AWS

​

Before you run Terraform

​

Cluster

• An EKS cluster with the EKS Pod Identity agent. EKS Auto Mode includes it. To use IAM roles for service accounts instead, set the module’s identity_type = "irsa"; the cluster then needs an IAM OIDC provider.
• An IngressClass named alb. The AWS Load Balancer Controller creates it. On EKS Auto Mode, create it yourself:
  apiVersion: eks.amazonaws.com/v1
  kind: IngressClassParams
  metadata:
    name: alb
  spec:
    scheme: internet-facing
  ---
  apiVersion: networking.k8s.io/v1
  kind: IngressClass
  metadata:
    name: alb
  spec:
    controller: eks.amazonaws.com/alb
    parameters:
      apiGroup: eks.amazonaws.com
      kind: IngressClassParams
      name: alb
  
• An ACM certificate for your hostname, in the cluster’s region. The load balancer uses it for HTTPS.

​

VPC and subnets

• Private subnets with a NAT gateway. Hosts need outbound access to your Tembo URL, Tembo’s API, object storage, LLM providers and code hosts such as GitHub.
• Several Availability Zones that offer your instance types. The default, c8id.8xlarge, isn’t offered in every zone; when one zone runs out of capacity, the host controller tries the next. To list the zones that offer it:
  aws ec2 describe-instance-type-offerings --location-type availability-zone \
    --filters Name=instance-type,Values=c8id.8xlarge --query 'InstanceTypeOfferings[].Location'
  
• The cluster’s API reachable from them. Hosts read their configuration through the cluster endpoint. Turn on the endpoint’s private access, so hosts reach it inside the VPC; the module opens port 443 on the cluster security group for them. With public access only, allow your NAT gateways’ addresses in the endpoint’s public access CIDRs.

​

Quotas

​

Permissions to apply

• IAM roles, inline policies and an instance profile.
• A security group and its rules, including a rule on the cluster security group.
• An S3 bucket and its settings.
• EKS Pod Identity associations.

​

Install the module

module "tembo" {
  source = "git::https://github.com/tembo/terraform-aws-tembo-agent-host.git?ref=v0.2.2"

  cluster_name         = "<your-eks-cluster>"
  kubernetes_namespace = "tembo"
  release_name         = "tembo"

  vpc_id          = "<your-vpc-id>"
  host_subnet_ids = ["<subnet-id>", "<subnet-id>"]

  # Your Tembo URL, so browsers can upload files.
  object_storage_cors_allowed_origins = ["https://tembo.example.com"]

  # With your own Postgres or Redis, let agent hosts reach them:
  # host_access_rules = [
  #   { security_group_id = "<postgres-sg>", port = 5432, description = "Postgres from Tembo agent hosts" },
  #   { security_group_id = "<redis-sg>", port = 6379, description = "Redis from Tembo agent hosts" },
  # ]
}

output "helm_values" {
  value = module.tembo.helm_values
}

terraform init
terraform apply

• The host controller’s role, bound to the chart’s service account through EKS Pod Identity. It can launch instances only into your subnets, with the module’s security group and instance profile, and terminate only the instances it tagged.
• The agent hosts’ role and instance profile, with access to the install’s bucket and, by default, Session Manager.
• The hosts’ security group: the host manager’s port (8743) from the cluster, all egress, and the hosts’ access to the Kubernetes API.
• An S3 bucket for project images, session snapshots and file uploads, and the control plane’s role to use it. To use a bucket you have, set object_storage_bucket_name.

​

Configure the chart with its outputs

terraform output -json helm_values > tembo-aws.json

• The host controller, with its role.
• A host class named default, with your subnets, the security group, the instance profile, c8id.8xlarge and Tembo’s stable agent host image.
• A pool named default, of one to three hosts.
• Object storage, with the bucket and the control plane’s role.
• On EKS Auto Mode, the class for the load balancers agent hosts reach Postgres and Redis through.

​

Need Help?