TerraformでEKSクラスターを構築する方法｜managed node groupとPod Identityの実践設計

この記事のポイント

・aws_eks_clusterとnode groupリソースで最小構成EKSを作れる
・Pod IdentityはIRSAの後継でOIDC設定が不要になる
・EKS add-onはaws_eks_addonでバージョン固定できる
・managed node group vs Fargate profileの設計判断基準も解説

# クラスター用IAMロール
resource "aws_iam_role" "eks_cluster" {
  name = "${var.cluster_name}-cluster-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "eks.amazonaws.com" }
      Action    = "sts:AssumeRole"
    }]
  })
}

resource "aws_iam_role_policy_attachment" "eks_cluster_policy" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
  role       = aws_iam_role.eks_cluster.name
}

# EKSクラスター本体
resource "aws_eks_cluster" "main" {
  name     = var.cluster_name
  version  = "1.30"
  role_arn = aws_iam_role.eks_cluster.arn

  vpc_config {
    subnet_ids              = var.private_subnet_ids
    endpoint_private_access = true
    endpoint_public_access  = false
  }

  access_config {
    authentication_mode = "API_AND_CONFIG_MAP"
  }

  depends_on = [aws_iam_role_policy_attachment.eks_cluster_policy]
}

resource "aws_iam_role" "eks_node" {
  name = "${var.cluster_name}-node-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "ec2.amazonaws.com" }
      Action    = "sts:AssumeRole"
    }]
  })
}

resource "aws_iam_role_policy_attachment" "eks_node_worker" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
  role       = aws_iam_role.eks_node.name
}

resource "aws_iam_role_policy_attachment" "eks_node_cni" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
  role       = aws_iam_role.eks_node.name
}

resource "aws_iam_role_policy_attachment" "eks_node_ecr" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
  role       = aws_iam_role.eks_node.name
}

resource "aws_eks_node_group" "main" {
  cluster_name    = aws_eks_cluster.main.name
  node_group_name = "main-ng"
  node_role_arn   = aws_iam_role.eks_node.arn
  subnet_ids      = var.private_subnet_ids

  # ami_type: AL2023_x86_64_STANDARD (x86_64) or AL2023_ARM_64_STANDARD (Graviton)
  ami_type       = "AL2023_x86_64_STANDARD"
  instance_types = ["t3.medium"]

  scaling_config {
    desired_size = 2
    max_size     = 5
    min_size     = 1
  }

  update_config {
    max_unavailable = 1
  }

  depends_on = [
    aws_iam_role_policy_attachment.eks_node_worker,
    aws_iam_role_policy_attachment.eks_node_cni,
    aws_iam_role_policy_attachment.eks_node_ecr,
  ]
}

aws_iam_role.eks_cluster: Creating...
aws_iam_role.eks_cluster: Creation complete after 1s [id=my-eks-cluster-role]
aws_iam_role_policy_attachment.eks_cluster_policy: Creation complete after 0s
aws_eks_cluster.main: Creating...
aws_eks_cluster.main: Still creating... [1m0s elapsed]
aws_eks_cluster.main: Still creating... [9m0s elapsed]
aws_eks_cluster.main: Creation complete after 9m23s [id=my-eks-cluster]
aws_eks_node_group.main: Creating...
aws_eks_node_group.main: Still creating... [1m0s elapsed]
aws_eks_node_group.main: Creation complete after 2m47s [id=my-eks-cluster:main-ng]

Apply complete! Resources: 12 added, 0 changed, 0 destroyed.

$ aws eks update-kubeconfig --name my-eks-cluster --region ap-northeast-1
Updated context arn:aws:eks:ap-northeast-1:123456789012:cluster/my-eks-cluster in /home/ec2-user/.kube/config

$ kubectl get nodes
NAME                                               STATUS   ROLES    AGE     VERSION
ip-10-0-1-45.ap-northeast-1.compute.internal      Ready       87s     v1.30.2-eks-1552ad0
ip-10-0-2-112.ap-northeast-1.compute.internal     Ready       91s     v1.30.2-eks-1552ad0

# Step 1: Pod Identity Agentアドオンを有効化
resource "aws_eks_addon" "pod_identity_agent" {
  cluster_name = aws_eks_cluster.main.name
  addon_name   = "eks-pod-identity-agent"

  depends_on = [aws_eks_node_group.main]
}

# Step 2: PodのIAMロール（pods.eks.amazonaws.comが引き受ける）
resource "aws_iam_role" "s3_reader" {
  name = "${var.cluster_name}-s3-reader"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "pods.eks.amazonaws.com" }
      Action    = ["sts:AssumeRole", "sts:TagSession"]
    }]
  })
}

resource "aws_iam_role_policy_attachment" "s3_reader" {
  policy_arn = "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"
  role       = aws_iam_role.s3_reader.name
}

# Step 3: サービスアカウントとIAMロールの紐付け
resource "aws_eks_pod_identity_association" "s3_access" {
  cluster_name    = aws_eks_cluster.main.name
  namespace       = "default"
  service_account = "s3-reader-sa"
  role_arn        = aws_iam_role.s3_reader.arn

  depends_on = [aws_eks_addon.pod_identity_agent]
}

resource "aws_eks_addon" "vpc_cni" {
  cluster_name  = aws_eks_cluster.main.name
  addon_name    = "vpc-cni"
  addon_version = "v1.18.3-eksbuild.2"

  depends_on = [aws_eks_node_group.main]
}

resource "aws_eks_addon" "coredns" {
  cluster_name  = aws_eks_cluster.main.name
  addon_name    = "coredns"
  addon_version = "v1.11.3-eksbuild.1"

  depends_on = [aws_eks_node_group.main]
}

resource "aws_eks_addon" "kube_proxy" {
  cluster_name  = aws_eks_cluster.main.name
  addon_name    = "kube-proxy"
  addon_version = "v1.30.3-eksbuild.5"

  depends_on = [aws_eks_node_group.main]
}

$ aws eks describe-addon-versions \
    --kubernetes-version 1.30 \
    --addon-name vpc-cni \
    --query 'addons[].addonVersions[].addonVersion' \
    --output text \
    --region ap-northeast-1

v1.18.3-eksbuild.2
v1.18.2-eksbuild.1
v1.18.1-eksbuild.3

# EBS CSI Driver用のIAMロール
resource "aws_iam_role" "ebs_csi_driver" {
  name = "${var.cluster_name}-ebs-csi-driver"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "pods.eks.amazonaws.com" }
      Action    = ["sts:AssumeRole", "sts:TagSession"]
    }]
  })
}

resource "aws_iam_role_policy_attachment" "ebs_csi_driver" {
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
  role       = aws_iam_role.ebs_csi_driver.name
}

resource "aws_eks_addon" "ebs_csi_driver" {
  cluster_name             = aws_eks_cluster.main.name
  addon_name               = "aws-ebs-csi-driver"
  addon_version            = "v1.35.0-eksbuild.1"
  service_account_role_arn = aws_iam_role.ebs_csi_driver.arn

  depends_on = [aws_eks_node_group.main]
}

# VPCモジュールを使っている場合の例
module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.13.0"

  private_subnet_tags = {
    "kubernetes.io/cluster/${var.cluster_name}" = "shared"
    "kubernetes.io/role/internal-elb"           = "1"
  }

  public_subnet_tags = {
    "kubernetes.io/cluster/${var.cluster_name}" = "shared"
    "kubernetes.io/role/elb"                    = "1"
  }
}

resource "aws_eks_node_group" "main" {
  # ... 省略 ...

  lifecycle {
    ignore_changes = [
      # AMIが更新されても自動でnode groupを変更しない
      ami_type,
      release_version,
    ]
  }
}