我正在努力使用地形形式部署我的 EKS 节点/节点组

Question

我是先得到这个错误的

NodeCreationFailure: Instances failed to 
join the kubernetes cluster

和我没有我的私人子网标记正确。我在网上找到了一些例子，他们以某种方式标记他们的vpc和子网，所以我复制了它，现在我得到了这个错误

Error: Cycle: aws_eks_cluster.eks, aws_subnet.private_subnet

这是令人沮丧的，但这是我的主要。压缩到所有相关资源块的Tf文件。这是我的整个vpc部分，因为我觉得它可以是基于其他帖子的任何东西。另外，对于上下文，我试图在私有子网内部署集群。

resource "aws_vpc" "vpc" {
cidr_block = "10.1.0.0/16"
tags = {
"kubernetes.io/cluster/${var.cluster_name}" = "shared"
}
}
resource "aws_subnet" "public_subnet" {
count                   = length(var.azs)
vpc_id                  = aws_vpc.vpc.id
cidr_block              = var.public_cidrs[count.index]
availability_zone       = var.azs[count.index]
map_public_ip_on_launch = true
tags = {
Name = "${var.name}-public-subnet-${count.index + 1}"
}
}
resource "aws_subnet" "private_subnet" {
count                   = length(var.azs)
vpc_id                  = aws_vpc.vpc.id
cidr_block              = var.private_cidrs[count.index]
availability_zone       = var.azs[count.index]
map_public_ip_on_launch = false
tags = {
"kubernetes.io/cluster/${aws_eks_cluster.eks.name}" = "shared"
"kubernetes.io/role/internal-elb"           = "1"
}
}
resource "aws_internet_gateway" "internet_gateway" {
vpc_id = aws_vpc.vpc.id
tags = {
Name = "${var.name}-internet-gateway"
}
}
resource "aws_route_table" "public_rt" {
vpc_id = aws_vpc.vpc.id
tags = {
Name = "${var.name}-public-rt"
}
}
resource "aws_route" "default_route" {
route_table_id         = aws_route_table.public_rt.id
destination_cidr_block = "0.0.0.0/0"
gateway_id             = aws_internet_gateway.internet_gateway.id
}
resource "aws_route_table_association" "public_assoc" {
count          = length(var.public_cidrs)
subnet_id      = aws_subnet.public_subnet[count.index].id
route_table_id = aws_route_table.public_rt.id
}
resource "aws_eip" "nat_eip" {
count      = length(var.public_cidrs)
vpc        = true
depends_on = [aws_internet_gateway.internet_gateway]
tags = {
Name = "${var.name}-nat-eip-${count.index + 1}"
}
}
resource "aws_nat_gateway" "nat_gateway" {
count         = length(var.public_cidrs)
allocation_id = aws_eip.nat_eip[count.index].id
subnet_id     = aws_subnet.public_subnet[count.index].id
depends_on    = [aws_internet_gateway.internet_gateway]
tags = {
Name = "${var.name}-NAT-gateway-${count.index + 1}"
}
}

这是我所有与我的集群和节点相关的源块

resource "aws_iam_role" "eks_cluster" {
name = "${var.name}-eks-cluster-role"
assume_role_policy = <<POLICY
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "eks.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
POLICY
}
resource "aws_iam_role_policy_attachment" "amazon_eks_cluster_policy" {
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
role       = aws_iam_role.eks_cluster.name
}
resource "aws_eks_cluster" "eks" {
name     = var.cluster_name
role_arn = aws_iam_role.eks_cluster.arn
## k8s Version
version = var.k8s_version
vpc_config {
endpoint_private_access = true
endpoint_public_access  = false
subnet_ids              = [
aws_subnet.private_subnet[0].id,
aws_subnet.private_subnet[1].id,
aws_subnet.private_subnet[2].id,
]
}
depends_on = [
aws_iam_role_policy_attachment.amazon_eks_cluster_policy
]
}
resource "aws_iam_role" "nodes_eks" {
name               = "role-node-group-eks"
assume_role_policy = <<POLICY
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
}, 
"Action": "sts:AssumeRole"
}
]
}
POLICY
}
resource "aws_iam_role_policy_attachment" "amazon_eks_worker_node_policy_eks" {
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
role       = aws_iam_role.nodes_eks.name
}
resource "aws_iam_role_policy_attachment" "amazon_eks_cni_policy_eks" {
policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
role       = aws_iam_role.nodes_eks.name
}
resource "aws_iam_role_policy_attachment" "amazon_ec2_container_registry_read_only" {
policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
role       = aws_iam_role.nodes_eks.name
}

resource "aws_eks_node_group" "nodes_eks" {
cluster_name    = aws_eks_cluster.eks.name
node_group_name = "${var.name}-node-group"
node_role_arn   = aws_iam_role.nodes_eks.arn
subnet_ids      = [
aws_subnet.private_subnet[0].id,
aws_subnet.private_subnet[1].id,
aws_subnet.private_subnet[2].id,
]
remote_access {
ec2_ssh_key = aws_key_pair.bastion_auth.id
}
scaling_config {
desired_size = 3
max_size     = 6
min_size     = 3
}
ami_type       = "AL2_x86_64"
capacity_type  = "ON_DEMAND"
disk_size      = 20
instance_types = [var.instance_type]
labels = {
role = "nodes-group-1"
}
version = var.k8s_version
depends_on = [
aws_iam_role_policy_attachment.amazon_eks_worker_node_policy_eks,
aws_iam_role_policy_attachment.amazon_eks_cni_policy_eks,
aws_iam_role_policy_attachment.amazon_ec2_container_registry_read_only,
]
}

Answer 1

在private-subnet资源中，您在标记:${aws_eks_cluster.eks.name}中引用您的EKS集群，这在EKS集群上创建了该资源的依赖项。

resource "aws_subnet" "private_subnet" {
count                   = length(var.azs)
vpc_id                  = aws_vpc.vpc.id
cidr_block              = var.private_cidrs[count.index]
availability_zone       = var.azs[count.index]
map_public_ip_on_launch = false
tags = {
"kubernetes.io/cluster/${aws_eks_cluster.eks.name}" = "shared" <- this creates dependency
"kubernetes.io/role/internal-elb"                   = "1"
}
}

另一方面，当你创建EKS集群时，你引用了相同的私有子网，它现在在私有子网上为这个资源创建了一个依赖项。

resource "aws_eks_cluster" "eks" {
name     = var.cluster_name
role_arn = aws_iam_role.eks_cluster.arn
## k8s Version
version = var.k8s_version
vpc_config {
endpoint_private_access = true
endpoint_public_access  = false
subnet_ids              = [
aws_subnet.private_subnet[0].id, <- this creates dependency
aws_subnet.private_subnet[1].id, <- this creates dependency
aws_subnet.private_subnet[2].id, <- this creates dependency
]
}
depends_on = [
aws_iam_role_policy_attachment.amazon_eks_cluster_policy
]
}

结果，你得到一个导致错误的依赖循环。

要解决这个问题，请将私有子网的标签更新为:

tags = {
"kubernetes.io/cluster/${var.cluster_name}" = "shared"
"kubernetes.io/role/internal-elb"           = "1"
}