Deployment of an EKS Cluster with Worker Nodes in AWS

import os # Set AWS credentials and default region aws_access_key_id = getEnvVar('AWS_ACCESS_KEY_ID') aws_secret_access_key = getEnvVar('AWS_SECRET_ACCESS_KEY') region = region # Configure AWS CLI os.system(f'aws configure set aws_access_key_id {aws_access_key_id}') os.system(f'aws configure set aws_secret_access_key {aws_secret_access_key}') os.system(f'aws configure set default.region {region}') print('AWS CLI configured with region:', region)

import boto3 import json # Define role and instance profile names # role_name = "MyEKSClusterRole" instance_profile_name = f"{role_name}-InstanceProfile" # Policy ARNs eks_cluster_policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy" # Custom inline policy custom_policy_document = { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "iam:ListRoles", "eks:*" ], "Resource": "*" } ] } # Updated trust policy for both EC2 and EKS trust_policy = { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": [ "ec2.amazonaws.com", "eks.amazonaws.com" ] }, "Action": "sts:AssumeRole" } ] } # Initialize session and client session = boto3.Session( aws_access_key_id=getEnvVar('AWS_ACCESS_KEY_ID'), aws_secret_access_key=getEnvVar('AWS_SECRET_ACCESS_KEY') ) iam_client = session.client('iam') # Create the IAM Role role_response = iam_client.create_role( RoleName=role_name, AssumeRolePolicyDocument=json.dumps(trust_policy), Description="EKS Cluster Role with EC2 and EKS trust" ) role_arn = role_response['Role']['Arn'] # Attach AWS managed policy iam_client.attach_role_policy( RoleName=role_name, PolicyArn=eks_cluster_policy_arn ) # Attach custom inline policy iam_client.put_role_policy( RoleName=role_name, PolicyName="EKSCustomPolicy", PolicyDocument=json.dumps(custom_policy_document) ) # Create instance profile if it doesn't exist try: iam_client.create_instance_profile( InstanceProfileName=instance_profile_name ) print(f"Created instance profile: {instance_profile_name}") except iam_client.exceptions.EntityAlreadyExistsException: print(f"Instance profile {instance_profile_name} already exists.") # Add role to instance profile iam_client.add_role_to_instance_profile( InstanceProfileName=instance_profile_name, RoleName=role_name ) print('Role ARN:', role_arn)

import boto3 import time # Initialize session and IAM client session = boto3.Session( aws_access_key_id=getEnvVar('AWS_ACCESS_KEY_ID'), aws_secret_access_key=getEnvVar('AWS_SECRET_ACCESS_KEY') ) iam_client = session.client('iam') # Set role and instance profile names #worker_role_name = "EKSWORKERNODEROLE" instance_profile_name = worker_role_name + "-InstanceProfile" # 1. Trust policy so EC2 instances can assume the role trust_policy = { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": [ "ec2.amazonaws.com", "eks.amazonaws.com" ] }, "Action": "sts:AssumeRole" } ] } # 2. Create the IAM role try: role_response = iam_client.create_role( RoleName=worker_role_name, AssumeRolePolicyDocument=json.dumps(trust_policy), Description="EKS Worker Node Role" ) print(f" Created role: {worker_role_name}") except iam_client.exceptions.EntityAlreadyExistsException: print(f" Role {worker_role_name} already exists.") role_response = iam_client.get_role(RoleName=worker_role_name) role_arn = role_response['Role']['Arn'] # 3. Attach required managed policies managed_policies = [ "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly", "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy", "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy" ] for policy_arn in managed_policies: iam_client.attach_role_policy(RoleName=worker_role_name, PolicyArn=policy_arn) print(f" Attached policy: {policy_arn}") # 4. Create instance profile and attach role try: iam_client.create_instance_profile(InstanceProfileName=instance_profile_name) print(f" Created instance profile: {instance_profile_name}") except iam_client.exceptions.EntityAlreadyExistsException: print(f" Instance profile {instance_profile_name} already exists.") # Add role to instance profile (wait to ensure profile is ready) time.sleep(5) try: iam_client.add_role_to_instance_profile( InstanceProfileName=instance_profile_name, RoleName=worker_role_name ) print(f" Added role to instance profile.") except iam_client.exceptions.LimitExceededException: print(" Role already associated with instance profile.") # Final output print(f" Role ARN: {role_arn}") worker_role_arn = role_arn

import boto3 # Initialize a session using Amazon EC2 session = boto3.Session( aws_access_key_id=getEnvVar('AWS_ACCESS_KEY_ID'), aws_secret_access_key=getEnvVar('AWS_SECRET_ACCESS_KEY'), region_name=region ) # Create EC2 client ec2_client = session.client('ec2') # Check existing VPCs vpcs = ec2_client.describe_vpcs() vpc_id = None # Reuse if VPC already exists for vpc in vpcs['Vpcs']: if vpc['CidrBlock'] == vpc_cidr: vpc_id = vpc['VpcId'] print(f"Using existing VPC: {vpc_id}") break # Otherwise, create new VPC if not vpc_id: if len(vpcs['Vpcs']) >= 5: raise Exception('VPC limit exceeded. Please delete unused VPCs or increase the limit.') vpc_response = ec2_client.create_vpc( CidrBlock=vpc_cidr, TagSpecifications=[{ 'ResourceType': 'vpc', 'Tags': [{'Key': 'Name', 'Value': 'MyEKS-VPC'}] }] ) vpc_id = vpc_response['Vpc']['VpcId'] ec2_client.modify_vpc_attribute(VpcId=vpc_id, EnableDnsSupport={'Value': True}) ec2_client.modify_vpc_attribute(VpcId=vpc_id, EnableDnsHostnames={'Value': True}) print(f"Created VPC: {vpc_id}") # Create Internet Gateway igw_response = ec2_client.create_internet_gateway() igw_id = igw_response['InternetGateway']['InternetGatewayId'] ec2_client.attach_internet_gateway(InternetGatewayId=igw_id, VpcId=vpc_id) print(f"Attached Internet Gateway: {igw_id}") # Create route table and default route to IGW route_table = ec2_client.create_route_table(VpcId=vpc_id) rtb_id = route_table['RouteTable']['RouteTableId'] ec2_client.create_route( RouteTableId=rtb_id, DestinationCidrBlock='0.0.0.0/0', GatewayId=igw_id ) print(f"Created route table with IGW route: {rtb_id}") print('Final VPC ID:', vpc_id)

import boto3 import json # Initialize a session using Amazon EC2 session = boto3.Session( aws_access_key_id=getEnvVar('AWS_ACCESS_KEY_ID'), aws_secret_access_key=getEnvVar('AWS_SECRET_ACCESS_KEY'), region_name=region ) # Create EC2 client ec2_client = session.client('ec2') # Describe existing subnets to avoid conflicts existing_subnets = ec2_client.describe_subnets(Filters=[{'Name': 'vpc-id', 'Values': [vpc_id]}]) existing_cidrs = [subnet['CidrBlock'] for subnet in existing_subnets['Subnets']] # Function to find a non-conflicting CIDR def find_non_conflicting_cidr(existing_cidrs, base_cidr, start_octet): for i in range(start_octet, 256): new_cidr = f"{base_cidr}.{i}.0/24" if new_cidr not in existing_cidrs: return new_cidr raise Exception("Unable to find a non-conflicting CIDR") # Base CIDR for subnets base_cidr = "10.0" # Find CIDRs for 2 public and 2 private subnets public_subnet_cidrs, private_subnet_cidrs = [], [] for i in range(50, 256): new_cidr = f"{base_cidr}.{i}.0/24" if new_cidr not in existing_cidrs: public_subnet_cidrs.append(new_cidr) if len(public_subnet_cidrs) == 2: break for i in range(60, 256): new_cidr = f"{base_cidr}.{i}.0/24" if new_cidr not in existing_cidrs: private_subnet_cidrs.append(new_cidr) if len(private_subnet_cidrs) == 2: break # Get available AZs in the region (first 2) az_response = ec2_client.describe_availability_zones( Filters=[{'Name': 'region-name', 'Values': [region]}, {'Name': 'state', 'Values': ['available']}] ) available_azs = sorted([az['ZoneName'] for az in az_response['AvailabilityZones']])[:2] if len(available_azs) < 2: raise Exception("At least 2 Availability Zones are required.") # Create public subnets in distinct AZs public_subnet_ids = [] for i, cidr in enumerate(public_subnet_cidrs): az = available_azs[i] subnet_response = ec2_client.create_subnet( VpcId=vpc_id, CidrBlock=cidr, AvailabilityZone=az ) subnet_id = subnet_response['Subnet']['SubnetId'] public_subnet_ids.append(subnet_id) # Enable auto-assign public IP on launch ec2_client.modify_subnet_attribute( SubnetId=subnet_id, MapPublicIpOnLaunch={'Value': True} ) # Associate subnet with the route table connected to the Internet Gateway ec2_client.associate_route_table( SubnetId=subnet_id, RouteTableId=rtb_id ) # Create private subnets in distinct AZs private_subnet_ids = [] for i, cidr in enumerate(private_subnet_cidrs): az = available_azs[i] subnet_response = ec2_client.create_subnet( VpcId=vpc_id, CidrBlock=cidr, AvailabilityZone=az ) private_subnet_ids.append(subnet_response['Subnet']['SubnetId']) # Output print('Public Subnet IDs:', json.dumps(public_subnet_ids, indent=4)) print('Private Subnet IDs:', json.dumps(private_subnet_ids, indent=4))

import boto3 # Initialize a session using Amazon EC2 session = boto3.Session( aws_access_key_id=getEnvVar('AWS_ACCESS_KEY_ID'), aws_secret_access_key=getEnvVar('AWS_SECRET_ACCESS_KEY'), region_name=region ) # Create EC2 client ec2_client = session.client('ec2') # Check if the security group already exists existing_sgs = ec2_client.describe_security_groups(Filters=[{'Name': 'vpc-id', 'Values': [vpc_id]}]) security_group_id = None for sg in existing_sgs['SecurityGroups']: if sg['GroupName'] == 'EKS-Security-Group': security_group_id = sg['GroupId'] break # Create security group if it doesn't exist if not security_group_id: security_group_response = ec2_client.create_security_group( GroupName='EKS-Security-Group', Description='Security group for EKS cluster', VpcId=vpc_id ) security_group_id = security_group_response['GroupId'] # Authorize inbound traffic for security group ec2_client.authorize_security_group_ingress( GroupId=security_group_id, IpPermissions=[ { 'IpProtocol': '-1', 'IpRanges': [{'CidrIp': '0.0.0.0/0'}] } ] ) print('Security Group ID:', security_group_id)