AWS EKS via eksctl

This article covers AWS EKS via eksctl, originally published as a secure GitHub Gist snippet.

apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig
 
metadata:
  name: eksctl-us-west-2-managed
  region: us-west-2
 
vpc:
  id: vpc-0b953326cd7a2f917
  subnets:
    public:
      us-west-2a: 
        id: subnet-0947f8d8495f046d6
      us-west-2c:
        id: subnet-0d4ae0a69651a70f3
  #totally isolated subnets, no NAT
    private:
      us-west-2a:
        id: subnet-0b23ee123b8b67b7a
      us-west-2c:
        id: subnet-0d1a5c002de859352
 
nodeGroups: 
  - name: standard-public
    instanceType: t3.micro
    iam:
      attachPolicyARNs:
      - arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy
      - arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy
      - arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
      - arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM
      withAddonPolicies:
        cloudWatch: true
        autoScaler: true
    preBootstrapCommands:
    - |
      echo '#install curl,nslookup,dig and nc'
      yum install -y bind-utils nmap-ncat curl
    - |
      echo '#setup journald log rotate, replacing the blank, commented-out versions'
      sed -i 's/\#SystemMaxUse\=/SystemMaxUse\=200M/' /etc/systemd/journald.conf
      sed -i 's/\#SystemKeepFree\=/SystemKeepFree\=200M/' /etc/systemd/journald.conf
      sed -i 's/\#SystemMaxFileSize\=/SystemMaxFileSize\=10M/' /etc/systemd/journald.conf
    - |
      echo '#SSM > SSH'
      yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
      systemctl start amazon-ssm-agent
    - |
      echo '#begin bootstrap.sh'
    kubeletExtraConfig:
      #kubeReserved: #Set by new AMI >=  20191213
      #evictionHard: #Set by new AMI >=  20191213
      systemReserved:
        cpu: "100m"
        memory: "100Mi"
        ephemeral-storage: "1Gi"
    ssh:
      publicKeyName: dev
    minSize: 2
    maxSize: 3
 - name: gpu-public
    volumeSize: 200
    instanceType: p3.2xlarge
    iam:
      attachPolicyARNs:
      - arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy
      - arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy
      - arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
      - arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM
    #  - arn:aws:iam::134354569320:policy/fsx-csi
      withAddonPolicies:
        cloudWatch: true
        autoScaler: true
    preBootstrapCommands:
    - |
      echo '#install curl,nslookup,dig and nc'
      yum install -y bind-utils nmap-ncat curl
    - |
      echo '#setup journald log rotate, replacing the blank, commented-out versions'
      sed -i 's/\#SystemMaxUse\=/SystemMaxUse\=200M/' /etc/systemd/journald.conf
      sed -i 's/\#SystemKeepFree\=/SystemKeepFree\=200M/' /etc/systemd/journald.conf
      sed -i 's/\#SystemMaxFileSize\=/SystemMaxFileSize\=10M/' /etc/systemd/journald.conf
    - |
      echo '#SSM > SSH'
      yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
      systemctl start amazon-ssm-agent
    - |
      echo '#begin bootstrap.sh'
    kubeletExtraConfig:
      #kubeReserved: #Set by new AMI >= 20191213
      #evictionHard: #Set by new AMI >= 20191213
      systemReserved:
        cpu: "100m"
        memory: "100Mi"
        ephemeral-storage: "1Gi" 
    ssh:
      allow: true
      publicKeyName: dev
    minSize: 0
    maxSize: 3
 
managedNodegroups:
  - name: managed-standard-public
    ssh:
      allow: true
      publicKeyName: dev
    # scalingConfig: #required in the schema but not known to eksctl v0.13.0 from brew
    #   desiredCapacity: 2
    #   maxSize: 4
    #   minSize: 2
    volumeSize: 200
 
cloudWatch:
  clusterLogging:
    enableTypes: ["*"]