eks-cluster.yaml-template

apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig

metadata:
  name: ${CLUSTER_NAME}
  region: eu-north-1
  version: "${CLUSTER_VERSION}"
  tags:
    environment: "${CLUSTER_NAME}"
    delete-after: "${DELETE_AFTER}"
    team: "${TEAM}"

iam:
  withOIDC: true
  serviceRoleARN: "arn:aws:iam::894516026745:role/WeaveEksClusterRole"
  serviceAccounts:
  - metadata:
      name: kustomize-controller
      namespace: flux-system
    attachPolicyARNs:
    - "arn:aws:iam::894516026745:policy/WeaveSopsKmsDecrypt"
    roleName: eksctl-${CLUSTER_NAME}-sops-decrypt-role
    roleOnly: true
  - metadata:
      name: external-dns
      namespace: external-dns
    attachPolicyARNs:
    - "arn:aws:iam::894516026745:policy/AllowExternalDNSUpdates"
    roleName: eksctl-${CLUSTER_NAME}-route53-external-dns-role
    roleOnly: false # create role and annotated service account

# Enable private access to the API server.
vpc:
  clusterEndpoints:
    privateAccess: true
    publicAccess: true

nodeGroups:
  - name: ${CLUSTER_NAME}-ng-1
    instanceType: t3.medium
    minSize: 3
    maxSize: 3
    desiredCapacity: 3
    volumeSize: 10
    privateNetworking: true
    tags:
      environment: "${CLUSTER_NAME}"
      delete-after: "${DELETE_AFTER}"
      team: "${TEAM}"
    propagateASGTags: true
    iam:
      instanceProfileARN: "arn:aws:iam::894516026745:instance-profile/WeaveEksWorkerNodeRole"

gitops:
  flux:
    gitProvider: github
    flags:
      owner: "weaveworks"
      repository: "clusters-config"
      private: "true"
      branch: "${BRANCH_NAME}"
      namespace: "flux-system"
      path: "eksctl-clusters/clusters/${CLUSTER_NAME}"