{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Description": "EKS nodes (AMI family: AmazonLinux2, SSH access: false, private networking: false) [created and managed by eksctl]",
    "Resources": {
        "EgressInterCluster": {
            "Type": "AWS::EC2::SecurityGroupEgress",
            "Properties": {
                "Description": "Allow control plane to communicate with worker nodes in group ng-0 (kubelet and workload TCP ports)",
                "DestinationSecurityGroupId": {
                    "Ref": "SG"
                },
                "FromPort": 1025,
                "GroupId": {
                    "Fn::ImportValue": "eksctl-wonderful-party-1565212003-cluster::SecurityGroup"
                },
                "IpProtocol": "tcp",
                "ToPort": 65535
            }
        },
        "EgressInterClusterAPI": {
            "Type": "AWS::EC2::SecurityGroupEgress",
            "Properties": {
                "Description": "Allow control plane to communicate with worker nodes in group ng-0 (workloads using HTTPS port, commonly used with extension API servers)",
                "DestinationSecurityGroupId": {
                    "Ref": "SG"
                },
                "FromPort": 443,
                "GroupId": {
                    "Fn::ImportValue": "eksctl-wonderful-party-1565212003-cluster::SecurityGroup"
                },
                "IpProtocol": "tcp",
                "ToPort": 443
            }
        },
        "IngressInterCluster": {
            "Type": "AWS::EC2::SecurityGroupIngress",
            "Properties": {
                "Description": "Allow worker nodes in group ng-0 to communicate with control plane (kubelet and workload TCP ports)",
                "FromPort": 1025,
                "GroupId": {
                    "Ref": "SG"
                },
                "IpProtocol": "tcp",
                "SourceSecurityGroupId": {
                    "Fn::ImportValue": "eksctl-wonderful-party-1565212003-cluster::SecurityGroup"
                },
                "ToPort": 65535
            }
        },
        "IngressInterClusterAPI": {
            "Type": "AWS::EC2::SecurityGroupIngress",
            "Properties": {
                "Description": "Allow worker nodes in group ng-0 to communicate with control plane (workloads using HTTPS port, commonly used with extension API servers)",
                "FromPort": 443,
                "GroupId": {
                    "Ref": "SG"
                },
                "IpProtocol": "tcp",
                "SourceSecurityGroupId": {
                    "Fn::ImportValue": "eksctl-wonderful-party-1565212003-cluster::SecurityGroup"
                },
                "ToPort": 443
            }
        },
        "IngressInterClusterCP": {
            "Type": "AWS::EC2::SecurityGroupIngress",
            "Properties": {
                "Description": "Allow control plane to receive API requests from worker nodes in group ng-0",
                "FromPort": 443,
                "GroupId": {
                    "Fn::ImportValue": "eksctl-wonderful-party-1565212003-cluster::SecurityGroup"
                },
                "IpProtocol": "tcp",
                "SourceSecurityGroupId": {
                    "Ref": "SG"
                },
                "ToPort": 443
            }
        },
        "NodeGroup": {
            "Type": "AWS::AutoScaling::AutoScalingGroup",
            "Properties": {
                "DesiredCapacity": "1",
                "LaunchTemplate": {
                    "LaunchTemplateName": {
                        "Fn::Sub": "${AWS::StackName}"
                    },
                    "Version": {
                        "Fn::GetAtt": "NodeGroupLaunchTemplate.LatestVersionNumber"
                    }
                },
                "MaxSize": "4",
                "MinSize": "1",
                "Tags": [
                    {
                        "Key": "Name",
                        "PropagateAtLaunch": "true",
                        "Value": "wonderful-party-1565212003-ng-0-Node"
                    },
                    {
                        "Key": "kubernetes.io/cluster/wonderful-party-1565212003",
                        "PropagateAtLaunch": "true",
                        "Value": "owned"
                    }
                ],
                "VPCZoneIdentifier": {
                    "Fn::Split": [
                        ",",
                        {
                            "Fn::ImportValue": "eksctl-wonderful-party-1565212003-cluster::SubnetsPublic"
                        }
                    ]
                }
            },
            "UpdatePolicy": {
                "AutoScalingRollingUpdate": {
                    "MaxBatchSize": "1",
                    "MinInstancesInService": "0"
                }
            }
        },
        "NodeGroupLaunchTemplate": {
            "Type": "AWS::EC2::LaunchTemplate",
            "Properties": {
                "LaunchTemplateData": {
                    "IamInstanceProfile": {
                        "Arn": {
                            "Fn::GetAtt": "NodeInstanceProfile.Arn"
                        }
                    },
                    "ImageId": "ami-03a55127c613349a7",
                    "InstanceType": "t2.medium",
                    "NetworkInterfaces": [
                        {
                            "AssociatePublicIpAddress": true,
                            "DeviceIndex": 0,
                            "Groups": [
                                {
                                    "Fn::ImportValue": "eksctl-wonderful-party-1565212003-cluster::SharedNodeSecurityGroup"
                                },
                                {
                                    "Ref": "SG"
                                }
                            ]
                        }
                    ],
                    "UserData": "[encoded data, 4304 characters]"
                },
                "LaunchTemplateName": {
                    "Fn::Sub": "${AWS::StackName}"
                }
            }
        },
        "NodeInstanceProfile": {
            "Type": "AWS::IAM::InstanceProfile",
            "Properties": {
                "Path": "/",
                "Roles": [
                    {
                        "Ref": "NodeInstanceRole"
                    }
                ]
            }
        },
        "NodeInstanceRole": {
            "Type": "AWS::IAM::Role",
            "Properties": {
                "AssumeRolePolicyDocument": {
                    "Statement": [
                        {
                            "Action": [
                                "sts:AssumeRole"
                            ],
                            "Effect": "Allow",
                            "Principal": {
                                "Service": [
                                    "ec2.amazonaws.com"
                                ]
                            }
                        }
                    ],
                    "Version": "2012-10-17"
                },
                "ManagedPolicyArns": [
                    "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy",
                    "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy",
                    "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
                ],
                "Path": "/"
            }
        },
        "SG": {
            "Type": "AWS::EC2::SecurityGroup",
            "Properties": {
                "GroupDescription": "Communication between the control plane and worker nodes in group ng-0",
                "Tags": [
                    {
                        "Key": "kubernetes.io/cluster/wonderful-party-1565212003",
                        "Value": "owned"
                    },
                    {
                        "Key": "Name",
                        "Value": {
                            "Fn::Sub": "${AWS::StackName}/SG"
                        }
                    }
                ],
                "VpcId": {
                    "Fn::ImportValue": "eksctl-wonderful-party-1565212003-cluster::VPC"
                }
            }
        }
    },
    "Outputs": {
        "FeatureLocalSecurityGroup": {
            "Value": true
        },
        "FeaturePrivateNetworking": {
            "Value": false
        },
        "FeatureSharedSecurityGroup": {
            "Value": true
        },
        "InstanceProfileARN": {
            "Export": {
                "Name": {
                    "Fn::Sub": "${AWS::StackName}::InstanceProfileARN"
                }
            },
            "Value": {
                "Fn::GetAtt": "NodeInstanceProfile.Arn"
            }
        },
        "InstanceRoleARN": {
            "Export": {
                "Name": {
                    "Fn::Sub": "${AWS::StackName}::InstanceRoleARN"
                }
            },
            "Value": {
                "Fn::GetAtt": "NodeInstanceRole.Arn"
            }
        }
    }
}
