Add EKS observability infra and demo Helm chart#7
Add EKS observability infra and demo Helm chart#7TerminalsandCoffee wants to merge 1 commit intomainfrom
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| module "vpc" { | ||
| source = "terraform-aws-modules/vpc/aws" | ||
| version = "~> 5.0" | ||
|
|
||
| name = "${var.cluster_name}-vpc" | ||
| cidr = var.vpc_cidr | ||
|
|
||
| azs = local.azs | ||
| private_subnets = [for idx, az in local.azs : cidrsubnet(var.vpc_cidr, 4, idx)] | ||
| public_subnets = [for idx, az in local.azs : cidrsubnet(var.vpc_cidr, 4, idx + 8)] | ||
|
|
||
| enable_nat_gateway = true | ||
| single_nat_gateway = true | ||
|
|
||
| public_subnet_tags = { | ||
| "kubernetes.io/role/elb" = "1" | ||
| } | ||
|
|
||
| private_subnet_tags = { | ||
| "kubernetes.io/role/internal-elb" = "1" | ||
| } | ||
|
|
||
| tags = local.tags | ||
| } |
Check failure
Code scanning / defsec
An ingress Network ACL rule allows ALL ports. Error
| module "vpc" { | ||
| source = "terraform-aws-modules/vpc/aws" | ||
| version = "~> 5.0" | ||
|
|
||
| name = "${var.cluster_name}-vpc" | ||
| cidr = var.vpc_cidr | ||
|
|
||
| azs = local.azs | ||
| private_subnets = [for idx, az in local.azs : cidrsubnet(var.vpc_cidr, 4, idx)] | ||
| public_subnets = [for idx, az in local.azs : cidrsubnet(var.vpc_cidr, 4, idx + 8)] | ||
|
|
||
| enable_nat_gateway = true | ||
| single_nat_gateway = true | ||
|
|
||
| public_subnet_tags = { | ||
| "kubernetes.io/role/elb" = "1" | ||
| } | ||
|
|
||
| private_subnet_tags = { | ||
| "kubernetes.io/role/internal-elb" = "1" | ||
| } | ||
|
|
||
| tags = local.tags | ||
| } |
Check failure
Code scanning / defsec
An ingress Network ACL rule allows ALL ports. Error
| module "vpc" { | ||
| source = "terraform-aws-modules/vpc/aws" | ||
| version = "~> 5.0" | ||
|
|
||
| name = "${var.cluster_name}-vpc" | ||
| cidr = var.vpc_cidr | ||
|
|
||
| azs = local.azs | ||
| private_subnets = [for idx, az in local.azs : cidrsubnet(var.vpc_cidr, 4, idx)] | ||
| public_subnets = [for idx, az in local.azs : cidrsubnet(var.vpc_cidr, 4, idx + 8)] | ||
|
|
||
| enable_nat_gateway = true | ||
| single_nat_gateway = true | ||
|
|
||
| public_subnet_tags = { | ||
| "kubernetes.io/role/elb" = "1" | ||
| } | ||
|
|
||
| private_subnet_tags = { | ||
| "kubernetes.io/role/internal-elb" = "1" | ||
| } | ||
|
|
||
| tags = local.tags | ||
| } |
Check failure
Code scanning / defsec
An ingress Network ACL rule allows ALL ports. Error
| module "vpc" { | ||
| source = "terraform-aws-modules/vpc/aws" | ||
| version = "~> 5.0" | ||
|
|
||
| name = "${var.cluster_name}-vpc" | ||
| cidr = var.vpc_cidr | ||
|
|
||
| azs = local.azs | ||
| private_subnets = [for idx, az in local.azs : cidrsubnet(var.vpc_cidr, 4, idx)] | ||
| public_subnets = [for idx, az in local.azs : cidrsubnet(var.vpc_cidr, 4, idx + 8)] | ||
|
|
||
| enable_nat_gateway = true | ||
| single_nat_gateway = true | ||
|
|
||
| public_subnet_tags = { | ||
| "kubernetes.io/role/elb" = "1" | ||
| } | ||
|
|
||
| private_subnet_tags = { | ||
| "kubernetes.io/role/internal-elb" = "1" | ||
| } | ||
|
|
||
| tags = local.tags | ||
| } |
Check failure
Code scanning / defsec
An ingress Network ACL rule allows ALL ports. Error
| module "vpc" { | ||
| source = "terraform-aws-modules/vpc/aws" | ||
| version = "~> 5.0" | ||
|
|
||
| name = "${var.cluster_name}-vpc" | ||
| cidr = var.vpc_cidr | ||
|
|
||
| azs = local.azs | ||
| private_subnets = [for idx, az in local.azs : cidrsubnet(var.vpc_cidr, 4, idx)] | ||
| public_subnets = [for idx, az in local.azs : cidrsubnet(var.vpc_cidr, 4, idx + 8)] | ||
|
|
||
| enable_nat_gateway = true | ||
| single_nat_gateway = true | ||
|
|
||
| public_subnet_tags = { | ||
| "kubernetes.io/role/elb" = "1" | ||
| } | ||
|
|
||
| private_subnet_tags = { | ||
| "kubernetes.io/role/internal-elb" = "1" | ||
| } | ||
|
|
||
| tags = local.tags | ||
| } |
Check failure
Code scanning / defsec
An ingress Network ACL rule allows specific ports from /0. Error
| resource "aws_iam_policy" "otel_collector" { | ||
| name = "${var.cluster_name}-otel" | ||
| description = "Minimal permissions for the OpenTelemetry collector to publish metrics and logs" | ||
|
|
||
| policy = jsonencode({ | ||
| Version = "2012-10-17" | ||
| Statement = [ | ||
| { | ||
| Effect = "Allow" | ||
| Action = ["cloudwatch:PutMetricData"] | ||
| Resource = "*" | ||
| }, | ||
| { | ||
| Effect = "Allow" | ||
| Action = ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"] | ||
| Resource = "*" | ||
| }, | ||
| { | ||
| Effect = "Allow" | ||
| Action = ["xray:PutTraceSegments", "xray:PutTelemetryRecords"] | ||
| Resource = "*" | ||
| } | ||
| ] | ||
| }) | ||
| } |
Check failure
Code scanning / defsec
IAM policy should avoid use of wildcards and instead apply the principle of least privilege Error
| resource "aws_iam_policy" "otel_collector" { | ||
| name = "${var.cluster_name}-otel" | ||
| description = "Minimal permissions for the OpenTelemetry collector to publish metrics and logs" | ||
|
|
||
| policy = jsonencode({ | ||
| Version = "2012-10-17" | ||
| Statement = [ | ||
| { | ||
| Effect = "Allow" | ||
| Action = ["cloudwatch:PutMetricData"] | ||
| Resource = "*" | ||
| }, | ||
| { | ||
| Effect = "Allow" | ||
| Action = ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"] | ||
| Resource = "*" | ||
| }, | ||
| { | ||
| Effect = "Allow" | ||
| Action = ["xray:PutTraceSegments", "xray:PutTelemetryRecords"] | ||
| Resource = "*" | ||
| } | ||
| ] | ||
| }) | ||
| } |
Check failure
Code scanning / defsec
IAM policy should avoid use of wildcards and instead apply the principle of least privilege Error
| module "vpc" { | ||
| source = "terraform-aws-modules/vpc/aws" | ||
| version = "~> 5.0" | ||
|
|
||
| name = "${var.cluster_name}-vpc" | ||
| cidr = var.vpc_cidr | ||
|
|
||
| azs = local.azs | ||
| private_subnets = [for idx, az in local.azs : cidrsubnet(var.vpc_cidr, 4, idx)] | ||
| public_subnets = [for idx, az in local.azs : cidrsubnet(var.vpc_cidr, 4, idx + 8)] | ||
|
|
||
| enable_nat_gateway = true | ||
| single_nat_gateway = true | ||
|
|
||
| public_subnet_tags = { | ||
| "kubernetes.io/role/elb" = "1" | ||
| } | ||
|
|
||
| private_subnet_tags = { | ||
| "kubernetes.io/role/internal-elb" = "1" | ||
| } | ||
|
|
||
| tags = local.tags | ||
| } |
Check warning
Code scanning / defsec
VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet "Rejects" for VPCs. Warning
| module "eks" { | ||
| source = "terraform-aws-modules/eks/aws" | ||
| version = "~> 20.0" | ||
|
|
||
| cluster_name = var.cluster_name | ||
| cluster_version = var.cluster_version | ||
| cluster_endpoint_public_access = true | ||
| enable_irsa = true | ||
|
|
||
| vpc_id = module.vpc.vpc_id | ||
| subnet_ids = module.vpc.private_subnets | ||
| control_plane_subnet_ids = module.vpc.private_subnets | ||
|
|
||
| eks_managed_node_groups = { | ||
| default = { | ||
| instance_types = var.node_instance_types | ||
| desired_size = var.node_desired_capacity | ||
| max_size = var.node_max_size | ||
| min_size = var.node_min_size | ||
| capacity_type = "SPOT" | ||
|
|
||
| tags = { | ||
| "k8s.io/cluster-autoscaler/enabled" = "true" | ||
| "k8s.io/cluster-autoscaler/${var.cluster_name}" = "owned" | ||
| "eks.amazonaws.com/capacityType" = "SPOT" | ||
| } | ||
| } | ||
| } | ||
|
|
||
| tags = local.tags | ||
| } |
Check warning
Code scanning / defsec
EKS Clusters should have cluster control plane logging turned on Warning
| module "eks" { | ||
| source = "terraform-aws-modules/eks/aws" | ||
| version = "~> 20.0" | ||
|
|
||
| cluster_name = var.cluster_name | ||
| cluster_version = var.cluster_version | ||
| cluster_endpoint_public_access = true | ||
| enable_irsa = true | ||
|
|
||
| vpc_id = module.vpc.vpc_id | ||
| subnet_ids = module.vpc.private_subnets | ||
| control_plane_subnet_ids = module.vpc.private_subnets | ||
|
|
||
| eks_managed_node_groups = { | ||
| default = { | ||
| instance_types = var.node_instance_types | ||
| desired_size = var.node_desired_capacity | ||
| max_size = var.node_max_size | ||
| min_size = var.node_min_size | ||
| capacity_type = "SPOT" | ||
|
|
||
| tags = { | ||
| "k8s.io/cluster-autoscaler/enabled" = "true" | ||
| "k8s.io/cluster-autoscaler/${var.cluster_name}" = "owned" | ||
| "eks.amazonaws.com/capacityType" = "SPOT" | ||
| } | ||
| } | ||
| } | ||
|
|
||
| tags = local.tags | ||
| } |
Check warning
Code scanning / defsec
EKS Clusters should have cluster control plane logging turned on Warning
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| public_subnet_tags = { | ||
| "kubernetes.io/role/elb" = "1" | ||
| } |
There was a problem hiding this comment.
The VPC subnets are only tagged with the ELB role keys and omit the required kubernetes.io/cluster/${var.cluster_name} tag on either the public or private subnet sets. When the cluster tries to create Kubernetes LoadBalancer services, the AWS cloud provider/ALB controller will skip untagged subnets, so no external load balancer can be provisioned with the defaults in this module. Please add the cluster tag to both subnet types so load balancers can be created.
Useful? React with 👍 / 👎.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR is being reviewed by Cursor Bugbot
Details
You are on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle.
To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.
| cpu: 250m | ||
| memory: 256Mi | ||
| env: | ||
| API_BASE_URL: "http://observability-api" |
There was a problem hiding this comment.
Bug: Frontend API URL doesn't match generated service name
The default API_BASE_URL is hardcoded to http://observability-api, but the actual API service name is generated dynamically using observability-app.fullname which produces ${ReleaseName}-observability-app-api (e.g., myrelease-observability-app-api). The frontend will fail to connect to the API service because the URL doesn't match the generated service name.
Additional Locations (1)
2 participants
Summary
Testing
Codex Task
Note
Adds Terraform EKS/VPC with IRSA for an OTEL collector and a Helm chart deploying frontend and API services with optional mesh annotations.
terraform-aws-modules/eks, VPC/subnets viaterraform-aws-modules/vpcin02-eks-observability-stack/infra.charts/observability-app):Chart.yaml, helpers) with standard labels/selectors.frontendandapiwith configurable images, resources, env, and service types.imagePullPolicy; optional mesh injector annotations viavalues.yaml.Written by Cursor Bugbot for commit d1b96a6. This will update automatically on new commits. Configure here.