AWS EKS Setup: Terraform, Kosten und DSGVO-Compliance

# vpc.tf
module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 5.0"

  name = "eks-production"
  cidr = "10.0.0.0/16"

  azs             = ["eu-central-1a", "eu-central-1b", "eu-central-1c"]
  private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]

  enable_nat_gateway   = true
  single_nat_gateway   = false  # true fuer Dev, false fuer Prod (HA)
  enable_dns_hostnames = true
  enable_dns_support   = true

  # Tags fuer den AWS Load Balancer Controller
  public_subnet_tags = {
    "kubernetes.io/role/elb" = 1
  }
  private_subnet_tags = {
    "kubernetes.io/role/internal-elb" = 1
  }

  tags = {
    Environment = "production"
    ManagedBy   = "terraform"
  }
}

# eks.tf
module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~> 20.0"

  cluster_name    = "production"
  cluster_version = "1.31"

  vpc_id     = module.vpc.vpc_id
  subnet_ids = module.vpc.private_subnets

  # API-Server nur aus dem VPC erreichbar
  cluster_endpoint_public_access  = false
  cluster_endpoint_private_access = true

  # EKS Add-ons
  cluster_addons = {
    coredns                = { most_recent = true }
    kube-proxy             = { most_recent = true }
    vpc-cni                = { most_recent = true }
    aws-ebs-csi-driver     = { most_recent = true }
  }

  # Managed Node Groups
  eks_managed_node_groups = {
    # System-Workloads (Monitoring, Ingress, etc.)
    system = {
      instance_types = ["m6i.large"]
      min_size       = 2
      max_size       = 4
      desired_size   = 2

      labels = {
        role = "system"
      }

      taints = [{
        key    = "CriticalAddonsOnly"
        effect = "NO_SCHEDULE"
      }]
    }

    # Application-Workloads
    application = {
      instance_types = ["m6i.xlarge", "m7i.xlarge"]
      min_size       = 2
      max_size       = 10
      desired_size   = 3
      capacity_type  = "ON_DEMAND"

      labels = {
        role = "application"
      }
    }

    # Spot-Nodes fuer nicht-kritische Workloads
    spot = {
      instance_types = ["m6i.large", "m5.large", "m7i.large"]
      min_size       = 0
      max_size       = 8
      desired_size   = 0
      capacity_type  = "SPOT"

      labels = {
        role = "spot"
      }

      taints = [{
        key    = "spot"
        value  = "true"
        effect = "NO_SCHEDULE"
      }]
    }
  }

  tags = {
    Environment = "production"
    ManagedBy   = "terraform"
  }
}

# irsa.tf -- Beispiel: S3-Zugriff fuer eine Backup-Anwendung
module "irsa_backup" {
  source  = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
  version = "~> 5.0"

  role_name = "eks-backup-role"

  oidc_providers = {
    main = {
      provider_arn               = module.eks.oidc_provider_arn
      namespace_service_accounts = ["backup:backup-sa"]
    }
  }

  role_policy_arns = {
    s3 = aws_iam_policy.backup_s3.arn
  }
}

resource "aws_iam_policy" "backup_s3" {
  name = "eks-backup-s3-access"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Action = [
        "s3:PutObject",
        "s3:GetObject",
        "s3:ListBucket"
      ]
      Resource = [
        "arn:aws:s3:::mein-backup-bucket",
        "arn:aws:s3:::mein-backup-bucket/*"
      ]
    }]
  })
}

apiVersion: v1
kind: ServiceAccount
metadata:
  name: backup-sa
  namespace: backup
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/eks-backup-role

# ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: api-ingress
  namespace: production
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:eu-central-1:123456789012:certificate/abc-123
    alb.ingress.kubernetes.io/ssl-policy: ELBSecurityPolicy-TLS13-1-2-2021-06
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
    alb.ingress.kubernetes.io/ssl-redirect: "443"
spec:
  rules:
    - host: api.mein-unternehmen.de
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: api-service
                port:
                  number: 80

# karpenter-nodepool.yaml
apiVersion: karpenter.sh/v1
kind: NodePool
metadata:
  name: default
spec:
  template:
    spec:
      requirements:
        - key: kubernetes.io/arch
          operator: In
          values: ["amd64"]
        - key: karpenter.sh/capacity-type
          operator: In
          values: ["on-demand", "spot"]
        - key: karpenter.k8s.aws/instance-category
          operator: In
          values: ["m", "c", "r"]
        - key: karpenter.k8s.aws/instance-generation
          operator: Gt
          values: ["5"]
      nodeClassRef:
        group: karpenter.k8s.aws
        kind: EC2NodeClass
        name: default
  limits:
    cpu: "100"
    memory: 400Gi
  disruption:
    consolidationPolicy: WhenEmptyOrUnderutilized
    consolidateAfter: 1m

# KMS-Key fuer EKS Secrets Encryption
resource "aws_kms_key" "eks" {
  description = "EKS Secrets Encryption Key"
  enable_key_rotation = true
}

# Im EKS-Modul referenzieren:
# cluster_encryption_config = {
#   provider_key_arn = aws_kms_key.eks.arn
#   resources        = ["secrets"]
# }

# Im EKS-Modul:
cluster_enabled_log_types = [
  "api",
  "audit",
  "authenticator",
  "controllerManager",
  "scheduler"
]

# Amazon CloudWatch Container Insights aktivieren
aws eks create-addon \
  --cluster-name production \
  --addon-name amazon-cloudwatch-observability \
  --region eu-central-1

# Alternativ: Prometheus + Grafana ueber Helm
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm install monitoring prometheus-community/kube-prometheus-stack \
  --namespace monitoring \
  --create-namespace \
  --set grafana.adminPassword=sicheres-passwort