Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Groundwork new workflows #143

Merged
merged 2 commits into from
Mar 28, 2023
Merged

Groundwork new workflows #143

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6c7f317
Groundwork new workflows
max-lobur Mar 27, 2023
beaa983
fix regex
max-lobur Mar 27, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 0 additions & 8 deletions examples/complete/main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,14 +22,6 @@ locals {
# https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/deploy/subnet_discovery.md
tags = { "kubernetes.io/cluster/${module.label.id}" = "shared" }

# required tags to make ALB ingress work https://docs.aws.amazon.com/eks/latest/userguide/alb-ingress.html
public_subnets_additional_tags = {
"kubernetes.io/role/elb" : 1
}
private_subnets_additional_tags = {
"kubernetes.io/role/internal-elb" : 1
}

allow_all_ingress_rule = {
key = "allow_all_ingress"
type = "ingress"
Expand Down
42 changes: 0 additions & 42 deletions examples/complete/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,36 +31,6 @@ variable "cluster_log_retention_period" {
description = "Number of days to retain cluster logs. Requires `enabled_cluster_log_types` to be set. See https://docs.aws.amazon.com/en_us/eks/latest/userguide/control-plane-logs.html."
}

variable "map_additional_aws_accounts" {
description = "Additional AWS account numbers to add to `config-map-aws-auth` ConfigMap"
type = list(string)
default = []
}

variable "map_additional_iam_roles" {
description = "Additional IAM roles to add to `config-map-aws-auth` ConfigMap"

type = list(object({
rolearn = string
username = string
groups = list(string)
}))

default = []
}

variable "map_additional_iam_users" {
description = "Additional IAM users to add to `config-map-aws-auth` ConfigMap"

type = list(object({
userarn = string
username = string
groups = list(string)
}))

default = []
}

variable "oidc_provider_enabled" {
type = bool
default = true
Expand Down Expand Up @@ -125,18 +95,6 @@ variable "min_size" {
description = "The minimum size of the AutoScaling Group"
}

variable "launch_template_id" {
type = string
description = "The ID of a custom launch template to use for the EKS node group."
default = null
}

variable "launch_template_version" {
type = string
description = "A specific version of the above specific launch template"
default = null
}

variable "before_cluster_joining_userdata" {
type = string
default = ""
Expand Down
18 changes: 9 additions & 9 deletions iam.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
locals {
create_role = local.enabled && length(var.node_role_arn) == 0
aws_policy_prefix = local.create_role ? format("arn:%s:iam::aws:policy", join("", data.aws_partition.current.*.partition)) : ""
aws_policy_prefix = local.create_role ? format("arn:%s:iam::aws:policy", join("", data.aws_partition.current[*].partition)) : ""
node_role_policy_arns = sort(var.node_role_policy_arns)
}

Expand All @@ -25,27 +25,27 @@ data "aws_iam_policy_document" "assume_role" {
resource "aws_iam_role" "default" {
count = local.create_role ? 1 : 0
name = module.label.id
assume_role_policy = join("", data.aws_iam_policy_document.assume_role.*.json)
assume_role_policy = join("", data.aws_iam_policy_document.assume_role[*].json)
permissions_boundary = var.node_role_permissions_boundary
tags = module.label.tags
}

resource "aws_iam_role_policy_attachment" "amazon_eks_worker_node_policy" {
count = local.create_role ? 1 : 0
policy_arn = format("%s/%s", local.aws_policy_prefix, "AmazonEKSWorkerNodePolicy")
role = join("", aws_iam_role.default.*.name)
role = join("", aws_iam_role.default[*].name)
}

resource "aws_iam_role_policy_attachment" "amazon_ec2_container_registry_read_only" {
count = local.create_role ? 1 : 0
policy_arn = format("%s/%s", local.aws_policy_prefix, "AmazonEC2ContainerRegistryReadOnly")
role = join("", aws_iam_role.default.*.name)
role = join("", aws_iam_role.default[*].name)
}

resource "aws_iam_role_policy_attachment" "existing_policies_for_eks_workers_role" {
count = local.create_role ? length(var.node_role_policy_arns) : 0
policy_arn = local.node_role_policy_arns[count.index]
role = join("", aws_iam_role.default.*.name)
role = join("", aws_iam_role.default[*].name)
}

# Create a CNI policy that is a merger of AmazonEKS_CNI_Policy and required IPv6 permissions
Expand Down Expand Up @@ -79,7 +79,7 @@ data "aws_iam_policy_document" "ipv6_eks_cni_policy" {
"ec2:CreateTags"
]
resources = [
"arn:${join("", data.aws_partition.current.*.partition)}:ec2:*:*:network-interface/*"
"arn:${join("", data.aws_partition.current[*].partition)}:ec2:*:*:network-interface/*"
]
}
}
Expand All @@ -88,13 +88,13 @@ resource "aws_iam_policy" "ipv6_eks_cni_policy" {
count = local.create_role && var.node_role_cni_policy_enabled ? 1 : 0

name = "${module.this.id}-CNI_Policy"
policy = join("", data.aws_iam_policy_document.ipv6_eks_cni_policy.*.json)
policy = join("", data.aws_iam_policy_document.ipv6_eks_cni_policy[*].json)
}

resource "aws_iam_role_policy_attachment" "ipv6_eks_cni_policy" {
count = local.create_role && var.node_role_cni_policy_enabled ? 1 : 0

policy_arn = join("", aws_iam_policy.ipv6_eks_cni_policy.*.arn)
role = join("", aws_iam_role.default.*.name)
policy_arn = join("", aws_iam_policy.ipv6_eks_cni_policy[*].arn)
role = join("", aws_iam_role.default[*].name)
}

4 changes: 2 additions & 2 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,7 @@ locals {
is_windows = can(regex("WINDOWS", var.ami_type))
ng = {
cluster_name = var.cluster_name
node_role_arn = local.create_role ? join("", aws_iam_role.default.*.arn) : try(var.node_role_arn[0], null)
node_role_arn = local.create_role ? join("", aws_iam_role.default[*].arn) : try(var.node_role_arn[0], null)
# Keep sorted so that change in order does not trigger replacement via random_pet
subnet_ids = sort(var.subnet_ids)
# Always supply instance types via the node group, not the launch template,
Expand Down Expand Up @@ -202,7 +202,7 @@ resource "aws_eks_node_group" "default" {
# except for count, lifecycle, and node_group_name.
resource "aws_eks_node_group" "cbd" {
count = local.enabled && var.create_before_destroy ? 1 : 0
node_group_name = format("%v%v%v", module.label.id, module.label.delimiter, join("", random_pet.cbd.*.id))
node_group_name = format("%v%v%v", module.label.id, module.label.delimiter, join("", random_pet.cbd[*].id))

lifecycle {
create_before_destroy = true
Expand Down
18 changes: 9 additions & 9 deletions outputs.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,41 +1,41 @@
output "eks_node_group_role_arn" {
description = "ARN of the worker nodes IAM role"
value = join("", aws_iam_role.default.*.arn)
value = join("", aws_iam_role.default[*].arn)
}

output "eks_node_group_role_name" {
description = "Name of the worker nodes IAM role"
value = join("", aws_iam_role.default.*.name)
value = join("", aws_iam_role.default[*].name)
}

output "eks_node_group_id" {
description = "EKS Cluster name and EKS Node Group name separated by a colon"
value = join("", aws_eks_node_group.default.*.id, aws_eks_node_group.cbd.*.id)
value = join("", aws_eks_node_group.default[*].id, aws_eks_node_group.cbd[*].id)
}

output "eks_node_group_arn" {
description = "Amazon Resource Name (ARN) of the EKS Node Group"
value = join("", aws_eks_node_group.default.*.arn, aws_eks_node_group.cbd.*.arn)
value = join("", aws_eks_node_group.default[*].arn, aws_eks_node_group.cbd[*].arn)
}

output "eks_node_group_resources" {
description = "List of objects containing information about underlying resources of the EKS Node Group"
value = local.enabled ? (var.create_before_destroy ? aws_eks_node_group.cbd.*.resources : aws_eks_node_group.default.*.resources) : []
value = local.enabled ? (var.create_before_destroy ? aws_eks_node_group.cbd[*].resources : aws_eks_node_group.default[*].resources) : []
}

output "eks_node_group_status" {
description = "Status of the EKS Node Group"
value = join("", aws_eks_node_group.default.*.status, aws_eks_node_group.cbd.*.status)
value = join("", aws_eks_node_group.default[*].status, aws_eks_node_group.cbd[*].status)
}

output "eks_node_group_remote_access_security_group_id" {
description = "The ID of the security group generated to allow SSH access to the nodes, if this module generated one"
value = join("", module.ssh_access.*.id)
value = join("", module.ssh_access[*].id)
}

output "eks_node_group_cbd_pet_name" {
description = "The pet name of this node group, if this module generated one"
value = join("", random_pet.cbd.*.id)
value = join("", random_pet.cbd[*].id)
}

output "eks_node_group_launch_template_id" {
Expand All @@ -45,7 +45,7 @@ output "eks_node_group_launch_template_id" {

output "eks_node_group_launch_template_name" {
description = "The name of the launch template used for this node group"
value = local.enabled ? (local.fetch_launch_template ? join("", data.aws_launch_template.this.*.name) : join("", aws_launch_template.default.*.name)) : null
value = local.enabled ? (local.fetch_launch_template ? join("", data.aws_launch_template.this[*].name) : join("", aws_launch_template.default[*].name)) : null
}

output "eks_node_group_tags_all" {
Expand Down