[EKS Auto Mode]GitLabとGitLab Runnerを同一EKSクラスター上で稼働させつつワーカーノードを分離してみた

module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~> 20.34.0"
  # 省略
  cluster_compute_config = {
    enabled    = true
    # 変更: 組み込みノードプールを無効
    # node_pools = ["general-purpose", "system"]
    node_pools = []
  }
  # 省略
}

# 追加: AutoMode用アクセスエントリ設定
# https://docs.aws.amazon.com/ja_jp/eks/latest/userguide/create-node-class.html
resource "aws_eks_access_entry" "auto_mode" {
  cluster_name  = module.eks.cluster_name
  principal_arn = module.eks.node_iam_role_arn
  type          = "EC2"
}

resource "aws_eks_access_policy_association" "auto_mode" {
  cluster_name  = module.eks.cluster_name
  policy_arn    = "arn:aws:eks::aws:cluster-access-policy/AmazonEKSAutoNodePolicy"
  principal_arn = module.eks.node_iam_role_arn

  access_scope {
    type = "cluster"
  }
}

resource "kubernetes_manifest" "node_class" {
  manifest = yamldecode(templatefile("${path.module}/templates/manifest/node_class.yaml", {
    node_security_group_id   = data.tfe_outputs.cluster.values.eks.node_security_group_id
    node_role_name           = data.tfe_outputs.cluster.values.eks.node_iam_role_name
  }))
}

resource "kubernetes_manifest" "node_pool_general" {
  manifest = yamldecode(file("${path.module}/files/manifest/node_pool_general.yaml"))
}

resource "kubernetes_manifest" "node_pool_gitlab_runner" {
  manifest = yamldecode(file("${path.module}/files/manifest/node_pool_gitlab_runner.yaml"))
}

apiVersion: eks.amazonaws.com/v1
kind: NodeClass
metadata:
  name: general
spec:

  # Required: Subnet selection for node placement
  subnetSelectorTerms:
    - tags:
        kubernetes.io/role/internal-elb: "1"
    # Alternative using direct subnet ID
    # - id: "subnet-0123456789abcdef0"

  # Required: Security group selection for nodes
  securityGroupSelectorTerms:
  - id: ${node_security_group_id}
    # Alternative approaches:
    # - id: "sg-0123456789abcdef0"
    # - name: "eks-cluster-node-security-group"

  # Optional: Configure SNAT policy (defaults to Random)
  snatPolicy: Random  # or Disabled

  # Optional: Network policy configuration (defaults to DefaultAllow)
  networkPolicy: DefaultAllow  # or DefaultDeny

  # Optional: Network policy event logging (defaults to Disabled)
  networkPolicyEventLogs: Disabled  # or Enabled

  # Optional: Configure ephemeral storage (shown with default values)
  ephemeralStorage:
    size: "80Gi"    # Range: 1-59000Gi or 1-64000G or 1-58Ti or 1-64T
    iops: 3000      # Range: 3000-16000
    throughput: 125 # Range: 125-1000

  # Optional: Name of IAM role to use for EC2 instance role
  # If unspecified, EKS creates a role
  # If specified, you must create an access entry for this role as described above
  role: ${node_role_name}

apiVersion: karpenter.sh/v1
kind: NodePool
metadata:
  name: general
spec:
  template:
    spec:
      nodeClassRef:
        group: eks.amazonaws.com
        kind: NodeClass
        name: general
      requirements:
        - key: "karpenter.sh/capacity-type"
          operator: In
          values: ["on-demand"]
        - key: "eks.amazonaws.com/instance-category"
          operator: In
          values: ["c", "m", "r"]
        - key: "eks.amazonaws.com/instance-cpu"
          operator: In
          values: ["2", "4", "8"]
        - key: "kubernetes.io/arch"
          operator: In
          values: ["amd64"]
    metadata:
      labels:
        workload: general

apiVersion: karpenter.sh/v1
kind: NodePool
metadata:
  name: gitlab-runner
spec:
  template:
    spec:
      nodeClassRef:
        group: eks.amazonaws.com
        kind: NodeClass
        name: general
      requirements:
        - key: "karpenter.sh/capacity-type"
          operator: In
          values: ["spot"]
        - key: "eks.amazonaws.com/instance-category"
          operator: In
          values: ["c", "m", "r"]
        - key: "eks.amazonaws.com/instance-cpu"
          operator: In
          values: ["2", "4", "8"]
        - key: "kubernetes.io/arch"
          operator: In
          values: ["amd64"]
      taints:
        - key: workload
          value: gitlab-runner
          effect: NoSchedule
    metadata:
      labels:
        workload: gitlab-runner