AWSTemplateFormatVersion: '2010-09-09'
Description: 'VPC Infrastructure for EKS'

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.2.0.0/16
      EnableDnsHostnames: true
      EnableDnsSupport: true
      InstanceTenancy: default
      Tags:
        - Key: Name
          Value: gsn-eks-vpc

  PublicSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.2.0.0/20
      AvailabilityZone: ap-northeast-2a
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: gsn-eks-subnet-public1-ap-northeast-2a

  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.2.16.0/20
      AvailabilityZone: ap-northeast-2c
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: gsn-eks-subnet-public2-ap-northeast-2c

  PrivateSubnet1:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.2.128.0/20
      AvailabilityZone: ap-northeast-2a
      Tags:
        - Key: Name
          Value: gsn-eks-subnet-private1-ap-northeast-2a

  PrivateSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.2.144.0/20
      AvailabilityZone: ap-northeast-2c
      Tags:
        - Key: Name
          Value: gsn-eks-subnet-private2-ap-northeast-2c

  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: gsn-eks-igw

  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway

  EIP:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: Name
          Value: gsn-eks-eip-ap-northeast-2a

  NATGateway:
    Type: AWS::EC2::NatGateway
    DependsOn: AttachGateway
    Properties:
      AllocationId: !GetAtt EIP.AllocationId
      SubnetId: !Ref PublicSubnet1
      Tags:
        - Key: Name
          Value: gsn-eks-nat-public1-ap-northeast-2a

  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: gsn-eks-rtb-public

  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway

  PublicSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet1
      RouteTableId: !Ref PublicRouteTable

  PublicSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PublicSubnet2
      RouteTableId: !Ref PublicRouteTable

  PrivateRouteTable1:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: gsn-eks-rtb-private1-ap-northeast-2a

  PrivateRouteTable2:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: gsn-eks-rtb-private2-ap-northeast-2c

  PrivateRoute1:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable1
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NATGateway

  PrivateRoute2:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId: !Ref PrivateRouteTable2
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId: !Ref NATGateway

  PrivateSubnet1RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet1
      RouteTableId: !Ref PrivateRouteTable1

  PrivateSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref PrivateSubnet2
      RouteTableId: !Ref PrivateRouteTable2

AWSTemplateFormatVersion: '2010-09-09'
Description: 'CloudFormation template to create IAM Roles for EKS Cluster and Node Group'

Resources:
  ROLEEKSClusterAutomode:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: 'ROLE-EKS-CLUSTER-AUTOMODE'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: eks.amazonaws.com
            Action:
              - 'sts:AssumeRole'
              - 'sts:TagSession'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
        - arn:aws:iam::aws:policy/AmazonEKSComputePolicy
        - arn:aws:iam::aws:policy/AmazonEKSBlockStoragePolicy
        - arn:aws:iam::aws:policy/AmazonEKSLoadBalancingPolicy
        - arn:aws:iam::aws:policy/AmazonEKSNetworkingPolicy

  ROLEEKSNodeAutomode:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: 'ROLE-EKS-NODE-AUTOMODE'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: 'sts:AssumeRole'
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPullOnly
        - arn:aws:iam::aws:policy/AmazonEKSWorkerNodeMinimalPolicy

Outputs:
  ClusterRoleArn:
    Description: ARN of the EKS Cluster Role
    Value: !GetAtt ROLEEKSClusterAutomode.Arn
    Export:
      Name: EKSClusterRoleArn

  NodeRoleArn:
    Description: ARN of the EKS Node Role
    Value: !GetAtt ROLEEKSNodeAutomode.Arn
    Export:
      Name: EKSNodeRoleArn

# A sample ClusterConfig file that creates a cluster with Auto Mode enabled.
apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig

metadata:
  name: GSN-AUTO-EKS
  region: ap-northeast-2
  version: "1.30"

# CloudFormation으로 생성된 IAM Role ARN 기입 (Cluster)
iam:
  serviceRoleARN: arn:aws:iam::000000000000:role/ROLE-EKS-CLUSTER-AUTOMODE

# CloudFormation으로 생성된 VPC, Subnet id 기입
vpc:
  id: "vpc-0775dcbf137ccfe00"
  clusterEndpoints:
    publicAccess: true
    privateAccess: false
  subnets:
    private:
      ap-northeast-2a:
          id: "subnet-0fb22b4b76037a045"
      ap-northeast-2c:
          id: "subnet-008be1cb5e3d63db2"

accessConfig:
  bootstrapClusterCreatorAdminPermissions: true # EKS 클러스터 생성자의 접근 권한 유무
  authenticationMode: API_AND_CONFIG_MAP
  accessEntries:
    - principalARN: arn:aws:iam::000000000000:user/gsn-user # AWS 콘솔 사용자 EKS 접근 허용
      accessPolicies:
        - policyARN: arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy
          accessScope:
            type: cluster

autoModeConfig:
  # defaults to false
  enabled: true
  # optional, defaults to [general-purpose, system].
  # To disable creation of nodePools, set it to the empty array ([]).
  nodePools: [general-purpose, system]
  # CloudFormation으로 생성된 IAM Role ARN 기입 (Node)
  nodeRoleARN: arn:aws:iam::000000000000:role/ROLE-EKS-NODE-AUTOMODE

# 클러스터 생성
eksctl create cluster -f eks-auto-cluster.yaml

---
apiVersion: eks.amazonaws.com/v1
kind: NodeClass
metadata:
  name: default
  labels:
    app.kubernetes.io/managed-by: eks
spec:
  # EBS 볼륨 설정
  ephemeralStorage:
    iops: 3000          # 초당 I/O 작업 수
    size: 80Gi          # 스토리지 크기
    throughput: 125     # 처리량(MiB/s)
  
  networkPolicy: DefaultAllow        # 기본 네트워크 정책 허용
  networkPolicyEventLogs: Disabled   # 네트워크 정책 이벤트 로깅 비활성화
  role: ROLE-EKS-NODE-AUTOMODE       # 노드에 적용될 IAM 역할
  
  # 보안 그룹 설정
  securityGroupSelectorTerms:
  - id: sg-03795c3ae3fec1252
  
  snatPolicy: Random    # SNAT 정책 설정
  
  # 서브넷 설정 (다중 AZ 구성)
  subnetSelectorTerms:
  - id: subnet-0fb22b4b76037a045
  - id: subnet-008be1cb5e3d63db2

---
apiVersion: karpenter.sh/v1
kind: NodePool
metadata:
  labels:
    app.kubernetes.io/managed-by: eks    # EKS에 의해 관리됨을 나타내는 라벨
  name: general-purpose                  # 일반 용도의 노드풀 이름
spec:
  # 노드 중단 관련 설정
  disruption:
    budgets:
    - nodes: 10%                         # 동시 중단 가능한 최대 노드 비율
    consolidateAfter: 30s                # 노드 통합 전 대기 시간
    consolidationPolicy: WhenEmptyOrUnderutilized  # 노드가 비었거나 활용도가 낮을 때 통합
  
  template:
    spec:
      expireAfter: 336h                  # 노드 만료 시간 (2주)
      nodeClassRef:                      # NodeClass 참조 설정
        group: eks.amazonaws.com
        kind: NodeClass
        name: default
      requirements:
      - key: karpenter.sh/capacity-type
        operator: In
        values: [on-demand]              # 온디맨드 인스턴스만 사용
      - key: eks.amazonaws.com/instance-category
        operator: In
        values: [c, m, r]                # c: 컴퓨팅 최적화, m: 범용, r: 메모리 최적화 인스턴스
      - key: eks.amazonaws.com/instance-generation
        operator: Gt
        values: ["4"]                    # 5세대 이상 인스턴스 사용
      - key: kubernetes.io/arch
        operator: In
        values: [amd64]                  # AMD64 아키텍처만 지원
      - key: kubernetes.io/os
        operator: In
        values: [linux]                  # Linux 운영체제만 지원
      terminationGracePeriod: 24h0m0s    # 노드 종료 전 유예 기간
---
apiVersion: karpenter.sh/v1
kind: NodePool
metadata:
  labels:
    app.kubernetes.io/managed-by: eks
  name: system
spec:
  # 노드 중단 관련 설정
  disruption:
    budgets:
    - nodes: 10%                     # 동시에 중단될 수 있는 최대 노드 비율
    consolidateAfter: 30s            # 노드 통합 전 대기 시간
    consolidationPolicy: WhenEmptyOrUnderutilized  # 노드가 비어있거나 활용도가 낮을 때 통합

  template:
    spec:
      expireAfter: 336h                  # 노드 만료 시간 (2주)
      nodeClassRef:                      # NodeClass 참조 설정
        group: eks.amazonaws.com
        kind: NodeClass
        name: default
      requirements:
      - key: karpenter.sh/capacity-type
        operator: In
        values: [on-demand]              # 온디맨드 인스턴스만 사용
      - key: eks.amazonaws.com/instance-category
        operator: In
        values: [c, m, r]                # c: 컴퓨팅 최적화, m: 범용, r: 메모리 최적화 인스턴스
      - key: eks.amazonaws.com/instance-generation
        operator: Gt
        values: ["4"]                    # 5세대 이상 인스턴스 사용
      - key: kubernetes.io/arch
        operator: In
        values: [amd64, arm64]           # AMD64, ARM64 아키텍처 모두 지원
      - key: kubernetes.io/os
        operator: In
        values: [linux]                  # Linux 운영체제만 지원
      # system 전용 워크로드 설정
      taints:                            
      - effect: NoSchedule
        key: CriticalAddonsOnly          # CriticalAddonsOnly taint를 통해 일반 워크로드의 스케줄링을 방지

      terminationGracePeriod: 24h0m0s    # 노드 종료 전 유예 기간 (draining)

# game-2048-service.yaml
---
apiVersion: v1
kind: Namespace
metadata:
  name: game-2048
  labels:
    name: game-2048
---
apiVersion: apps/v1
kind: Deployment
metadata:
  namespace: game-2048
  name: deployment-2048
spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: app-2048
  replicas: 3
  template:
    metadata:
      labels:
        app.kubernetes.io/name: app-2048
    spec:
      containers:
        - image: public.ecr.aws/l6m2t8p7/docker-2048:latest
          imagePullPolicy: Always
          name: app-2048
          ports:
            - containerPort: 80
          resources:
            requests:
              cpu: "1"       # 1vCPU
              memory: "2Gi"  # 2GiB
---
apiVersion: v1
kind: Service
metadata:
  namespace: game-2048
  name: service-2048
spec:
  ports:
    - port: 80
      targetPort: 80
      protocol: TCP
  type: NodePort
  selector:
    app.kubernetes.io/name: app-2048

# game-2048-ingress.yaml
---
apiVersion: networking.k8s.io/v1
kind: IngressClass
metadata:
  namespace: game-2048
  labels:
    app.kubernetes.io/name: LoadBalancerController
  name: alb
spec:
  controller: eks.amazonaws.com/alb
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  namespace: game-2048
  name: ingress-2048
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    # CloudFormation으로 생성된 Public Subnet 입력
    alb.ingress.kubernetes.io/subnets: subnet-05e52aea3d8b92bd6, subnet-001a37e7fa004843b
spec:
  ingressClassName: alb
  rules:
    - http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: service-2048
                port:
                  number: 80

# metrics-server repo 추가
helm repo add metrics-server https://kubernetes-sigs.github.io/metrics-server/

# helm install
helm upgrade --install metrics-server metrics-server/metrics-server \
  --namespace kube-system \
  --set nodeSelector."karpenter\.sh/nodepool"=system \
  --set 'tolerations[0].key=CriticalAddonsOnly' \
  --set 'tolerations[0].operator=Exists'

# helm delete (참고)
helm uninstall metrics-server -n kube-system

# spot-nodeclass_nodepool.yaml
---
apiVersion: eks.amazonaws.com/v1
kind: NodeClass
metadata:
  name: spot-class
  labels:
    app.kubernetes.io/managed-by: gsn
spec:
  # EBS 볼륨 설정 (동일)
  ephemeralStorage:
    iops: 3000
    size: 30Gi
    throughput: 125
  # networkPolicy 설정 (동일)
  networkPolicy: DefaultAllow
  networkPolicyEventLogs: Disabled
  # 노드에 적용될 IAM 역할 (동일)
  role: ROLE-EKS-NODE-AUTOMODE
  # 보안 그룹 설정 (동일)
  securityGroupSelectorTerms:
  - id: sg-03795c3ae3fec1252
  snatPolicy: Random    
  # 서브넷 설정 (동일)
  subnetSelectorTerms:
  - id: subnet-0fb22b4b76037a045
  - id: subnet-008be1cb5e3d63db2
---
apiVersion: karpenter.sh/v1
kind: NodePool
metadata:
  name: spot-purpose
  labels:
    app.kubernetes.io/managed-by: gsn
spec:
  weight: 10                             # 노드풀 가중치 설정 (우선적으로 Spot이 생성되도록 설정)
  disruption:
    budgets:
    - nodes: 10%
    consolidateAfter: 30s
    consolidationPolicy: WhenEmptyOrUnderutilized
  template:
    spec:
      expireAfter: 480h                  # 노드 만료 시간 (기존 설정과 차이를 두기위해 해당 값 수정, 21일 초과 불가)
      nodeClassRef:
        group: eks.amazonaws.com
        kind: NodeClass
        name: spot-class
      requirements:
      - key: karpenter.sh/capacity-type
        operator: In
        values: [spot]                   # 스팟 인스턴스만 사용 (Spot 설정)
      - key: eks.amazonaws.com/instance-category
        operator: In
        values: [c, m, r]
      - key: eks.amazonaws.com/instance-generation
        operator: Gt
        values: ["4"]
      - key: kubernetes.io/arch
        operator: In
        values: [amd64]
      - key: kubernetes.io/os
        operator: In
        values: [linux]
      terminationGracePeriod: 24h0m0s

---
apiVersion: policy/v1
kind: PodDisruptionBudget
metadata:
  name: pdb-2048
  namespace: game-2048
spec:
  minAvailable: 1 # 최소 1개의 파드는 실행
  selector:
    matchLabels:
      app.kubernetes.io/name: app-2048

apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig

metadata:
  name: GSN-AUTO-EKS
  region: ap-northeast-2
  version: "1.31" # 변경(v1.30→v1.31)
... # 이하 동일