Skip to content

Commit 7dfe891

Browse files
gene-redpandagene-redpanda
authored
Merge pull request #6 from redpanda-data/sarah/readme
Remove extraneous info from README
2 parents 572e81a + 30665c7 commit 7dfe891

File tree

1 file changed

+52
-207
lines changed

1 file changed

+52
-207
lines changed

‎README.md‎

Lines changed: 52 additions & 207 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,9 @@
22

33
# Redpanda AWS BYOVPC Terraform Module
44

5-
This Terraform module provisions the necessary AWS infrastructure for a Redpanda customer-managed VPC cluster. It configures IAM roles, security groups, VPC components, and storage resources required for deploying Redpanda in a customer's AWS environment.
5+
This Terraform module provisions the necessary AWS infrastructure for a Redpanda BYOVPC cluster. It configures IAM
6+
roles, security groups, VPC components, and storage resources required for deploying Redpanda in a customer's AWS
7+
environment.
68

79
## Module Overview
810

@@ -13,180 +15,50 @@ This module deploys several core components:
1315
3. **Security Groups**: Sets up security groups with appropriate ingress/egress rules
1416
4. **Storage Resources**: Creates S3 buckets for cloud storage and management, and DynamoDB table for state locking
1517

16-
## Usage
17-
18-
```terraform
19-
module "redpanda_byoc" {
20-
source = "redpanda-data/redpanda-byovpc/aws"
21-
22-
region = "us-east-1"
23-
aws_account_id = "123456789012" # Optional if already authenticated
24-
common_prefix = "redpanda"
25-
26-
# VPC Configuration
27-
vpc_id = "" # Leave empty to create a new VPC
28-
vpc_cidr_block = "10.0.0.0/16"
29-
30-
# Subnet Configuration
31-
private_subnet_cidrs = [
32-
"10.0.0.0/24",
33-
"10.0.2.0/24",
34-
"10.0.4.0/24"
35-
]
36-
public_subnet_cidrs = []
37-
zones = ["use1-az1", "use1-az2", "use1-az3"]
38-
39-
# Tags and Conditions
40-
condition_tags = {
41-
"redpanda-managed" = "true"
42-
}
43-
default_tags = {
44-
"Environment" = "production"
45-
}
46-
ignore_tags = ["AutoTag", "CreatedBy"]
47-
48-
# Additional Configuration
49-
enable_private_link = false
50-
create_rpk_user = false
51-
force_destroy_cloud_storage = false
52-
}
53-
```
54-
55-
## Requirements
56-
57-
| Name | Version |
58-
|------|---------|
59-
| terraform | >= 1.8.5 |
60-
| aws | Latest |
61-
62-
## Provider Configuration
63-
64-
This module requires the AWS provider to be configured:
65-
66-
```terraform
67-
provider "aws" {
68-
region = var.region
69-
70-
ignore_tags {
71-
keys = var.ignore_tags
72-
}
73-
}
74-
```
75-
76-
## Inputs
77-
78-
| Name | Description | Type | Default | Required |
79-
|------|-------------|------|---------|:--------:|
80-
| region | The AWS region to deploy resources into | `string` | n/a | yes |
81-
| aws_account_id | AWS account ID to use (if not already authenticated) | `string` | `""` | no |
82-
| aws_access_key | AWS access key for the account | `string` | n/a | yes |
83-
| aws_secret_key | AWS secret key for the account | `string` | n/a | yes |
84-
| common_prefix | Prefix for naming resources | `string` | `"redpanda"` | no |
85-
| vpc_id | Existing VPC ID (if not creating a new one) | `string` | `""` | no |
86-
| vpc_cidr_block | CIDR block for the VPC (if creating a new one) | `string` | `"10.0.0.0/16"` | no |
87-
| private_subnet_cidrs | CIDRs for private subnets | `list(string)` | See variables.tf | no |
88-
| private_subnet_ids | IDs of existing private subnets | `list(string)` | `[]` | no |
89-
| public_subnet_cidrs | CIDRs for public subnets | `list(string)` | `[]` | no |
90-
| zones | AWS availability zone IDs | `list(string)` | See variables.tf | no |
91-
| condition_tags | Tags used as conditions in IAM policies | `map(string)` | `{"redpanda-managed": "true"}` | no |
92-
| default_tags | Tags to apply to all resources | `map(string)` | `{}` | no |
93-
| ignore_tags | Tags to ignore during resource reconciliation | `list(string)` | `[]` | no |
94-
| enable_private_link | Enable AWS PrivateLink support | `bool` | `false` | no |
95-
| create_rpk_user | Create RPK user policies for testing | `bool` | `false` | no |
96-
| force_destroy_cloud_storage | Force destroy the cloud storage bucket | `bool` | `false` | no |
97-
| source_cluster_bucket_names | Bucket names of source clusters for read replicas | `set(string)` | `[]` | no |
98-
| reader_cluster_id | ID of the reader cluster for read replicas | `string` | `""` | no |
99-
| network_exclude_zone_ids | AZ IDs to exclude from selection | `list(string)` | `[]` | no |
100-
| cloud_tags | Cloud-specific tags for resources | `map(string)` | `{}` | no |
101-
102-
## Outputs
103-
104-
| Name | Description |
105-
|------|-------------|
106-
| redpanda_agent_role_arn | ARN of the Redpanda Agent IAM role |
107-
| agent_instance_profile_arn | ARN of the Redpanda Agent instance profile |
108-
| connectors_node_group_instance_profile_arn | ARN of the Connectors node group instance profile |
109-
| utility_node_group_instance_profile_arn | ARN of the Utility node group instance profile |
110-
| redpanda_node_group_instance_profile_arn | ARN of the Redpanda node group instance profile |
111-
| k8s_cluster_role_arn | ARN of the Kubernetes cluster IAM role |
112-
| cloud_storage_bucket_arn | ARN of the Redpanda cloud storage S3 bucket |
113-
| management_bucket_arn | ARN of the management S3 bucket |
114-
| dynamodb_table_arn | ARN of the DynamoDB table for state locking |
115-
| vpc_arn | ARN of the VPC |
116-
| private_subnet_ids | JSON-encoded list of private subnet IDs |
117-
| redpanda_agent_security_group_arn | ARN of the Redpanda Agent security group |
118-
| connectors_security_group_arn | ARN of the Connectors security group |
119-
| redpanda_node_group_security_group_arn | ARN of the Redpanda node group security group |
120-
| utility_security_group_arn | ARN of the Utility security group |
121-
| cluster_security_group_arn | ARN of the EKS cluster security group |
122-
| node_security_group_arn | ARN of the EKS node shared security group |
123-
| byovpc_rpk_user_policy_arns | JSON-encoded list of RPK user policy ARNs (if enabled) |
124-
| permissions_boundary_policy_arn | ARN of the permissions boundary policy |
125-
| private_subnet_arns | List of ARNs of the private subnets |
126-
127-
## Resources
128-
129-
### IAM Resources
130-
131-
The module creates IAM roles for various components:
132-
133-
- **Redpanda Agent**: Role for the agent VM that manages the Redpanda cluster
134-
- **K8s Cluster**: Role for the EKS cluster
135-
- **Redpanda Node Group**: Role for Redpanda broker nodes
136-
- **Utility Node Group**: Role for utility nodes (load balancer controller, etc.)
137-
- **Connectors Node Group**: Role for Redpanda connectors
138-
139-
### Networking Resources
140-
141-
- **VPC** (optional): Creates a new VPC if `vpc_id` is not provided
142-
- **Subnets**: Private and public subnets in specified availability zones
143-
- **NAT Gateway**: For private subnet internet access
144-
- **Route Tables**: For public and private subnets
145-
- **S3 Gateway Endpoint**: For efficient S3 access without NAT charges
146-
147-
### Security Groups
148-
149-
- **Redpanda Agent**: For the agent VM
150-
- **Connectors**: For connector nodes
151-
- **Redpanda Node Group**: For Redpanda broker nodes
152-
- **Utility**: For utility nodes
153-
- **Cluster**: For the EKS cluster
154-
- **Node**: Shared security group for EKS nodes
155-
156-
### Storage Resources
157-
158-
- **Cloud Storage Bucket**: S3 bucket for Redpanda tiered storage
159-
- **Management Bucket**: S3 bucket for Terraform state and configuration
160-
- **DynamoDB Table**: For Terraform state locking
161-
162-
## Notes
18+
## Guidance
16319

16420
1. Either `private_subnet_ids` or `private_subnet_cidrs` must be provided.
16521
2. For Private Link support, set `enable_private_link = true`.
16622
3. The tags specified in `condition_tags` must also be provided during cluster creation.
16723
4. The module includes proper tag handling for all resources using `default_tags`.
16824
5. For read replica clusters, configure `source_cluster_bucket_names` and `reader_cluster_id`.
25+
6. It can be useful to add ignore_tags to your workspace AWS provider declaration to avoid Terraform attempting to remove tags applied by external automation. More information is available here: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/guides/resource-tagging#ignoring-changes-in-all-resources
16926

17027
## Examples
17128

172-
### Basic Usage with New VPC
29+
### Basic Usage where module will create the VPC
17330

17431
```terraform
17532
module "redpanda_byoc" {
17633
source = "redpanda-data/redpanda-byovpc/aws"
177-
178-
region = "us-west-2"
179-
common_prefix = "redpanda-prod"
180-
181-
vpc_cidr_block = "10.0.0.0/16"
34+
35+
region = "us-east-2"
36+
zones = [
37+
"use2-az1",
38+
"use2-az2",
39+
"use2-az3"
40+
]
41+
42+
common_prefix = "redpanda-prod"
43+
44+
vpc_cidr_block = "10.0.0.0/16"
18245
private_subnet_cidrs = [
18346
"10.0.0.0/24",
18447
"10.0.2.0/24",
185-
"10.0.4.0/24"
48+
"10.0.4.0/24",
49+
"10.0.6.0/24",
50+
"10.0.8.0/24",
51+
"10.0.10.0/24"
18652
]
187-
188-
zones = ["usw2-az1", "usw2-az2", "usw2-az3"]
189-
53+
public_subnet_cidrs = [
54+
"10.0.1.0/24",
55+
"10.0.3.0/24",
56+
"10.0.5.0/24",
57+
"10.0.7.0/24",
58+
"10.0.9.0/24",
59+
"10.0.11.0/24"
60+
]
61+
19062
default_tags = {
19163
"Environment" = "production"
19264
"Project" = "redpanda"
@@ -201,12 +73,18 @@ module "redpanda_byoc" {
20173
module "redpanda_byoc" {
20274
source = "redpanda-data/redpanda-byovpc/aws"
20375
204-
region = "us-east-1"
205-
common_prefix = "redpanda-dev"
206-
76+
region = "us-east-2"
77+
zones = [
78+
"use2-az1",
79+
"use2-az2",
80+
"use2-az3"
81+
]
82+
83+
common_prefix = "redpanda-dev"
84+
20785
vpc_id = "vpc-1234567890abcdef0"
20886
private_subnet_ids = ["subnet-1234567890abcdef0", "subnet-0fedcba0987654321"]
209-
87+
21088
default_tags = {
21189
"Environment" = "development"
21290
"Project" = "redpanda"
@@ -221,61 +99,28 @@ module "redpanda_byoc" {
22199
module "redpanda_byoc" {
222100
source = "redpanda-data/redpanda-byovpc/aws"
223101
224-
region = "us-east-2"
225-
common_prefix = "redpanda-staging"
226-
227-
vpc_cidr_block = "10.0.0.0/16"
102+
region = "us-east-2"
103+
zones = [
104+
"use2-az1",
105+
"use2-az2",
106+
"use2-az3"
107+
]
108+
109+
common_prefix = "redpanda-staging"
110+
111+
vpc_cidr_block = "10.0.0.0/16"
228112
private_subnet_cidrs = [
229113
"10.0.0.0/24",
230114
"10.0.2.0/24",
231115
"10.0.4.0/24"
232116
]
233-
234-
zones = ["use2-az1", "use2-az2", "use2-az3"]
235-
117+
236118
enable_private_link = true
237-
119+
238120
default_tags = {
239121
"Environment" = "staging"
240122
"Project" = "redpanda"
241123
"Terraform" = "true"
242124
}
243125
}
244126
```
245-
246-
## Ignore Tags
247-
248-
It can be useful to add ignore_tags to your workspace AWS provider declaration to avoid Terraform attempting to remove tags applied by external automation. More information is available here
249-
250-
https://registry.terraform.io/providers/hashicorp/aws/latest/docs/guides/resource-tagging#ignoring-changes-in-all-resources
251-
252-
## Capture the output
253-
254-
The output of `terraform apply` should display a number of output values. For example:
255-
256-
```shell
257-
agent_instance_profile_arn = "..."
258-
byovpc_rpk_user_policy_arns = "[...]"
259-
cloud_storage_bucket_arn = "..."
260-
cluster_security_group_arn = "..."
261-
connectors_node_group_instance_profile_arn = "..."
262-
connectors_security_group_arn = "..."
263-
dynamodb_table_arn = "..."
264-
k8s_cluster_role_arn = "..."
265-
management_bucket_arn = "..."
266-
node_security_group_arn = "..."
267-
permissions_boundary_policy_arn = "..."
268-
private_subnet_ids = "[...]"
269-
redpanda_agent_role_arn = "..."
270-
redpanda_agent_security_group_arn = "..."
271-
redpanda_node_group_instance_profile_arn = "..."
272-
redpanda_node_group_security_group_arn = "..."
273-
utility_node_group_instance_profile_arn = "..."
274-
utility_security_group_arn = "..."
275-
vpc_arn = "..."
276-
```
277-
278-
These values can also be retrieved at any time by running `terraform output`.
279-
280-
Note these values. They are needed for the next steps. To continue with cluster creation, see
281-
[Configure a Customer-Managed VPC on AWS](https://deploy-preview-12--rp-cloud.netlify.app/redpanda-cloud/get-started/cluster-types/byoc/vpc-byo-aws/).

0 commit comments

Comments
 (0)