terraform: add aws-eks-operator #44

clstokes · 2025-12-19T18:02:42Z

No description provided.

clstokes · 2025-12-20T01:41:10Z

@rajsinghtech, I'd appreciate your review when you have a chance.

Copilot

Pull request overview

This PR adds a new Terraform module for deploying an AWS EKS cluster with the Tailscale Kubernetes operator, enabling secure cluster access through Tailscale's mesh network.

Introduces a complete Terraform configuration for EKS with Tailscale operator integration
Configures provider authentication using AWS EKS token-based authentication
Includes comprehensive documentation with deployment and verification instructions

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
terraform/aws/aws-eks-operator/versions.tf	Defines Terraform version constraints and configures AWS, Kubernetes, and Helm providers with EKS authentication
terraform/aws/aws-eks-operator/variables.tf	Declares Tailscale OAuth credentials as sensitive variables with validation rules
terraform/aws/aws-eks-operator/outputs.tf	Exports VPC ID, cluster name, namespace, and kubeconfig commands for cluster access
terraform/aws/aws-eks-operator/main.tf	Implements the main infrastructure including VPC, EKS cluster, and Tailscale operator Helm deployment
terraform/aws/aws-eks-operator/README.md	Provides comprehensive documentation for prerequisites, deployment steps, and verification procedures

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

terraform/aws/aws-eks-operator/versions.tf

terraform/aws/aws-eks-operator/main.tf

terraform/aws/aws-eks-operator/outputs.tf

terraform/aws/aws-eks-operator/README.md

terraform/aws/aws-eks-operator/outputs.tf

Copilot

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

terraform/aws/aws-eks-operator/README.md

terraform/aws/aws-eks-operator/main.tf

Copilot

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 12 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

terraform/aws/aws-eks-operator/main.tf

terraform/aws/aws-eks-operator/variables.tf

terraform/aws/aws-eks-operator/README.md

Makefile

terraform/aws/aws-eks-operator/main.tf

terraform/aws/aws-eks-operator/variables.tf

terraform/aws/aws-eks-operator/versions.tf

terraform/aws/aws-eks-operator/main.tf

Copilot

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

terraform/aws/aws-eks-operator/main.tf

terraform/aws/aws-eks-operator/README.md

terraform/aws/aws-eks-operator/main.tf

Co-authored-by: Copilot <[email protected]>

…ples-infrastructure-as-code into clstokes/eks-operator

rajsinghtech · 2025-12-26T10:50:26Z

Looks pretty good, thanks @clstokes, there is much more we could expand on here, for example run a kind: connector resource and advertise the pod and service cidr's via an app connector for the cluster domain of cluster.local or setup the proxygroup ingress and egress and dnsconfig so that ts.net resolves.

WIll approve for now but please review the feedback 🥇

rajsinghtech · 2025-12-26T10:18:55Z

terraform/aws/aws-eks-operator/main.tf

+      }
+      apiServerProxyConfig = {
+        mode = true
+        tags = "tag:k8s-operator,tag:k8s-api-server"


Why are you setting tag here? this field doesn't even exist please see https://github.com/tailscale/tailscale/blob/main/cmd/k8s-operator/deploy/chart/values.yaml#L131

in addition tag:k8s-api-server is outside of the scope of what our documented used tags are.

rajsinghtech · 2025-12-26T10:23:44Z

terraform/aws/aws-eks-operator/main.tf

+    yamlencode({
+      operatorConfig = {
+        image = {
+          repo = "tailscale/k8s-operator"


Suggested change

repo = "tailscale/k8s-operator"

repository = "tailscale/k8s-operator"

https://github.com/tailscale/tailscale/blob/main/cmd/k8s-operator/deploy/chart/values.yaml#L52
In helm u can fill the values with stuff that doesnt exist and things will silently still work. So you likely weren't running into issues for these reasons.

rajsinghtech · 2025-12-26T10:29:45Z

terraform/aws/aws-eks-operator/outputs.tf

+output "cmd_kubectl_ha_proxy_apply" {
+  description = "Command to deploy the Tailscale high availability API server proxy - https://tailscale.com/kb/1437/kubernetes-operator-api-server-proxy#configuring-a-high-availability-api-server-proxy"
+  value       = "OPERATOR_NAME=${helm_release.tailscale_operator.name} envsubst < tailscale-api-server-ha-proxy.yaml | kubectl apply -f -"
+}
+
+output "cmd_kubectl_ha_proxy_delete" {
+  description = "Command to delete the Tailscale high availability API server proxy - https://tailscale.com/kb/1437/kubernetes-operator-api-server-proxy#configuring-a-high-availability-api-server-proxy"
+  value       = "OPERATOR_NAME=${helm_release.tailscale_operator.name} envsubst < tailscale-api-server-ha-proxy.yaml | kubectl delete -f -"


Suggested change

output "cmd_kubectl_ha_proxy_apply" {

description = "Command to deploy the Tailscale high availability API server proxy - https://tailscale.com/kb/1437/kubernetes-operator-api-server-proxy#configuring-a-high-availability-api-server-proxy"

value = "OPERATOR_NAME=${helm_release.tailscale_operator.name} envsubst < tailscale-api-server-ha-proxy.yaml | kubectl apply -f -"

}

output "cmd_kubectl_ha_proxy_delete" {

description = "Command to delete the Tailscale high availability API server proxy - https://tailscale.com/kb/1437/kubernetes-operator-api-server-proxy#configuring-a-high-availability-api-server-proxy"

value = "OPERATOR_NAME=${helm_release.tailscale_operator.name} envsubst < tailscale-api-server-ha-proxy.yaml | kubectl delete -f -"

output "cmd_kubectl_ha_proxy_apply" {

description = "Command to deploy the Tailscale high availability API server proxy - https://tailscale.com/kb/1437/kubernetes-operator-api-server-proxy#configuring-a-high-availability-api-server-proxy"

value = "HA_PROXY_SERVICE_NAME=${local.ha_proxy_service_name} envsubst < tailscale-api-server-ha-proxy.yaml | kubectl apply -f -"

}

output "cmd_kubectl_ha_proxy_delete" {

description = "Command to delete the Tailscale high availability API server proxy - https://tailscale.com/kb/1437/kubernetes-operator-api-server-proxy#configuring-a-high-availability-api-server-proxy"

value = "HA_PROXY_SERVICE_NAME=${local.ha_proxy_service_name} envsubst < tailscale-api-server-ha-proxy.yaml | kubectl delete -f -"

Untested but I think this is correct

rajsinghtech · 2025-12-26T10:35:47Z

terraform/aws/aws-eks-operator/README.md

+
+```shell
+kubectl get pods -n tailscale
+kubectl logs -n tailscale -l app.kubernetes.io/name=$(terraform output -raw operator_name)


Suggested change

kubectl logs -n tailscale -l app.kubernetes.io/name=$(terraform output -raw operator_name)

kubectl logs -n tailscale -l app=operator

is probably easier

rajsinghtech · 2025-12-26T10:43:00Z

terraform/aws/aws-eks-operator/README.md

+After deployment, configure kubectl to access your cluster using Tailscale:
+
+```shell
+tailscale configure kubeconfig ${terraform output -raw operator_name}


Suggested change

tailscale configure kubeconfig ${terraform output -raw operator_name}

tailscale configure kubeconfig $(terraform output -raw operator_name)

command substitution is ( not {

rajsinghtech · 2025-12-26T10:48:15Z

terraform/aws/aws-eks-operator/main.tf

+        hostname = local.operator_name
+      }
+      apiServerProxyConfig = {
+        mode = true


Suggested change

mode = true

mode = "true"

allowImpersonation = "true"

https://github.com/tailscale/tailscale/blob/main/cmd/k8s-operator/deploy/chart/values.yaml#L132 defualts to false but because your using proxygroup in auth mode you will need cluster roles created and allow impersonation.

spec: type: kube-apiserver kubeAPIServer: mode: auth

clstokes added 4 commits December 19, 2025 13:02

terraform: add aws-eks

59b3f84

rename aws-eks to aws-eks-operator

9bb7067

Merge branch 'main' into clstokes/eks-operator

dc27e4b

cleanup and tflint fixes

1b49a5b

clstokes changed the title ~~terraform: add aws-eks~~ terraform: add aws-eks-operator Dec 20, 2025

terraform fmt

386d6c6

clstokes mentioned this pull request Dec 20, 2025

Implement AWS EKS Tailscale Operator setup with Terraform #38

Closed

clstokes marked this pull request as ready for review December 20, 2025 01:40

clstokes requested review from Copilot and rajsinghtech December 20, 2025 01:40

Copilot started reviewing on behalf of clstokes December 20, 2025 01:41 View session

Copilot AI reviewed Dec 20, 2025

View reviewed changes

clstokes added 3 commits December 21, 2025 07:40

address most copilot feedback

849beaa

rename terraform-tflint to terraform-check-tflint

b4741ac

tflint

42dded2

clstokes requested a review from Copilot December 21, 2025 12:48

Copilot started reviewing on behalf of clstokes December 21, 2025 12:48 View session

This comment was marked as resolved.

Sign in to view

address more copilot feedback

110e277

clstokes requested a review from Copilot December 21, 2025 14:29

Copilot started reviewing on behalf of clstokes December 21, 2025 14:29 View session

This comment was marked as resolved.

Sign in to view

move ha proxy to external kubectl manifest, and various cleanup

657078d

clstokes requested a review from Copilot December 21, 2025 16:06

Copilot started reviewing on behalf of clstokes December 21, 2025 16:07 View session

Copilot AI reviewed Dec 21, 2025

View reviewed changes

terraform/aws/aws-eks-operator/README.md Show resolved Hide resolved

terraform/aws/aws-eks-operator/main.tf Outdated Show resolved Hide resolved

clstokes added 3 commits December 21, 2025 14:26

add 'terraform-fmt' to Makefile

431d846

add operator_name output

9c9b5c9

provision ha proxy with null_resource local-exec provisioner

e51384a

clstokes requested a review from Copilot December 21, 2025 22:49

Copilot started reviewing on behalf of clstokes December 21, 2025 22:49 View session

This comment was marked as resolved.

Sign in to view

clstokes added 5 commits December 21, 2025 22:34

cleanup

6ac0452

Update Makefile

0fadf5b

use a random suffix for ha proxy name

ea8dc02

fix tflint issue

d0b1672

use aws_eks_cluster_versions data source for latest version

d0fdb41

clstokes requested a review from Copilot December 23, 2025 14:43

Copilot started reviewing on behalf of clstokes December 23, 2025 14:43 View session

Copilot AI reviewed Dec 23, 2025

View reviewed changes

clstokes added 4 commits December 23, 2025 07:10

update prerequisites

e3a880c

add enable_ha_proxy_service local variable

835bf8f

remove beta from api_version for aws auth call

2982944

use a data source instead of aws cli

3ac53c2

clstokes requested a review from Copilot December 23, 2025 16:55

Copilot started reviewing on behalf of clstokes December 23, 2025 16:56 View session

Copilot AI reviewed Dec 23, 2025

View reviewed changes

terraform/aws/aws-eks-operator/main.tf Show resolved Hide resolved

terraform/aws/aws-eks-operator/README.md Outdated Show resolved Hide resolved

terraform/aws/aws-eks-operator/README.md Outdated Show resolved Hide resolved

terraform/aws/aws-eks-operator/main.tf Show resolved Hide resolved

clstokes and others added 3 commits December 23, 2025 09:45

Update terraform/aws/aws-eks-operator/README.md

473ecfc

Co-authored-by: Copilot <[email protected]>

Update README.md

c0dbf1c

Merge branch 'clstokes/eks-operator' of github.com:tailscale-dev/exam…

2c00fca

…ples-infrastructure-as-code into clstokes/eks-operator

clstokes requested a review from jaxxstorm December 23, 2025 21:09

jaxxstorm approved these changes Dec 23, 2025

View reviewed changes

rajsinghtech approved these changes Dec 26, 2025

View reviewed changes

	repo = "tailscale/k8s-operator"
	repository = "tailscale/k8s-operator"

	kubectl logs -n tailscale -l app.kubernetes.io/name=$(terraform output -raw operator_name)
	kubectl logs -n tailscale -l app=operator

	tailscale configure kubeconfig ${terraform output -raw operator_name}
	tailscale configure kubeconfig $(terraform output -raw operator_name)

terraform: add aws-eks-operator #44

Are you sure you want to change the base?

terraform: add aws-eks-operator #44

Uh oh!

Conversation

clstokes commented Dec 19, 2025

Uh oh!

clstokes commented Dec 20, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rajsinghtech commented Dec 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rajsinghtech Dec 26, 2025

Choose a reason for hiding this comment

Uh oh!

rajsinghtech Dec 26, 2025

Choose a reason for hiding this comment

Uh oh!

rajsinghtech Dec 26, 2025

Choose a reason for hiding this comment

Uh oh!

rajsinghtech Dec 26, 2025

Choose a reason for hiding this comment

Uh oh!

rajsinghtech Dec 26, 2025

Choose a reason for hiding this comment

Uh oh!

rajsinghtech Dec 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

rajsinghtech commented Dec 26, 2025 •

edited

Loading

rajsinghtech Dec 26, 2025 •

edited

Loading