Deploy a Redpanda Cluster in Amazon Elastic Kubernetes Service

eksctl create cluster --name <cluster-name> \
    --external-dns-access \
    --nodegroup-name standard-workers \
    --node-type m5.xlarge \
    --nodes 3 \
    --nodes-min 3 \
    --nodes-max 4

eksctl create cluster --with-oidc --name <cluster-name> \
    --external-dns-access \
    --nodegroup-name standard-workers \
    --node-type m5.xlarge \
    --nodes 3 \
    --nodes-min 3 \
    --nodes-max 4

kubectl get service

aws eks update-kubeconfig --region <region> --name <cluster-name>

eksctl create iamserviceaccount \
  `# Do not change the name. It is required by EKS.` \
  --name ebs-csi-controller-sa \
  `# Do not change the namespace. It is required by EKS.` \
  --namespace kube-system \
  --cluster <cluster-name> \
  --attach-policy-arn arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy \
  --approve \
  --role-only \
  --role-name AmazonEKS_EBS_CSI_DriverRole-<cluster-name>

AWS_ACCOUNT_ID=`aws sts get-caller-identity | jq -r '.Account'`

eksctl create addon \
    --name aws-ebs-csi-driver \
    --cluster <cluster-name> \
    --service-account-role-arn arn:aws:iam::${AWS_ACCOUNT_ID}:role/AmazonEKS_EBS_CSI_DriverRole-<cluster-name> \
    --force

AWS_SECURITY_GROUP_ID=`aws eks describe-cluster --name <cluster-name> | jq -r '.cluster.resourcesVpcConfig.clusterSecurityGroupId'`

aws ec2 authorize-security-group-ingress \
  --group-id ${AWS_SECURITY_GROUP_ID} \
  --ip-permissions "[ \
    { \
      \"IpProtocol\": \"tcp\", \
      \"FromPort\": 30081, \
      \"ToPort\": 30081, \
      \"IpRanges\": [{\"CidrIp\": \"0.0.0.0/0\"}] \
    }, \
    { \
      \"IpProtocol\": \"tcp\", \
      \"FromPort\": 30082, \
      \"ToPort\": 30082, \
      \"IpRanges\": [{\"CidrIp\": \"0.0.0.0/0\"}] \
    }, \
    { \
      \"IpProtocol\": \"tcp\", \
      \"FromPort\": 31644, \
      \"ToPort\": 31644, \
      \"IpRanges\": [{\"CidrIp\": \"0.0.0.0/0\"}] \
    }, \
    { \
      \"IpProtocol\": \"tcp\", \
      \"FromPort\": 31092, \
      \"ToPort\": 31092, \
      \"IpRanges\": [{\"CidrIp\": \"0.0.0.0/0\"}] \
    } \
  ]"

helm repo add jetstack https://charts.jetstack.io
helm repo update
helm install cert-manager jetstack/cert-manager \
  --set installCRDs=true \
  --namespace cert-manager  \
  --create-namespace

helm repo add redpanda https://charts.redpanda.com
export DOMAIN=customredpandadomain.local && \
helm install redpanda redpanda/redpanda --namespace redpanda --create-namespace \
  --set auth.sasl.enabled=true \
  --set "auth.sasl.users[0].name=superuser" \
  --set "auth.sasl.users[0].password=secretpassword" \
  --set external.domain=${DOMAIN} --wait

kubectl get pod -n redpanda  \
-o=custom-columns=NODE:.spec.nodeName,NAME:.metadata.name -l \
app.kubernetes.io/component=redpanda-statefulset

kubectl -n redpanda exec -ti redpanda-0 -c redpanda -- \
rpk acl user create redpanda-twitch-account \
-p changethispassword \
--admin-api-tls-enabled \
--admin-api-tls-truststore /etc/tls/certs/default/ca.crt \
--api-urls redpanda-0.redpanda.redpanda.svc.cluster.local.:9644,redpanda-1.redpanda.redpanda.svc.cluster.local.:9644,redpanda-2.redpanda.redpanda.svc.cluster.local.:9644

kubectl exec -n redpanda -c redpanda redpanda-0 -- \
  rpk acl create --allow-principal User:redpanda-twitch-account \
  --operation all \
  --topic twitch_chat \
  --tls-enabled \
  --tls-truststore /etc/tls/certs/default/ca.crt \
  --user=superuser --password=secretpassword --sasl-mechanism SCRAM-SHA-512 \
  --brokers redpanda-0.redpanda.redpanda.svc.cluster.local:9093

alias rpk-topic="kubectl -n redpanda exec -i -t redpanda-0 -c redpanda -- rpk topic --brokers redpanda-0.redpanda.redpanda.svc.cluster.local.:9093,redpanda-1.redpanda.redpanda.svc.cluster.local.:9093,redpanda-2.redpanda.redpanda.svc.cluster.local.:9093 --tls-truststore /etc/tls/certs/default/ca.crt --tls-enabled --user=redpanda-twitch-account --password=changethispassword --sasl-mechanism SCRAM-SHA-256"

rpk-topic create twitch_chat

rpk-topic describe twitch_chat

rpk-topic produce twitch_chat

rpk-topic consume twitch_chat --num 1

kubectl -n redpanda port-forward svc/redpanda-console 8080:8080

sudo true && kubectl -n redpanda get endpoints,node -A -o go-template='{{ range $_ := .items }}{{ if and (eq .kind "Endpoints") (eq .metadata.name "redpanda-external") }}{{ range $_ := (index .subsets 0).addresses }}{{ $nodeName := .nodeName }}{{ $podName := .targetRef.name }}{{ range $node := $.items }}{{ if and (eq .kind "Node") (eq .metadata.name $nodeName) }}{{ range $_ := .status.addresses }}{{ if eq .type "ExternalIP" }}{{ .address }} {{ $podName }}.${DOMAIN}{{ "\n" }}{{ end }}{{ end }}{{ end }}{{ end }}{{ end }}{{ end }}{{ end }}' | envsubst | sudo tee -a /etc/hosts

203.0.113.3 redpanda-0.customredpandadomain.local
203.0.113.5 redpanda-1.customredpandadomain.local
203.0.113.7 redpanda-2.customredpandadomain.local

kubectl -n redpanda get secret redpanda-default-root-certificate -o go-template='{{ index .data "ca.crt" | base64decode }}' > ca.crt

export REDPANDA_BROKERS=redpanda-0.customredpandadomain.local:31092,redpanda-1.customredpandadomain.local:31092,redpanda-2.customredpandadomain.local:31092

rpk topic describe twitch_chat --tls-enabled --tls-truststore=ca.crt --user=redpanda-twitch-account --password=changethispassword --sasl-mechanism SCRAM-SHA-256