feat: update EKS node pools defaults

CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+# v0.6.0
+
+- Use gp3 for EBS volumes of EKS nodes.
+- Encrypt EBS volumes of EKS nodes.
+
 # v0.5.1
 
 ### Minor fixes

README.md

@@ -221,7 +221,7 @@ You can find examples of code that uses this Terraform module in the [examples](
 | <a name="input_eks_cluster_endpoint_public_access"></a> [eks\_cluster\_endpoint\_public\_access](#input\_eks\_cluster\_endpoint\_public\_access) | Indicates whether or not the Amazon EKS public API server endpoint is enabled. | `bool` | n/a | yes |
 | <a name="input_eks_enable_cluster_creator_admin_permissions"></a> [eks\_enable\_cluster\_creator\_admin\_permissions](#input\_eks\_enable\_cluster\_creator\_admin\_permissions) | Indicates whether or not to add the cluster creator (the identity used by Terraform) as an administrator via access entry. | `bool` | `true` | no |
 | <a name="input_eks_kubernetes_version"></a> [eks\_kubernetes\_version](#input\_eks\_kubernetes\_version) | Specify which Kubernetes release to use. | `string` | n/a | yes |
-| <a name="input_eks_managed_node_group_defaults"></a> [eks\_managed\_node\_group\_defaults](#input\_eks\_managed\_node\_group\_defaults) | The default settings of the EKS managed node groups. | <pre>object({<br/>    ami_type              = string<br/>    block_device_mappings = map(any)<br/>  })</pre> | <pre>{<br/>  "ami_type": "AL2_x86_64",<br/>  "block_device_mappings": {<br/>    "sdc": {<br/>      "device_name": "/dev/xvda",<br/>      "ebs": {<br/>        "delete_on_termination": true,<br/>        "volume_size": 128,<br/>        "volume_type": "gp2"<br/>      }<br/>    }<br/>  }<br/>}</pre> | no |
+| <a name="input_eks_managed_node_group_defaults"></a> [eks\_managed\_node\_group\_defaults](#input\_eks\_managed\_node\_group\_defaults) | The default settings of the EKS managed node groups. | <pre>object({<br/>    ami_type              = string<br/>    block_device_mappings = map(any)<br/>  })</pre> | <pre>{<br/>  "ami_type": "AL2_x86_64",<br/>  "block_device_mappings": {<br/>    "sdc": {<br/>      "device_name": "/dev/xvda",<br/>      "ebs": {<br/>        "delete_on_termination": true,<br/>        "encrypted": true,<br/>        "volume_size": 128,<br/>        "volume_type": "gp3"<br/>      }<br/>    }<br/>  }<br/>}</pre> | no |
 | <a name="input_eks_managed_node_groups"></a> [eks\_managed\_node\_groups](#input\_eks\_managed\_node\_groups) | The managed node groups of the EKS cluster. | <pre>map(object({<br/>    instance_types             = set(string)<br/>    min_size                   = number<br/>    max_size                   = number<br/>    desired_size               = optional(number)<br/>    subnet_ids                 = optional(list(string), null)<br/>    ami_type                   = optional(string, "AL2_x86_64")<br/>    disk_size_gb               = optional(number, 128)<br/>    tags                       = optional(map(string), {})<br/>    use_custom_launch_template = optional(bool, true)<br/>    labels                     = optional(map(string), {})<br/>    taints = optional(set(object({<br/>      key : string<br/>      value : string<br/>      effect : string<br/>    })), [])<br/>  }))</pre> | <pre>{<br/>  "gpu-a10": {<br/>    "ami_type": "AL2_x86_64_GPU",<br/>    "desired_size": 0,<br/>    "disk_size_gb": 128,<br/>    "instance_types": [<br/>      "g5.12xlarge"<br/>    ],<br/>    "labels": {<br/>      "nebuly.com/accelerator": "nvidia-ampere-a10",<br/>      "nvidia.com/gpu.present": "true"<br/>    },<br/>    "max_size": 1,<br/>    "min_size": 0,<br/>    "tags": {<br/>      "k8s.io/cluster-autoscaler/enabled": "true"<br/>    },<br/>    "taints": [<br/>      {<br/>        "effect": "NO_SCHEDULE",<br/>        "key": "nvidia.com/gpu",<br/>        "value": ""<br/>      }<br/>    ]<br/>  },<br/>  "gpu-t4": {<br/>    "ami_type": "AL2_x86_64_GPU",<br/>    "desired_size": 1,<br/>    "disk_size_gb": 128,<br/>    "instance_types": [<br/>      "g4dn.xlarge"<br/>    ],<br/>    "labels": {<br/>      "nebuly.com/accelerator": "nvidia-tesla-t4",<br/>      "nvidia.com/gpu.present": "true"<br/>    },<br/>    "max_size": 1,<br/>    "min_size": 0,<br/>    "taints": [<br/>      {<br/>        "effect": "NO_SCHEDULE",<br/>        "key": "nvidia.com/gpu",<br/>        "value": ""<br/>      }<br/>    ]<br/>  },<br/>  "workers": {<br/>    "desired_size": 1,<br/>    "instance_types": [<br/>      "r5.xlarge"<br/>    ],<br/>    "max_size": 1,<br/>    "min_size": 1<br/>  }<br/>}</pre> | no |
 | <a name="input_eks_service_accounts"></a> [eks\_service\_accounts](#input\_eks\_service\_accounts) | The service accounts that will able to assume the EKS IAM Role. | <pre>list(object({<br/>    name : string<br/>    namespace : string<br/>  }))</pre> | <pre>[<br/>  {<br/>    "name": "aws-load-balancer-controller",<br/>    "namespace": "kube-system"<br/>  },<br/>  {<br/>    "name": "cluster-autoscaler",<br/>    "namespace": "kube-system"<br/>  },<br/>  {<br/>    "name": "cluster-autoscaler",<br/>    "namespace": "nebuly"<br/>  },<br/>  {<br/>    "name": "cluster-autoscaler",<br/>    "namespace": "nebuly-bootstrap"<br/>  },<br/>  {<br/>    "name": "aws-load-balancer-controller",<br/>    "namespace": "nebuly"<br/>  },<br/>  {<br/>    "name": "nebuly",<br/>    "namespace": "nebuly"<br/>  },<br/>  {<br/>    "name": "nebuly",<br/>    "namespace": "default"<br/>  }<br/>]</pre> | no |
 | <a name="input_k8s_image_pull_secret_name"></a> [k8s\_image\_pull\_secret\_name](#input\_k8s\_image\_pull\_secret\_name) | The name of the Kubernetes Image Pull Secret to use. <br/>  This value will be used to auto-generate the values.yaml file for installing the Nebuly Platform Helm chart. | `string` | `"nebuly-docker-pull"` | no |

tests/dev-provisioning/secrets.auto.tfvars.example

@@ -0,0 +1,2 @@
+aws_access_key = ""
+aws_secret_key = ""

variables.tf

@@ -244,8 +244,9 @@ variable "eks_managed_node_group_defaults" {
         device_name = "/dev/xvda"
         ebs = {
           volume_size           = 128
-          volume_type           = "gp2"
+          volume_type           = "gp3"
           delete_on_termination = true
+          encrypted             = true
         }
       }
   } }