.
├── eks.tf       // EKS クラスタ定義
├── iam.tf       // IAM 定義
├── locals.tf    // 定数定義
├── provider.tf  // AWS Provider 定義
├── terraform.tf // Terraform バージョン定義
└── vpc.tf       // VPC 定義

terraform {
  required_version = "1.11.2"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "5.94.1"
    }
  }
}

provider "aws" {
  region = "ap-northeast-1"
  assume_role {
    role_arn = "arn:aws:iam::123456789123:role/terraform" # Terraform 用の Admin IAM ロール
  }
}

locals {
  name                       = "eks-auto-mode-playground"
  cluster_version            = "1.31"
  access_entry_principal_arn = "arn:aws:iam::123456789123:role/ren510dev-playground" # クラスタを利用するユーザの IAM ロール
}

resource "aws_eip" "eks_auto_mode_playground_eip" {
  count = 1

  tags = {
    Name = "${local.name}-eip"
  }
}

module "eks_auto_mode_playground_vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "5.19.0"

  name = "eks-auto-mode-playground"
  cidr = "10.0.0.0/16"

  azs = [
    "ap-northeast-1a",
    "ap-northeast-1c",
    "ap-northeast-1d",
  ]

  public_subnets = [
    "10.0.0.0/20",  # ap-northeast-1a public subnet
    "10.0.16.0/20", # ap-northeast-1c public subnet
    "10.0.32.0/20", # ap-northeast-1d public subnet
  ]
  public_subnet_tags = {
    "kubernetes.io/role/elb" = "1",
  }

  private_subnets = [
    "10.0.128.0/20", # ap-northeast-1a private subnet
    "10.0.144.0/20", # ap-northeast-1c private subnet
    "10.0.160.0/20", # ap-northeast-1d private subnet
  ]
  private_subnet_tags = {
    "kubernetes.io/role/internal-elb" = "1"
  }

  ### NAT Gateway: 単一の NAT Gateway を使用
  enable_nat_gateway     = true
  single_nat_gateway     = true
  one_nat_gateway_per_az = false
  reuse_nat_ips          = true
  external_nat_ip_ids    = aws_eip.eks_auto_mode_playground_eip.*.id

  ### VPN Gateway
  enable_vpn_gateway = false

  depends_on = [
    aws_eip.eks_auto_mode_playground_eip
  ]

  tags = {
    Name = local.name
  }
}

### AmazonEKSAutoClusterRole
resource "aws_iam_role" "eks_auto_mode_cluster_role" {
  name        = "eks-auto-mode-master-role"
  description = "Allows access to other AWS service resources that are required to operate Auto Mode clusters managed by EKS."

  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Effect = "Allow",
        Action = [
          "sts:AssumeRole",
          "sts:TagSession"
        ],
        Principal = {
          Service = "eks.amazonaws.com"
        }
      }
    ]
  })

  tags = {
    Name = local.name
  }
}

resource "aws_iam_role_policy_attachment" "eks_auto_mode_cluster_role_cluster_policy" {
  role       = aws_iam_role.eks_auto_mode_cluster_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
}

resource "aws_iam_role_policy_attachment" "eks_auto_mode_cluster_role_block_storage_policy" {
  role       = aws_iam_role.eks_auto_mode_cluster_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSBlockStoragePolicy"
}

resource "aws_iam_role_policy_attachment" "eks_auto_mode_cluster_role_compute_policy" {
  role       = aws_iam_role.eks_auto_mode_cluster_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSComputePolicy"
}

resource "aws_iam_role_policy_attachment" "eks_auto_mode_cluster_role_load_balancing_policy" {
  role       = aws_iam_role.eks_auto_mode_cluster_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSLoadBalancingPolicy"
}

resource "aws_iam_role_policy_attachment" "eks_auto_mode_cluster_role_networking_policy" {
  role       = aws_iam_role.eks_auto_mode_cluster_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSNetworkingPolicy"
}

### AmazonEKSAutoNodeRole
resource "aws_iam_role" "eks_auto_mode_node_role" {
  name        = "eks-auto-mode-node-role"
  description = "Allows EKS nodes to connect to EKS Auto Mode clusters and to pull container images from ECR."

  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      {
        Effect = "Allow",
        Action = "sts:AssumeRole",
        Principal = {
          Service = "ec2.amazonaws.com"
        }
      }
    ]
  })

  tags = {
    Name = local.name
  }
}

resource "aws_iam_role_policy_attachment" "eks_auto_mode_node_role_container_registry_pull_policy" {
  role       = aws_iam_role.eks_auto_mode_node_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPullOnly"
}

resource "aws_iam_role_policy_attachment" "eks_auto_mode_node_role_worker_node_minimal_policy" {
  role       = aws_iam_role.eks_auto_mode_node_role.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodeMinimalPolicy"
}

module "eks_auto_mode_playground" {
  source  = "terraform-aws-modules/eks/aws"
  version = "20.35.0"

  cluster_name    = local.name
  cluster_version = local.cluster_version

  ### VPC
  vpc_id = module.eks_auto_mode_playground_vpc.vpc_id
  subnet_ids = [
    module.eks_auto_mode_playground_vpc.private_subnets[0], # ap-northeast-1a private subnet
    module.eks_auto_mode_playground_vpc.private_subnets[1], # ap-northeast-1c private subnet
    module.eks_auto_mode_playground_vpc.private_subnets[2], # ap-northeast-1d private subnet
  ]

  cluster_endpoint_private_access      = true
  cluster_endpoint_public_access       = true
  cluster_endpoint_public_access_cidrs = ["0.0.0.0/0"]

  authentication_mode                      = "API"
  enable_cluster_creator_admin_permissions = true

  ### Control-Plane
  create_iam_role = false
  iam_role_arn    = aws_iam_role.eks_auto_mode_cluster_role.arn

  ### Data-Plane
  cluster_compute_config = {
    enabled       = true # EKS Auto Mode 有効化
    node_pools    = ["general-purpose", "system"]
    node_role_arn = aws_iam_role.eks_auto_mode_node_role.arn
  }

  ### Cluster network
  cluster_service_ipv4_cidr = "172.20.0.0/16"
  cluster_ip_family         = "ipv4"

  ### IRSA
  enable_irsa = true

  ### Cluster zonal shift
  cluster_zonal_shift_config = {
    enabled = true
  }

  ### Cluster upgrade policy
  cluster_upgrade_policy = {
    support_type = "STANDARD"
  }

  ### Addons
  bootstrap_self_managed_addons = false
  cluster_addons                = {}

  ### Logging
  cluster_enabled_log_types = [
    "api",
    "audit",
    "authenticator",
    "controllerManager",
    "scheduler",
  ]

  depends_on = [
    module.eks_auto_mode_playground_vpc,
    aws_iam_role.eks_auto_mode_cluster_role,
    aws_iam_role.eks_auto_mode_node_role,
  ]

  tags = {
    Name = local.name
  }
}

resource "aws_eks_access_entry" "admin_entry" {
  cluster_name  = module.eks_auto_mode_playground.cluster_name
  principal_arn = local.access_entry_principal_arn
  type          = "STANDARD"

  tags = {
    Name = local.name
  }
}

resource "aws_eks_access_policy_association" "admin_policy" {
  cluster_name  = module.eks_auto_mode_playground.cluster_name
  principal_arn = aws_eks_access_entry.admin_entry.principal_arn
  policy_arn    = "arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy"

  access_scope {
    type = "cluster"
  }

  depends_on = [
    module.eks_auto_mode_playground,
    resource.aws_eks_access_entry.admin_entry,
  ]
}

$ aws eks update-kubeconfig --name eks-auto-mode-playground --region ap-northeast-1

### NodePool
$ kubectl get nodepools -o wide
NAME              NODECLASS   NODES   READY   AGE   WEIGHT   CPU   MEMORY
general-purpose   default     0       True    56m            0     0
system            default     0       True    56m            0     0

### Node
$ kubectl get nodes -o wide
No resources found

### Namespace
$ kubectl get namespace
NAME              STATUS   AGE
default           Active   60m
kube-node-lease   Active   60m
kube-public       Active   60m
kube-system       Active   60m

$ kubectl get pods -A -o wide
No resources found

apiVersion: v1
kind: Namespace
metadata:
  name: nginx
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  namespace: nginx
spec:
  selector:
    matchLabels:
      app: nginx-pod
  template:
    metadata:
      labels:
        app: nginx-pod
    spec:
      containers:
        - name: nginx
          image: nginx:latest
          imagePullPolicy: Always
          ports:
            - containerPort: 80
          resources:
            limits:
              memory: '512Mi'
              cpu: '0.2'
            requests:
              memory: '256Mi'
              cpu: '0.1'
---
apiVersion: v1
kind: Service
metadata:
  name: nginx-svc
  namespace: nginx
spec:
  type: ClusterIP
  selector:
    app: nginx-pod
  ports:
    - name: http
      protocol: TCP
      port: 80
      targetPort: 80

### ノード 確認
$ kubectl get nodes -o wide
NAME                  STATUS   ROLES    AGE   VERSION               INTERNAL-IP    EXTERNAL-IP   OS-IMAGE                                          KERNEL-VERSION   CONTAINER-RUNTIME
i-0a6b078d4c199f378   Ready    <none>   11m   v1.31.6-eks-aad632c   10.0.128.172   <none>        Bottlerocket (EKS Auto) 2025.1.9 (aws-k8s-1.31)   6.1.131          containerd://1.7.27+bottlerocket

### Pod 確認
$ kubectl get pods -A -o wide
NAMESPACE   NAME                                READY   STATUS    RESTARTS   AGE   IP             NODE                  NOMINATED NODE   READINESS GATES
nginx       nginx-deployment-7987c95c7f-qrsgv   1/1     Running   0          11m   10.0.128.192   i-0a6b078d4c199f378   <none>           <none>

apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  name: alb
  labels:
    app.kubernetes.io/name: LoadBalancerController
spec:
  controller: eks.amazonaws.com/alb

$ kubectl apply -f ingress-class.yaml
ingressclass.networking.k8s.io/alb created

$ kubectl get ingressclass -o wide
NAME   CONTROLLER              PARAMETERS   AGE
alb    eks.amazonaws.com/alb   <none>       2m34s

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: nginx-ingress
  namespace: nginx
  annotations:
    alb.ingress.kubernetes.io/load-balancer-name: nginx-ingress
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
spec:
  ingressClassName: alb
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: nginx-svc
                port:
                  number: 80

$ kubectl get ingress -n nginx -o wide
NAME            CLASS   HOSTS   ADDRESS                                                    PORTS   AGE
nginx-ingress   alb     *       nginx-ingress-746646965.ap-northeast-1.elb.amazonaws.com   80      4m4s

apiVersion: karpenter.k8s.aws/v1
kind: EC2NodeClass
metadata:
  name: default
spec:
  ### AMI ファミリ
  amiFamily: AL2

  ### インスタンスに接続するサブネット（subnetSelectorTerms の配列内は OR で結合され、一つの Term は AND で結合される）
  subnetSelectorTerms:
    - tags:
        karpenter.sh/discovery: '${CLUSTER_NAME}'

  ### インスタンスにアタッチするセキュリティグループ
  securityGroupSelectorTerms:
    - tags:
        karpenter.sh/discovery: '${CLUSTER_NAME}'

  ### NodeID に使用する IAM インスタンスプロファイル（Role または instanceProfile のいずれかを指定する）
  instanceProfile: 'KarpenterNodeInstanceProfile-${CLUSTER_NAME}'

apiVersion: karpenter.sh/v1
kind: NodePool
metadata:
  name: default
spec:
  template:
    metadata:
      ### 全てのノードに付与されるラベル属性
      labels:
        role: app

      ### 全てのノードに付与されるアノテーション属性
      annotations:
        example.com/owner: 'my-team'

    spec:
      ### 参照するクラウドプロバイダのノードクラス
      nodeClassRef:
        group: karpenter.k8s.aws
        kind: EC2NodeClass
        name: default

      ### 必要に応じて Taints ラベルを付与することで Pod 配置を制御
      taints:
        - key: example.com/special-taint
          effect: NoSchedule

      ### ノードの初期化開始時に追加される Pod は Taints ラベルを許容し、完了後に Taints を削除する
      startupTaints:
        - key: example.com/another-taint
          effect: NoSchedule

      ### ノードが削除されるまでの生存期間（Never を設定すると有効期限を無効にできるがセキュリティ上の懸念が生じる）
      expireAfter: 720h | Never

      ### ノードが強制削除されるまでのドレイン期間（削除命令が実行されるとノードのドレインを開始する）
      terminationGracePeriod: 48h

      ### プロビジョニングされたノードのパラメータを制限（see: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#operators）
      requirements:
        - key: 'karpenter.k8s.aws/instance-category'
          operator: In
          values: ['c', 'm', 'r']
        - key: 'karpenter.k8s.aws/instance-cpu'
          operator: In
          values: ['4', '8', '16', '32']
        - key: 'karpenter.k8s.aws/instance-hypervisor'
          operator: In
          values: ['nitro']
        - key: 'karpenter.k8s.aws/instance-generation'
          operator: Gt
          values: ['2']
        - key: 'topology.kubernetes.io/zone'
          operator: In
          values: ['us-west-2a', 'us-west-2b']
        - key: 'kubernetes.io/arch'
          operator: In
          values: ['arm64', 'amd64']
        - key: 'karpenter.sh/capacity-type'
          operator: In
          values: ['spot', 'on-demand']

  ### Karpenter が統合対象とするノードの種類（不要なキャパシティを削減してコストを最適化します）
  disruption:
    consolidationPolicy: WhenEmptyOrUnderutilized

    ### Pod がノードに追加・削除された後 Karpenter がノードを統合するまでの待機時間
    consolidateAfter: 1m

    ### Karpenter がノードをスケールダウンできる速度を制御
    budgets:
      - nodes: 10%
      - schedule: '0 9 * * mon-fri' ### 例：平日の AM 9:00 から 8 時間はデプロビジョニングさせない
        duration: 8h
        nodes: '0'

  ### クラスタの合計リソース数を定義（limits を超えて Karpenter はノードを追加できません）
  limits:
    cpu: '1000'
    memory: 1000Gi

  ### 選択される NodePool の優先順位（指定しない場合は weight=0 となり、値が大きいほど優先順位が高くなる）
  weight: 10

apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
  name: balloon
spec:
  cooldownPeriod: 300
  minReplicaCount: 0
  scaleTargetRef:
    name: balloon
  triggers:
    - metadata:
        desiredReplicas: '3'
        start: 30 8 * * *
        end: 00 18 * * *
        timezone: Asia/Tokyo
      type: cron

$ kubectl get node -o wide -w
NAME                  STATUS   ROLES    AGE    VERSION               INTERNAL-IP    EXTERNAL-IP   OS-IMAGE                                           KERNEL-VERSION   CONTAINER-RUNTIME
i-0e3fe4ed33df707d6   Ready    <none>   2d9h   v1.31.6-eks-aad632c   10.0.128.112   <none>        Bottlerocket (EKS Auto) 2025.1.11 (aws-k8s-1.31)   6.1.131          containerd://1.7.27+bottlerocket
i-0e3fe4ed33df707d6   Ready    <none>   2d9h   v1.31.6-eks-aad632c   10.0.128.112   <none>        Bottlerocket (EKS Auto) 2025.1.11 (aws-k8s-1.31)   6.1.131          containerd://1.7.27+bottlerocket
i-0c776b6e149074eb8   Ready    <none>   87s    v1.32.2-eks-677bac1   10.0.155.140   <none>        Bottlerocket (EKS Auto) 2025.1.11 (aws-k8s-1.32)   6.1.131          containerd://1.7.27+bottlerocket