{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Description": "EKS nodes (AMI family: AmazonLinux2, SSH access: true, private networking: false) [created and managed by eksctl]",
    "Mappings": {
        "ServicePrincipalPartitionMap": {
            "aws": {
                "EC2": "ec2.amazonaws.com",
                "EKS": "eks.amazonaws.com",
                "EKSFargatePods": "eks-fargate-pods.amazonaws.com"
            },
            "aws-cn": {
                "EC2": "ec2.amazonaws.com.cn",
                "EKS": "eks.amazonaws.com",
                "EKSFargatePods": "eks-fargate-pods.amazonaws.com"
            },
            "aws-us-gov": {
                "EC2": "ec2.amazonaws.com",
                "EKS": "eks.amazonaws.com",
                "EKSFargatePods": "eks-fargate-pods.amazonaws.com"
            }
        }
    },
    "Resources": {
        "EgressInterCluster": {
            "Type": "AWS::EC2::SecurityGroupEgress",
            "Properties": {
                "Description": "Allow control plane to communicate with worker nodes in group n5 (kubelet and workload TCP ports)",
                "DestinationSecurityGroupId": {
                    "Ref": "SG"
                },
                "FromPort": 1025,
                "GroupId": {
                    "Fn::ImportValue": "eksctl-test-cluster::SecurityGroup"
                },
                "IpProtocol": "tcp",
                "ToPort": 65535
            }
        },
        "EgressInterClusterAPI": {
            "Type": "AWS::EC2::SecurityGroupEgress",
            "Properties": {
                "Description": "Allow control plane to communicate with worker nodes in group n5 (workloads using HTTPS port, commonly used with extension API servers)",
                "DestinationSecurityGroupId": {
                    "Ref": "SG"
                },
                "FromPort": 443,
                "GroupId": {
                    "Fn::ImportValue": "eksctl-test-cluster::SecurityGroup"
                },
                "IpProtocol": "tcp",
                "ToPort": 443
            }
        },
        "IngressInterClusterCP": {
            "Type": "AWS::EC2::SecurityGroupIngress",
            "Properties": {
                "Description": "Allow control plane to receive API requests from worker nodes in group n5",
                "FromPort": 443,
                "GroupId": {
                    "Fn::ImportValue": "eksctl-test-cluster::SecurityGroup"
                },
                "IpProtocol": "tcp",
                "SourceSecurityGroupId": {
                    "Ref": "SG"
                },
                "ToPort": 443
            }
        },
        "NodeGroup": {
            "Type": "AWS::AutoScaling::AutoScalingGroup",
            "Properties": {
                "LaunchTemplate": {
                    "LaunchTemplateName": {
                        "Fn::Sub": "${AWS::StackName}"
                    },
                    "Version": {
                        "Fn::GetAtt": [
                            "NodeGroupLaunchTemplate",
                            "LatestVersionNumber"
                        ]
                    }
                },
                "MaxSize": "2",
                "MinSize": "2",
                "Tags": [
                    {
                        "Key": "Name",
                        "PropagateAtLaunch": "true",
                        "Value": "test-n5-Node"
                    },
                    {
                        "Key": "kubernetes.io/cluster/test",
                        "PropagateAtLaunch": "true",
                        "Value": "owned"
                    }
                ],
                "VPCZoneIdentifier": {
                    "Fn::Split": [
                        ",",
                        {
                            "Fn::ImportValue": "eksctl-test-cluster::SubnetsPublic"
                        }
                    ]
                }
            },
            "UpdatePolicy": {
                "AutoScalingRollingUpdate": {}
            }
        },
        "NodeGroupLaunchTemplate": {
            "Type": "AWS::EC2::LaunchTemplate",
            "Properties": {
                "LaunchTemplateData": {
                    "BlockDeviceMappings": [
                        {
                            "DeviceName": "/dev/xvda",
                            "Ebs": {
                                "Encrypted": false,
                                "Iops": 3000,
                                "Throughput": 125,
                                "VolumeSize": 80,
                                "VolumeType": "gp3"
                            }
                        }
                    ],
                    "IamInstanceProfile": {
                        "Arn": {
                            "Fn::GetAtt": [
                                "NodeInstanceProfile",
                                "Arn"
                            ]
                        }
                    },
                    "ImageId": "ami-09729f03d2b24317c",
                    "InstanceType": "m5.large",
                    "KeyName": "eksctl-test-nodegroup-n5-bd:d8:ab:d8:3a:09:95:22:91:61:9f:1c:92:b5:dc:2e",
                    "MetadataOptions": {
                        "HttpPutResponseHopLimit": 2,
                        "HttpTokens": "optional"
                    },
                    "NetworkInterfaces": [
                        {
                            "DeviceIndex": 0,
                            "Groups": [
                                {
                                    "Fn::ImportValue": "eksctl-test-cluster::SharedNodeSecurityGroup"
                                },
                                {
                                    "Ref": "SG"
                                }
                            ]
                        }
                    ],
                    "UserData": "[encoded data, 5792 characters]"
                },
                "LaunchTemplateName": {
                    "Fn::Sub": "${AWS::StackName}"
                }
            }
        },
        "NodeInstanceProfile": {
            "Type": "AWS::IAM::InstanceProfile",
            "Properties": {
                "Path": "/",
                "Roles": [
                    {
                        "Ref": "NodeInstanceRole"
                    }
                ]
            }
        },
        "NodeInstanceRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Statement": [
                        {
                            "Action": [
                                "sts:AssumeRole"
                            ],
                            "Effect": "Allow",
                            "Principal": {
                                "Service": [
                                    {
                                        "Fn::FindInMap": [
                                            "ServicePrincipalPartitionMap",
                                            {
                                                "Ref": "AWS::Partition"
                                            },
                                            "EC2"
                                        ]
                                    }
                                ]
                            }
                        }
                    ],
                    "Version": "2012-10-17"
                },
                "ManagedPolicyArns": [
                    {
                        "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
                    },
                    {
                        "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/AmazonEKSWorkerNodePolicy"
                    },
                    {
                        "Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/AmazonEKS_CNI_Policy"
                    }
                ],
                "Path": "/",
                "Tags": [
                    {
                        "Key": "Name",
                        "Value": {
                            "Fn::Sub": "${AWS::StackName}/NodeInstanceRole"
                        }
                    }
                ]
            }
        },
        "SG": {
            "Type": "AWS::EC2::SecurityGroup",
            "Properties": {
                "GroupDescription": "Communication between the control plane and worker nodes in group n5",
                "SecurityGroupIngress": [
                    {
                        "Description": "[IngressInterCluster] Allow worker nodes in group n5 to communicate with control plane (kubelet and workload TCP ports)",
                        "FromPort": 1025,
                        "IpProtocol": "tcp",
                        "SourceSecurityGroupId": {
                            "Fn::ImportValue": "eksctl-test-cluster::SecurityGroup"
                        },
                        "ToPort": 65535
                    },
                    {
                        "Description": "[IngressInterClusterAPI] Allow worker nodes in group n5 to communicate with control plane (workloads using HTTPS port, commonly used with extension API servers)",
                        "FromPort": 443,
                        "IpProtocol": "tcp",
                        "SourceSecurityGroupId": {
                            "Fn::ImportValue": "eksctl-test-cluster::SecurityGroup"
                        },
                        "ToPort": 443
                    },
                    {
                        "CidrIp": "0.0.0.0/0",
                        "Description": "Allow SSH access to worker nodes in group n5",
                        "FromPort": 22,
                        "IpProtocol": "tcp",
                        "ToPort": 22
                    },
                    {
                        "CidrIpv6": "::/0",
                        "Description": "Allow SSH access to worker nodes in group n5",
                        "FromPort": 22,
                        "IpProtocol": "tcp",
                        "ToPort": 22
                    }
                ],
                "Tags": [
                    {
                        "Key": "kubernetes.io/cluster/test",
                        "Value": "owned"
                    },
                    {
                        "Key": "Name",
                        "Value": {
                            "Fn::Sub": "${AWS::StackName}/SG"
                        }
                    }
                ],
                "VpcId": {
                    "Fn::ImportValue": "eksctl-test-cluster::VPC"
                }
            }
        }
    },
    "Outputs": {
        "FeatureLocalSecurityGroup": {
            "Value": true
        },
        "FeaturePrivateNetworking": {
            "Value": false
        },
        "FeatureSharedSecurityGroup": {
            "Value": true
        },
        "InstanceProfileARN": {
            "Value": {
                "Fn::GetAtt": [
                    "NodeInstanceProfile",
                    "Arn"
                ]
            },
            "Export": {
                "Name": {
                    "Fn::Sub": "${AWS::StackName}::InstanceProfileARN"
                }
            }
        },
        "InstanceRoleARN": {
            "Value": {
                "Fn::GetAtt": [
                    "NodeInstanceRole",
                    "Arn"
                ]
            },
            "Export": {
                "Name": {
                    "Fn::Sub": "${AWS::StackName}::InstanceRoleARN"
                }
            }
        }
    }
}
