Type: AWS::CloudFormation::Stack | |
| Condition: CreatePerAccountSharedResources | |
| DeletionPolicy: Retain | |
| Metadata: { cfn-lint: { config: { ignore_checks: [W3011] } } } | |
| Properties: | |
| TemplateURL: !Sub | |
| - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}templates/amazon-eks-per-account-resources.template.yaml' | |
| - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion] | |
| S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName] | |
| Tags: [{Key: !FindInMap [Config, Prefix, Value], Value: AccountSharedResources}] | |
| RegionalSharedResources: | |
| Type: AWS::CloudFormation::Stack | |
| Condition: CreatePerRegionSharedResources | |
| DeletionPolicy: Retain | |
| Metadata: | |
| cfn-lint: { config: { ignore_checks: [W3011, W9901] } } | |
| DependsOn: !If [CreatePerAccountSharedResources, !Ref AccountSharedResources, !Ref 'AWS::NoValue'] | |
| Properties: | |
| TemplateURL: !Sub | |
| - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}templates/amazon-eks-per-region-resources.template.yaml' | |
| - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion] | |
| S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName] | |
| Parameters: | |
| QSS3BucketName: !Ref QSS3BucketName | |
| QSS3KeyPrefix: !Ref QSS3KeyPrefix | |
| Tags: [{Key: !FindInMap [Config, Prefix, Value], Value: RegionalSharedResources}] | |
| VPCStack: | |
| Type: AWS::CloudFormation::Stack | |
| Metadata: | |
| cfn-lint: { config: { ignore_checks: [ W9901 ] } } | |
| Properties: | |
| TemplateURL: !Sub | |
| - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}submodules/quickstart-aws-vpc/templates/aws-vpc.template.yaml' | |
| - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion] | |
| S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName] | |
| Parameters: | |
| AvailabilityZones: !Join [ ',', !Ref 'AvailabilityZones' ] | |
| NumberOfAZs: !Ref 'NumberOfAZs' | |
| PrivateSubnet1ACIDR: !Ref 'PrivateSubnet1CIDR' | |
| PrivateSubnet2ACIDR: !Ref 'PrivateSubnet2CIDR' | |
| PrivateSubnet3ACIDR: !Ref 'PrivateSubnet3CIDR' | |
| PrivateSubnetATag2: "kubernetes.io/role/internal-elb=" | |
| PublicSubnet1CIDR: !Ref 'PublicSubnet1CIDR' | |
| PublicSubnet2CIDR: !Ref 'PublicSubnet2CIDR' | |
| PublicSubnet3CIDR: !Ref 'PublicSubnet3CIDR' | |
| PublicSubnetTag2: "kubernetes.io/role/elb=" | |
| VPCCIDR: !Ref 'VPCCIDR' | |
| EKSStack: | |
| Type: AWS::CloudFormation::Stack | |
| Metadata: | |
| DependsOn: | |
| - !If [CreatePerRegionSharedResources, !Ref RegionalSharedResources, !Ref 'AWS::NoValue'] | |
| - !If [CreatePerAccountSharedResources, !Ref AccountSharedResources, !Ref 'AWS::NoValue'] | |
| - !If [DetectSharedStacks, !Ref AutoDetectSharedResources, !Ref 'AWS::NoValue'] | |
| cfn-lint: { config: { ignore_checks: [ W9901, E9902 ] } } | |
| Properties: | |
| TemplateURL: !Sub | |
| - 'https://${S3Bucket}.s3.${S3Region}.${AWS::URLSuffix}/${QSS3KeyPrefix}templates/amazon-eks.template.yaml' | |
| - S3Region: !If [UsingDefaultBucket, !Ref 'AWS::Region', !Ref QSS3BucketRegion] | |
| S3Bucket: !If [UsingDefaultBucket, !Sub '${QSS3BucketName}-${AWS::Region}', !Ref QSS3BucketName] | |
| Parameters: | |
| PublicSubnet1ID: !GetAtt VPCStack.Outputs.PublicSubnet1ID | |
| PublicSubnet2ID: !If | |
| - 2AZDeployment | |
| - !GetAtt VPCStack.Outputs.PublicSubnet2ID | |
| - !Ref AWS::NoValue | |
| PublicSubnet3ID: !If | |
| - 3AZDeployment | |
| - !GetAtt VPCStack.Outputs.PublicSubnet3ID | |
| - !Ref AWS::NoValue | |
| KeyPairName: !Ref KeyPairName | |
| QSS3BucketName: !Ref QSS3BucketName | |
| QSS3KeyPrefix: !Ref QSS3KeyPrefix | |
| QSS3BucketRegion: !Ref QSS3BucketRegion | |
| PrivateSubnet1ID: !GetAtt VPCStack.Outputs.PrivateSubnet1AID | |
| PrivateSubnet2ID: !If | |
| - 2AZDeployment | |
| - !GetAtt VPCStack.Outputs.PrivateSubnet2AID | |
| - !Ref AWS::NoValue | |
| PrivateSubnet3ID: !If | |
| - 3AZDeployment | |
| - !GetAtt VPCStack.Outputs.PrivateSubnet3AID | |
| - !Ref AWS::NoValue | |
| NumberOfNodes: !Ref NumberOfNodes | |
| MaxNumberOfNodes: !Ref MaxNumberOfNodes | |
| NodeGroupOS: !Ref NodeGroupOS | |
| NodeGroupType: !Ref NodeGroupType | |
| NodeInstanceFamily: !Ref NodeInstanceFamily | |
| NodeInstanceType: !Ref NodeInstanceType | |
| RemoteAccessCIDR: !Ref RemoteAccessCIDR | |
| AdditionalEKSAdminUserArn: !Ref AdditionalEKSAdminUserArn | |
| AdditionalEKSAdminRoleArn: !Ref AdditionalEKSAdminRoleArn | |
| VPCID: !GetAtt VPCStack.Outputs.VPCID | |
| ProvisionClusterAutoScaler: !Ref ClusterAutoScaler | |
| EfsStorageClass: !Ref EfsStorageClass | |
| GrafanaIntegration: !If [EnableGrafana, 'Enabled', 'Disabled'] | |
| PrometheusIntegration: !If [EnablePrometheus, 'Enabled', 'Disabled'] | |
| ProvisionBastionHost: !Ref ProvisionBastionHost | |
| EKSPublicAccessEndpoint: !Ref EKSPublicAccessEndpoint | |
| ProvisionALBIngressController: !Ref ALBIngressController | |
| FargateLabels: !Ref FargateLabels | |
| FargateNamespaces: !Ref FargateNamespaces | |
| EKSClusterName: !Ref EKSClusterName | |
| SnykIntegrationId: !Ref SnykIntegrationId | |
| SnykIntegration: !Ref SnykIntegration | |
| NewRelicLicenseKey: !Ref NewRelicLicenseKey | |
| NewRelicIntegration: !Ref NewRelicIntegration | |
| VaultIntegration: !Ref VaultIntegration | |
| VaultUIACMSSLCertificateArn: !Ref VaultUIACMSSLCertificateArn | |
| VaultUIHostedZoneID: !Ref VaultUIHostedZoneID | |
| VaultUIDomainName: !Ref VaultUIDomainName | |
| ConsulIntegration: !Ref ConsulIntegration | |
| RancherIntegration: !Ref RancherIntegration | |
| RancherDomainName: !Ref RancherDomainName | |
| ConsulUIACMSSLCertificateArn: !Ref ConsulUIACMSSLCertificateArn | |
| ConsulUIHostedZoneID: !Ref ConsulUIHostedZoneID | |
| ConsulUIDomainName: !Ref ConsulUIDomainName | |
| ConfigSetName: !If [CreateAdvancedConfigWithDefaults, !Ref 'AWS::StackName', !Ref ConfigSetName] | |
| TestSuite: !Ref TestSuite | |
| CalicoIntegration: !Ref CalicoIntegration | |
| RafaySysIntegration: !Ref RafaySysIntegration | |
| RafaySysProject: !Ref RafaySysProject | |
| RafaySysBootstrapBucket: !Ref RafaySysBootstrapBucket | |
| RafaySysBootstrapKey: !Ref RafaySysBootstrapKey | |
| RafaySysApiKey: !Ref RafaySysApiKey | |
| RafaySysApiSecret: !Ref RafaySysApiSecret | |
| RafaySysFirstName: !Ref RafaySysFirstName | |
| RafaySysLastName: !Ref RafaySysLastName | |
| RafaySysOrganizationName: !Ref RafaySysOrganizationName | |
| RafaySysEmail: !Ref RafaySysEmail | |
| Outputs: | |
| EKSClusterName: | |
| Value: !GetAtt EKSStack.Outputs.EKSClusterName | |
| BastionIP: | |
| Value: !GetAtt EKSStack.Outputs.BastionIP | |
| BastionSecurityGroup: | |
| Value: !GetAtt EKSStack.Outputs.BastionSecurityGroup | |
| NodeGroupSecurityGroup: | |
| Value: !GetAtt EKSStack.Outputs.NodeGroupSecurityGroup | |
| OIDCIssuerURL: | |
| Value: !GetAtt EKSStack.Outputs.OIDCIssuerURL | |
| Rules: | |
| AutoDetectSharedParams: | |
| RuleCondition: !Or | |
| - !Equals [!Ref PerRegionSharedResources, 'AutoDetect'] | |
| - !Equals [!Ref PerAccountSharedResources, 'AutoDetect'] | |
| Assertions: | |
| - Assert: !And | |
| - !Equals [!Ref PerRegionSharedResources, 'AutoDetect'] | |
| - !Equals [!Ref PerAccountSharedResources, 'AutoDetect'] | |
| AssertDescription: "AutDetect must be set/unset for both PerRegionSharedResources and PerAccountSharedResources" | |
| WindowsUnmanaged: | |
| Assertions: | |
| - Assert: !Not [!Equals [NodeGroupOS, 'Windows']] | |
| AssertDescription: "Managed nodegroups do not support Windows nodes." | |
| RuleCondition: !Equals | |
| - !Ref NodeGroupType | |
| - Managed | |
| LablesNeedNamespaces: | |
| RuleCondition: !Not | |
| - !Equals [ !Ref FargateLabels, "" ] | |
| Assertions: | |
| - AssertDescription: You must specify at least one Fargate namespace to enable Fargate. | |
| Assert: !Not | |
| - !Equals [ !Ref FargateNamespaces, "" ] | |
| # Vault | |
| VaultUIDomainNamePresentWithHostedID: | |
| RuleCondition: !And | |
| - !Equals [!Ref VaultIntegration, 'Enabled'] | |
| - !Equals [ !Ref VaultUIHostedZoneID, '' ] | |
| Assertions: | |
| - Assert: !Not [!Equals [!Ref VaultUIDomainName, '']] | |
| AssertDescription: "Vault: Please specify a 'Domain Name' if you specify 'Route 53 Hosted Zone ID'" | |
| VaultUIHostedIDPresentWithDomainName: | |
| RuleCondition: !And | |
| - !Equals [!Ref VaultIntegration, 'Enabled'] | |
| - !Equals [ !Ref VaultUIDomainName, '' ] | |
| Assertions: | |
| - Assert: !Not [!Equals [!Ref VaultUIHostedZoneID, '']] | |
| AssertDescription: "Vault: Please specify a 'Route 53 Hosted Zone ID' if you specify 'Domain Name'" | |
| VaultUIGenerateOrProvideSSL: | |
| RuleCondition: !And | |
| - !Equals [!Ref VaultIntegration, 'Enabled'] | |
| - !Not [!Equals [!Ref VaultUIACMSSLCertificateArn, '']] | |
| Assertions: | |
| - Assert: !And | |
| - !Equals [!Ref VaultUIHostedZoneID, ''] | |
| - !Equals [!Ref VaultUIDomainName, ''] | |
| AssertDescription: "Vault1: Using an SSL certificate is enforced. A CertificateArn or a HostedZoneID and Domain Name must be provided." | |
| VaultUINoLoadBalancerInfoSupplied: | |
| RuleCondition: !Equals [!Ref VaultIntegration, 'Enabled'] | |
| Assertions: | |
| - Assert: !Or | |
| - !Not [!Equals [!Ref VaultUIHostedZoneID, '']] | |
| - !Not [!Equals [!Ref VaultUIACMSSLCertificateArn, '']] | |
| - !Not [!Equals [!Ref VaultUIDomainName, '']] | |
| AssertDescription: "Vault2: Using an SSL certificate is enforced. A CertificateArn or a HostedZoneID and Domain Name must be provided." | |
| # Consul | |
| ConsulUIDomainNamePresentWithHostedID: | |
| RuleCondition: !And | |
| - !Equals [!Ref ConsulIntegration, 'Enabled'] | |
| - !Equals [ !Ref ConsulUIHostedZoneID, '' ] | |
| Assertions: | |
| - Assert: !Not [!Equals [!Ref ConsulUIDomainName, '']] | |
| AssertDescription: "Consul: Please specify a 'Domain Name' if you specify 'Route 53 Hosted Zone ID'" | |
| ConsulUIHostedIDPresentWithDomainName: | |
| RuleCondition: !And | |
| - !Equals [!Ref ConsulIntegration, 'Enabled'] | |
| - !Equals [ !Ref ConsulUIDomainName, '' ] | |
| Assertions: | |
| - Assert: !Not [!Equals [!Ref ConsulUIHostedZoneID, '']] | |
| AssertDescription: "Consul: Please specify a 'Route 53 Hosted Zone ID' if you specify 'Domain Name'" | |
| ConsulUIGenerateOrProvideSSL: | |
| RuleCondition: !And | |
| - !Equals [!Ref ConsulIntegration, 'Enabled'] | |
| - !Not [!Equals [!Ref ConsulUIACMSSLCertificateArn, '']] | |
| Assertions: | |
| - Assert: !And | |
| - !Equals [!Ref ConsulUIHostedZoneID, ''] | |
| - !Equals [!Ref ConsulUIDomainName, ''] | |
| AssertDescription: "Consul1: Using an SSL certificate is enforced. A CertificateArn or a HostedZoneID and Domain Name must be provided." | |
| ConsulUINoLoadBalancerInfoSupplied: | |
| RuleCondition: !Equals [!Ref ConsulIntegration, 'Enabled'] | |
| Assertions: | |
| - Assert: !Or | |
| - !Not [!Equals [!Ref ConsulUIHostedZoneID, '']] | |
| - !Not [!Equals [!Ref ConsulUIACMSSLCertificateArn, '']] | |
| - !Not [!Equals [!Ref ConsulUIDomainName, '']] | |
| AssertDescription: "Consul2: Using an SSL certificate is enforced. A CertificateArn or a HostedZoneID and Domain Name must be provided." |