main.yml

# ami images optimized for eks: https://docs.aws.amazon.com/eks/latest/userguide/eks-optimized-ami.html
# instances types: https://aws.amazon.com/es/ec2/instance-types/t2/
---
AWSTemplateFormatVersion: '2010-09-09'
Description: 'Amazon EKS Sample VPC - Private and Public subnets'

Parameters:

  K8sVersion:
    Type: Number
    Default: 1.24
    Description: The kubernetes version

  VpcBlock:
    Type: String
    Default: 192.168.0.0/16
    Description: The CIDR range for the VPC. This should be a valid private (RFC 1918) CIDR range.

  PublicSubnet01Block:
    Type: String
    Default: 192.168.0.0/18
    Description: CidrBlock for public subnet 01 within the VPC

  PublicSubnet02Block:
    Type: String
    Default: 192.168.64.0/18
    Description: CidrBlock for public subnet 02 within the VPC

  PrivateSubnet01Block:
    Type: String
    Default: 192.168.128.0/18
    Description: CidrBlock for private subnet 01 within the VPC

  PrivateSubnet02Block:
    Type: String
    Default: 192.168.192.0/18
    Description: CidrBlock for private subnet 02 within the VPC

  NodeInstanceType:
    Type: String
    Default: t2.medium

  NodeAmiType:
    Type: String
    Default: AL2_x86_64
    AllowedValues:
      - AL2_ARM_64
      - AL2_x86_64
      - AL2_x86_64_GPU
      - BOTTLEROCKET_ARM_64
      - BOTTLEROCKET_x86_64

  NodeDiskSize:
    Type: Number
    Default: 40

  NodesGroupMinSize:
    Type: Number
    Default: 1
  
  NodesGroupDesiredSize:
    Type: Number
    Default: 2
  
  NodesGroupMaxSize:
    Type: Number
    Default: 3

  SQLDBInstanceId:
    Type: String

  SQLDBInstance:
    Type: String
    Default: db.t3.micro

  SQLPubliclyAccessible:
    Type: String
    Default: "false"
    Description: Indicates whether the DB instance is an internet-facing instance
    AllowedValues:
      - "true"
      - "false"

  SQLDBStorage:
    Type: Number
    Default: 20
    Description: The size of the database (GiB)
    MinValue: 20
    MaxValue: 65536

  SQLDBEngine:
    Type: String
    Default: postgres
    AllowedValues:
      - aurora
      - aurora-mysql
      - aurora-postgresql
      - mariadb
      - mysql
      - oracle-ee
      - oracle-ee-cdb
      - oracle-se2
      - oracle-se2-cdb
      - postgres
      - sqlserver-ee
      - sqlserver-se
      - sqlserver-ex
      - sqlserver-web

  SQLDBEngineVersion:
    Type: String
    Default: 14.3

  SQLDBPort:
    Type: Number
    Default: 5432

  SQLDBName:
    Type: String
    Default: mydb

  SQLDBUsername:
    Type: String
    NoEcho: true

  SQLDBPassword:
    Type: String
    NoEcho: true


Metadata:
  AWS::CloudFormation::Interface:
    ParameterGroups:
      -
        Label:
          default: "Kubernetes Configuration"
        Parameters:
          - K8sVersion
      -
        Label:
          default: "Worker Network Configuration"
        Parameters:
          - VpcBlock
          - PublicSubnet01Block
          - PublicSubnet02Block
          - PrivateSubnet01Block
          - PrivateSubnet02Block
      - 
        Label:
          default: "Node Group"
        Parameters:
          - NodeInstanceType
          - NodeAmiType
          - NodeDiskSize
          - NodesGroupMinSize
          - NodesGroupDesiredSize
          - NodesGroupMaxSize
      -
        Label:
          default: "SQL Database"
        Parameters:
          - SQLDBInstanceId
          - SQLDBInstance
          - SQLPubliclyAccessible
          - SQLDBStorage
          - SQLDBEngine
          - SQLDBEngineVersion
          - SQLDBPort
          - SQLDBName
          - SQLDBUsername
          - SQLDBPassword

Resources:

  # --- Network
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: !Ref VpcBlock
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
      - Key: Name
        Value: !Sub '${AWS::StackName}-VPC'

  InternetGateway:
    Type: "AWS::EC2::InternetGateway"

  VPCGatewayAttachment:
    Type: "AWS::EC2::VPCGatewayAttachment"
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: Public Subnets
      - Key: Network
        Value: Public

  PrivateRouteTable01:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: Private Subnet AZ1
      - Key: Network
        Value: Private01

  PrivateRouteTable02:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
      - Key: Name
        Value: Private Subnet AZ2
      - Key: Network
        Value: Private02

  PublicRoute:
    DependsOn: VPCGatewayAttachment
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PrivateRoute01:
    DependsOn:
    - VPCGatewayAttachment
    - NatGateway01
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable01
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway01

  PrivateRoute02:
    DependsOn:
    - VPCGatewayAttachment
    - NatGateway02
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable02
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NatGateway02

  NatGateway01:
    DependsOn:
    - NatGatewayEIP1
    - PublicSubnet01
    - VPCGatewayAttachment
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt 'NatGatewayEIP1.AllocationId'
      SubnetId: !Ref PublicSubnet01
      Tags:
      - Key: Name
        Value: !Sub '${AWS::StackName}-NatGatewayAZ1'

  NatGateway02:
    DependsOn:
    - NatGatewayEIP2
    - PublicSubnet02
    - VPCGatewayAttachment
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId: !GetAtt 'NatGatewayEIP2.AllocationId'
      SubnetId: !Ref PublicSubnet02
      Tags:
      - Key: Name
        Value: !Sub '${AWS::StackName}-NatGatewayAZ2'

  NatGatewayEIP1:
    DependsOn:
    - VPCGatewayAttachment
    Type: 'AWS::EC2::EIP'
    Properties:
      Domain: vpc

  NatGatewayEIP2:
    DependsOn:
    - VPCGatewayAttachment
    Type: 'AWS::EC2::EIP'
    Properties:
      Domain: vpc

  PublicSubnet01:
    Type: AWS::EC2::Subnet
    Metadata:
      Comment: Subnet 01
    Properties:
      MapPublicIpOnLaunch: true
      AvailabilityZone:
        Fn::Select:
        - '0'
        - Fn::GetAZs:
            Ref: AWS::Region
      CidrBlock:
        Ref: PublicSubnet01Block
      VpcId:
        Ref: VPC
      Tags:
      - Key: Name
        Value: !Sub "${AWS::StackName}-PublicSubnet01"
      - Key: kubernetes.io/role/elb
        Value: 1

  PublicSubnet02:
    Type: AWS::EC2::Subnet
    Metadata:
      Comment: Subnet 02
    Properties:
      MapPublicIpOnLaunch: true
      AvailabilityZone:
        Fn::Select:
        - '1'
        - Fn::GetAZs:
            Ref: AWS::Region
      CidrBlock:
        Ref: PublicSubnet02Block
      VpcId:
        Ref: VPC
      Tags:
      - Key: Name
        Value: !Sub "${AWS::StackName}-PublicSubnet02"
      - Key: kubernetes.io/role/elb
        Value: 1

  PrivateSubnet01:
    Type: AWS::EC2::Subnet
    Metadata:
      Comment: Subnet 03
    Properties:
      AvailabilityZone:
        Fn::Select:
        - '0'
        - Fn::GetAZs:
            Ref: AWS::Region
      CidrBlock:
        Ref: PrivateSubnet01Block
      VpcId:
        Ref: VPC
      Tags:
      - Key: Name
        Value: !Sub "${AWS::StackName}-PrivateSubnet01"
      - Key: kubernetes.io/role/internal-elb
        Value: 1

  PrivateSubnet02:
    Type: AWS::EC2::Subnet
    Metadata:
      Comment: Private Subnet 02
    Properties:
      AvailabilityZone:
        Fn::Select:
        - '1'
        - Fn::GetAZs:
            Ref: AWS::Region
      CidrBlock:
        Ref: PrivateSubnet02Block
      VpcId:
        Ref: VPC
      Tags:
      - Key: Name
        Value: !Sub "${AWS::StackName}-PrivateSubnet02"
      - Key: kubernetes.io/role/internal-elb
        Value: 1

  PublicSubnet01RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet01
      RouteTableId: !Ref PublicRouteTable

  PublicSubnet02RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet02
      RouteTableId: !Ref PublicRouteTable

  PrivateSubnet01RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet01
      RouteTableId: !Ref PrivateRouteTable01

  PrivateSubnet02RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet02
      RouteTableId: !Ref PrivateRouteTable02

  # --- EKS
  ControlPlaneSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Cluster communication with worker nodes
      VpcId: !Ref VPC

  ESKRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${AWS::StackName}-cluster-role'
      Description: 'This roles has permissions to settup a k8s cluster'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - eks.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
        - arn:aws:iam::aws:policy/AmazonEKSServicePolicy

  EKSCluster:
    Type: AWS::EKS::Cluster
    Properties:
      Name: !Sub '${AWS::StackName}-eks'
      Version: !Ref K8sVersion
      RoleArn: !GetAtt ESKRole.Arn
      ResourcesVpcConfig:
        SecurityGroupIds:
          - !Ref ControlPlaneSecurityGroup
        SubnetIds:
          - !Ref PublicSubnet01
          - !Ref PublicSubnet02
          - !Ref PrivateSubnet01
          - !Ref PrivateSubnet02
        EndpointPublicAccess: true
        EndpointPrivateAccess: true

  NodeInstanceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${AWS::StackName}-node-role'
      Description: 'This role admin worker nodes of kubernetes cluster'
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy
        - arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy
        - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
        - arn:aws:iam::aws:policy/CloudWatchLogsFullAccess
        - arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy

  NodeGroup:
    Type: AWS::EKS::Nodegroup
    Properties: 
      ClusterName: !Ref EKSCluster
      NodegroupName: !Sub '${AWS::StackName}-node-group'
      NodeRole: !GetAtt NodeInstanceRole.Arn
      InstanceTypes: 
        - !Ref NodeInstanceType
      AmiType: !Ref NodeAmiType
      DiskSize: !Ref NodeDiskSize
      ScalingConfig:
        MinSize: !Ref NodesGroupMinSize
        DesiredSize: !Ref NodesGroupDesiredSize
        MaxSize: !Ref NodesGroupMaxSize
      Subnets:
        - !Ref PrivateSubnet01
        - !Ref PrivateSubnet02

  # --- DB
  SQLVPCSecurityGroup:
    Type: AWS::EC2::SecurityGroup 
    Properties:
      GroupDescription: "Instance to RDS Access"
      GroupName: !Sub '${AWS::StackName}-RDSVPC-Secutiry-Group' 
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          CidrIp: 0.0.0.0/0

  SQLSubnetGroup:
    Type: AWS::RDS::DBSubnetGroup
    Properties:
      DBSubnetGroupDescription: "RDS Subnet Group for RDS"
      DBSubnetGroupName: !Sub '${AWS::StackName}-Subnet-Group'
      SubnetIds:
        - !Ref PrivateSubnet01
        - !Ref PrivateSubnet02

  SQLDatabase:
    Type: AWS::RDS::DBInstance
    Properties:
      DBInstanceIdentifier: !Ref SQLDBInstanceId
      DBInstanceClass: !Ref SQLDBInstance
      StorageType: gp2 # general purpose SSD
      MultiAZ: false
      AllocatedStorage: !Ref SQLDBStorage
      Engine: !Ref SQLDBEngine
      EngineVersion: !Ref SQLDBEngineVersion
      PreferredBackupWindow: "03:00-03:30"
      BackupRetentionPeriod: 1
      DeleteAutomatedBackups: true
      DeletionProtection: false
      DBName: !Ref SQLDBName
      Port: !Ref SQLDBPort
      MasterUsername: !Ref SQLDBUsername
      MasterUserPassword: !Ref SQLDBPassword
      AutoMinorVersionUpgrade: true
      PubliclyAccessible: !Ref SQLPubliclyAccessible
      VPCSecurityGroups:
        - !Ref SQLVPCSecurityGroup
      DBSubnetGroupName: !Ref SQLSubnetGroup
      # DBSecurityGroups:
      # AvailabilityZone: 
      # AssociatedRoles
      # MonitoringInterval: 60
      # MonitoringRoleArn:
      # EnableIAMDatabaseAuthentication:

Outputs:

  SubnetIds:
    Description: Subnets IDs in the VPC
    Value: !Join [ ",", [ !Ref PublicSubnet01, !Ref PublicSubnet02, !Ref PrivateSubnet01, !Ref PrivateSubnet02 ] ]

  SecurityGroups:
    Description: Security group for the cluster control plane communication with worker nodes
    Value: !Join [ ",", [ !Ref ControlPlaneSecurityGroup ] ]

  VpcId:
    Description: The VPC Id
    Value: !Ref VPC
  
  EKSName:
    Description: The cluster name
    Value: !Ref EKSCluster
  
  NodeGroupId:
    Description: The Node Group Id
    Value: !Ref NodeGroup