Deploy Fluent Bit DaemonSet with CloudWatch

2MFA/main.tf

@@ -38,7 +38,7 @@ variable "apply_to_all_users" {
 # ============================================================================
 terraform {
   required_version = ">= 1.0"
-  
+
   required_providers {
     aws = {
       source  = "hashicorp/aws"
@@ -66,7 +66,7 @@ data "aws_iam_policy_document" "require_mfa" {
   statement {
     sid    = "DenyAllExceptMFASetupWithoutMFA"
     effect = "Deny"
-    
+
     not_actions = [
       "iam:CreateVirtualMFADevice",
       "iam:EnableMFADevice",
@@ -80,52 +80,52 @@ data "aws_iam_policy_document" "require_mfa" {
       "iam:GetAccountSummary",
       "iam:ListAccountAliases",
     ]
-    
+
     resources = ["*"]
-    
+
     condition {
       test     = "BoolIfExists"
       variable = "aws:MultiFactorAuthPresent"
       values   = ["false"]
     }
   }
-  
+
   # Allow viewing account information
   statement {
     sid    = "AllowViewAccountInfo"
     effect = "Allow"
-    
+
     actions = [
       "iam:GetAccountPasswordPolicy",
       "iam:GetAccountSummary",
       "iam:ListVirtualMFADevices",
       "iam:ListAccountAliases",
     ]
-    
+
     resources = ["*"]
   }
-  
+
   # Allow managing own passwords and access keys
   statement {
     sid    = "AllowManageOwnPasswordsAndAccessKeys"
     effect = "Allow"
-    
+
     actions = [
       "iam:ChangePassword",
       "iam:GetUser",
       "iam:GetLoginProfile",
     ]
-    
+
     resources = [
       "arn:aws:iam::${data.aws_caller_identity.current.account_id}:user/$${aws:username}"
     ]
   }
-  
+
   # Allow managing own MFA devices
   statement {
     sid    = "AllowManageOwnMFADevices"
     effect = "Allow"
-    
+
     actions = [
       "iam:CreateVirtualMFADevice",
       "iam:DeleteVirtualMFADevice",
@@ -134,7 +134,7 @@ data "aws_iam_policy_document" "require_mfa" {
       "iam:ResyncMFADevice",
       "iam:DeactivateMFADevice",
     ]
-    
+
     resources = [
       "arn:aws:iam::${data.aws_caller_identity.current.account_id}:mfa/$${aws:username}",
       "arn:aws:iam::${data.aws_caller_identity.current.account_id}:user/$${aws:username}",
@@ -175,7 +175,7 @@ resource "aws_iam_group_policy_attachment" "mfa_enforcement" {
 # ============================================================================
 resource "aws_iam_group_membership" "mfa_required_users" {
   count = length(var.users_requiring_mfa) > 0 ? 1 : 0
-  
+
   name  = "${var.mfa_required_group_name}-membership"
   group = aws_iam_group.mfa_required.name
   users = var.users_requiring_mfa
@@ -185,7 +185,7 @@ resource "aws_iam_group_membership" "mfa_required_users" {
 # ============================================================================
 resource "aws_iam_user_policy_attachment" "mfa_all_users" {
   for_each = var.apply_to_all_users ? toset(data.aws_iam_users.all[0].names) : toset([])
-  
+
   user       = each.value
   policy_arn = aws_iam_policy.require_mfa.arn
 }

2MFA/mfa.tf

@@ -1,4 +1,4 @@
-aws_region               = "us-east-1"
+aws_region              = "us-east-1"
 mfa_policy_name         = "RequireMFAPolicy"
 mfa_required_group_name = "MFARequiredUsers"
 

READme.m

@@ -0,0 +1,39 @@
+ Fluent Bit DaemonSet Deployment
+This deploys Fluent Bit as a DaemonSet to collect logs from all Kubernetes pods and send them to AWS CloudWatch.
+
+Prerequisites
+- AWS CLI configured
+- kubectl configured for dev-test-eks cluster
+- Terraform installed
+
+Deployment Steps
+
+1. Update `terraform.tfvars` with your node group name
+2. Initialize Terraform:
+```bash
+   terraform init
+```
+3. Validate configuration:
+```bash
+   terraform validate
+```
+4. Deploy:
+```bash
+   terraform apply
+```
+
+Verification
+```bash
+kubectl get daemonset fluent-bit -n kube-system
+kubectl get pods -n kube-system -l k8s-app=fluent-bit
+kubectl logs -n kube-system -l k8s-app=fluent-bit --tail=50
+```
+
+Check CloudWatch: https://console.aws.amazon.com/cloudwatch/home?region=us-east-1#logsV2:log-groups/log-group/kubernetes-logs
+
+Resources Created
+- CloudWatch Log Group: kubernetes-logs
+- IAM Policy: FluentBitCloudWatchPolicy
+- Kubernetes ServiceAccount, ClusterRole, ClusterRoleBinding
+- ConfigMap with Fluent Bit configuration
+- DaemonSet running Fluent Bit on all nodes

bank-infra/backend.tf

@@ -2,7 +2,7 @@ terraform {
   required_version = ">= 1.10.0"
 
   backend "s3" {
-    bucket       = "pod4bankapp-tfstate-bucket"   # must be created first
+    bucket       = "pod4bankapp-tfstate-bucket" # must be created first
     key          = "envs/dev/terraform.tfstate"
     region       = "us-east-1"
     use_lockfile = true

bank-infra/bootstrap/terraform.tfvars

@@ -1,5 +1,5 @@
-project              = "pod4bankapp"
-environment          = "bootstrap"
-aws_region           = "us-east-1"
-bucket_name          = "pod4bankapp-tfstate-bucket"
-dynamodb_table_name  = "pod4bankapp-tf-locks"
+project             = "pod4bankapp"
+environment         = "bootstrap"
+aws_region          = "us-east-1"
+bucket_name         = "pod4bankapp-tfstate-bucket"
+dynamodb_table_name = "pod4bankapp-tf-locks"

bank-infra/dev/01-provider.tf

@@ -6,21 +6,21 @@
 terraform {
   required_providers {
     namecheap = {
-      source = "namecheap/namecheap"
+      source  = "namecheap/namecheap"
       version = "2.2.0"
     }
     aws = {
-      source = "hashicorp/aws"
+      source  = "hashicorp/aws"
       version = "6.0.0-beta2"
     }
   }
 }
 
 provider "namecheap" {
-  user_name = var.namecheap_username
-  api_user = var.namecheap_api_user
-  api_key = var.namecheap_api_key
-  client_ip = var.namecheap_client_ip
+  user_name   = var.namecheap_username
+  api_user    = var.namecheap_api_user
+  api_key     = var.namecheap_api_key
+  client_ip   = var.namecheap_client_ip
   use_sandbox = false
 }
 provider "aws" {

bank-infra/dev/main.tf

@@ -1,57 +1,57 @@
 # Creating a VPC and EKS cluster using Terraform
 module "vpc-deployment" {
-    source = "./module-vpc"
-    
-    environment = var.environment
-    vpc_cidrblock = var.vpc_cidrblock
-    countsub = var.countsub
-    create_subnet = var.create_subnet
-    create_elastic_ip = var.create_elastic_ip
-  
+  source = "./module-vpc"
+
+  environment       = var.environment
+  vpc_cidrblock     = var.vpc_cidrblock
+  countsub          = var.countsub
+  create_subnet     = var.create_subnet
+  create_elastic_ip = var.create_elastic_ip
+
 }
 
 #creating an EKS cluster using Terraform
 # and deploying it in the VPC created above
 module "eks-deployment" {
-    source = "./module-eks"
-    
-    environment = var.environment
-    vpc_cidrblock = var.vpc_cidrblock
-    countsub = var.countsub
-    create_subnet = var.create_subnet
-    create_elastic_ip = var.create_elastic_ip
-    desired_size = var.desired_size
-    max_size = var.max_size
-    min_size = var.min_size
-    instance_types = var.instance_types
-    capacity_type = var.capacity_type
-    public_subnet_ids  = module.vpc-deployment.public_subnet_ids
-    private_subnet_ids = module.vpc-deployment.private_subnet_ids
-    cluster_name = var.cluster_name
-    repository_name = var.repository_name
-    domain-name = var.domain-name
-    email = var.email
-  
+  source = "./module-eks"
+
+  environment        = var.environment
+  vpc_cidrblock      = var.vpc_cidrblock
+  countsub           = var.countsub
+  create_subnet      = var.create_subnet
+  create_elastic_ip  = var.create_elastic_ip
+  desired_size       = var.desired_size
+  max_size           = var.max_size
+  min_size           = var.min_size
+  instance_types     = var.instance_types
+  capacity_type      = var.capacity_type
+  public_subnet_ids  = module.vpc-deployment.public_subnet_ids
+  private_subnet_ids = module.vpc-deployment.private_subnet_ids
+  cluster_name       = var.cluster_name
+  repository_name    = var.repository_name
+  domain-name        = var.domain-name
+  email              = var.email
+
 }
 
 module "namecheap-deployment" {
-    source = "./module-dns"
-    environment = var.environment
-    domain-name = var.domain-name
-    nginx_lb_ip = module.eks-deployment.nginx_lb_ip
-    nginx_ingress_load_balancer_hostname = module.eks-deployment.nginx_ingress_load_balancer_hostname
-    nginx_ingress_lb_dns = module.eks-deployment.nginx_ingress_lb_dns
-  
+  source                               = "./module-dns"
+  environment                          = var.environment
+  domain-name                          = var.domain-name
+  nginx_lb_ip                          = module.eks-deployment.nginx_lb_ip
+  nginx_ingress_load_balancer_hostname = module.eks-deployment.nginx_ingress_load_balancer_hostname
+  nginx_ingress_lb_dns                 = module.eks-deployment.nginx_ingress_lb_dns
+
 }
 
 module "rds-mysql-deployment" {
-    source = "./module-database"
-    environment = var.environment
-    db_instance_class = var.db_instance_class
-    db_allocated_storage = var.db_allocated_storage
-    private_subnet_db_ids = module.vpc-deployment.private_subnet_db_ids
-    db_name =  var.db_name
-    db_password = var.db_password
-    db_username = var.db_username
-    aws_security_group_ids = module.vpc-deployment.aws_security_group_ids
+  source                 = "./module-database"
+  environment            = var.environment
+  db_instance_class      = var.db_instance_class
+  db_allocated_storage   = var.db_allocated_storage
+  private_subnet_db_ids  = module.vpc-deployment.private_subnet_db_ids
+  db_name                = var.db_name
+  db_password            = var.db_password
+  db_username            = var.db_username
+  aws_security_group_ids = module.vpc-deployment.aws_security_group_ids
 }

bank-infra/dev/terraform.tfvars

@@ -1,17 +1,17 @@
-environment = "production"
-vpc_cidrblock = "192.168.0.0/16"
-countsub = 2
-create_subnet = true
+environment       = "production"
+vpc_cidrblock     = "192.168.0.0/16"
+countsub          = 2
+create_subnet     = true
 create_elastic_ip = true
-desired_size = 2
-max_size = 6
-min_size = 2
-instance_types = ["t2.medium"]
-capacity_type = "ON_DEMAND"
-ami_type = "AL2_x86_64" 
-label_one = "system-nodepool"
-eks_version = "1.32"
-domain-name = "cloudwitches.online"
-cluster_name = "eks-cluster"
-repository_name = "eks-repository"
-email = "support@digitalwitchng.online"
+desired_size      = 2
+max_size          = 6
+min_size          = 2
+instance_types    = ["t2.medium"]
+capacity_type     = "ON_DEMAND"
+ami_type          = "AL2_x86_64"
+label_one         = "system-nodepool"
+eks_version       = "1.32"
+domain-name       = "cloudwitches.online"
+cluster_name      = "eks-cluster"
+repository_name   = "eks-repository"
+email             = "support@digitalwitchng.online"