Terraform-aws-eks: Add support for adding container insights

[cplee]

I have issues

I'm submitting a...

• [ ] bug report
• [x] feature request
• [ ] support request
• [ ] kudos, thank you, warm fuzzy

What is the current behavior?

I'd like to add support to provision the necessary resources within the cluster to enable Container Insights.

Before I begin, i'm looking for feedback on my approach:

• New module variable named cluster_container_insights_metrics to turn on feature (default == false)
• Update the cluster IAM role to include the policy CloudWatchAgentServerPolicy (assuming manage_cluster_iam_resources == true)
• If enabled, provision the necessary serviceaccount, clusterrole, clusterrolebinding, configmap, daemonset for Container Insights (see: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Container-Insights-setup-EKS-quickstart.html)
• New module variable named cluster_container_insights_logs to turn on feature (default == false)
• If enabled, provision the necessary serviceaccount, clusterrole, clusterrolebinding, configmap, daemonset for Container Insights logs(see: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Container-Insights-setup-logs.html)

If this is a bug, how to reproduce? Please include a code sample if relevant.

What's the expected behavior?

When enabled, the cluster has container insights metrics and/or logs configured for the cluster

Are you able to fix this problem and submit a PR? Link here if you have already.

Yes, once I hear 👍

Environment details

• Affected module version:
• OS:
• Terraform version:

Any other relevant info

[cplee]

I'm second guessing this idea. Since container insights is still using fluentd, you'll find that it takes a significant amount of resources to run within your cluster. I propose putting this on hold until fluent bit becomes an option for container insights...assuming that is on the roadmap.

[max-rocket-internet]

Hi @cplee!

I'm always open to be persuaded but my feeling here would be to not include this. The reasons are covered in https://github.com/terraform-aws-modules/terraform-aws-eks/issues/99 but I'll reiterate here:

• This module is already complicated enough
• If we add this then why not Sysdig? and New Relic?
• There are already much better tools for this that manage installation, upgrades and different settings (Helm)

I would suggest you make a Helm Chart for Container Insights 🙂

[max-rocket-internet]

Also, FYI there's already a cloudwatch pluging for fluent-bit: https://github.com/aws/amazon-cloudwatch-logs-for-fluent-bit

[cplee]

Sounds good, thanks

[max-rocket-internet]

@moniecodes I think you are mixing up ECS and EKS.

[moniecodes]

Yes, I just noticed this and deleted my comment! arg, wishful thinking.. I imagine if it was available so simply support would have been already added. Thanks