-
-
Notifications
You must be signed in to change notification settings - Fork 4.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* run terraform upgrade tool * fix post upgrade TODOs * use strict typing for variables * upgrade examples, point them at VPC module tf 0.12 PR * remove unnecessary `coalesce()` calls coalesce(lookup(map, key, ""), default) -> lookup(map, key, default) * Fix autoscaling_enabled broken (#1) * always set a value for tags, fix coalescelist calls * always set a value for these tags * fix tag value * fix tag value * default element available * added default value * added a general default without this default - TF is throwing an error when running a destroy * Fix CI * Change vpc module back to `terraform-aws-modules/vpc/aws` in example * Update CHANGELOG.md * Change type of variable `cluster_log_retention_in_days` to number * Remove `xx_count` variables * Actual lists instead of strings with commas * Remove `xx_count` variable from docs * Replace element with list indexing * Change variable `worker_group_tags` to a attribute of worker_group * Fix workers_launch_template_mixed tags * Change override_instance_type_x variables to list. * Update CHANGELOG.md
- Loading branch information
1 parent
3f06015
commit da2c78b
Showing
24 changed files
with
1,275 additions
and
636 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,103 +1,140 @@ | ||
| resource "local_file" "config_map_aws_auth" { | ||
| count = "${var.write_aws_auth_config ? 1 : 0}" | ||
| content = "${data.template_file.config_map_aws_auth.rendered}" | ||
| count = var.write_aws_auth_config ? 1 : 0 | ||
| content = data.template_file.config_map_aws_auth.rendered | ||
| filename = "${var.config_output_path}config-map-aws-auth_${var.cluster_name}.yaml" | ||
| } | ||
|
|
||
| resource "null_resource" "update_config_map_aws_auth" { | ||
| count = "${var.manage_aws_auth ? 1 : 0}" | ||
| depends_on = ["aws_eks_cluster.this"] | ||
| count = var.manage_aws_auth ? 1 : 0 | ||
| depends_on = [aws_eks_cluster.this] | ||
|
|
||
| provisioner "local-exec" { | ||
| working_dir = "${path.module}" | ||
| working_dir = path.module | ||
|
|
||
| command = <<EOS | ||
| for i in `seq 1 10`; do \ | ||
| echo "${null_resource.update_config_map_aws_auth.triggers.kube_config_map_rendered}" > kube_config.yaml & \ | ||
| echo "${null_resource.update_config_map_aws_auth.triggers.config_map_rendered}" > aws_auth_configmap.yaml & \ | ||
| echo "${null_resource.update_config_map_aws_auth[0].triggers.kube_config_map_rendered}" > kube_config.yaml & \ | ||
| echo "${null_resource.update_config_map_aws_auth[0].triggers.config_map_rendered}" > aws_auth_configmap.yaml & \ | ||
| kubectl apply -f aws_auth_configmap.yaml --kubeconfig kube_config.yaml && break || \ | ||
| sleep 10; \ | ||
| done; \ | ||
| rm aws_auth_configmap.yaml kube_config.yaml; | ||
| EOS | ||
|
|
||
| interpreter = ["${var.local_exec_interpreter}"] | ||
|
|
||
| interpreter = var.local_exec_interpreter | ||
| } | ||
|
|
||
| triggers { | ||
| kube_config_map_rendered = "${data.template_file.kubeconfig.rendered}" | ||
| config_map_rendered = "${data.template_file.config_map_aws_auth.rendered}" | ||
| endpoint = "${aws_eks_cluster.this.endpoint}" | ||
| triggers = { | ||
| kube_config_map_rendered = data.template_file.kubeconfig.rendered | ||
| config_map_rendered = data.template_file.config_map_aws_auth.rendered | ||
| endpoint = aws_eks_cluster.this.endpoint | ||
| } | ||
| } | ||
|
|
||
| data "aws_caller_identity" "current" {} | ||
| data "aws_caller_identity" "current" { | ||
| } | ||
|
|
||
| data "template_file" "launch_template_mixed_worker_role_arns" { | ||
| count = "${var.worker_group_launch_template_mixed_count}" | ||
| template = "${file("${path.module}/templates/worker-role.tpl")}" | ||
|
|
||
| vars { | ||
| worker_role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${element(coalescelist(aws_iam_instance_profile.workers_launch_template_mixed.*.role, data.aws_iam_instance_profile.custom_worker_group_launch_template_mixed_iam_instance_profile.*.role_name), count.index)}" | ||
| count = local.worker_group_launch_template_mixed_count | ||
| template = file("${path.module}/templates/worker-role.tpl") | ||
|
|
||
| vars = { | ||
| worker_role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${element( | ||
| coalescelist( | ||
| aws_iam_instance_profile.workers_launch_template_mixed.*.role, | ||
| data.aws_iam_instance_profile.custom_worker_group_launch_template_mixed_iam_instance_profile.*.role_name, | ||
| ), | ||
| count.index, | ||
| )}" | ||
| } | ||
| } | ||
|
|
||
| data "template_file" "launch_template_worker_role_arns" { | ||
| count = "${var.worker_group_launch_template_count}" | ||
| template = "${file("${path.module}/templates/worker-role.tpl")}" | ||
|
|
||
| vars { | ||
| worker_role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${element(coalescelist(aws_iam_instance_profile.workers_launch_template.*.role, data.aws_iam_instance_profile.custom_worker_group_launch_template_iam_instance_profile.*.role_name), count.index)}" | ||
| count = local.worker_group_launch_template_count | ||
| template = file("${path.module}/templates/worker-role.tpl") | ||
|
|
||
| vars = { | ||
| worker_role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${element( | ||
| coalescelist( | ||
| aws_iam_instance_profile.workers_launch_template.*.role, | ||
| data.aws_iam_instance_profile.custom_worker_group_launch_template_iam_instance_profile.*.role_name, | ||
| ), | ||
| count.index, | ||
| )}" | ||
| } | ||
| } | ||
|
|
||
| data "template_file" "worker_role_arns" { | ||
| count = "${var.worker_group_count}" | ||
| template = "${file("${path.module}/templates/worker-role.tpl")}" | ||
|
|
||
| vars { | ||
| worker_role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${element(coalescelist(aws_iam_instance_profile.workers.*.role, data.aws_iam_instance_profile.custom_worker_group_iam_instance_profile.*.role_name), count.index)}" | ||
| count = local.worker_group_count | ||
| template = file("${path.module}/templates/worker-role.tpl") | ||
|
|
||
| vars = { | ||
| worker_role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${element( | ||
| coalescelist( | ||
| aws_iam_instance_profile.workers.*.role, | ||
| data.aws_iam_instance_profile.custom_worker_group_iam_instance_profile.*.role_name, | ||
| [""] | ||
| ), | ||
| count.index, | ||
| )}" | ||
| } | ||
| } | ||
|
|
||
| data "template_file" "config_map_aws_auth" { | ||
| template = "${file("${path.module}/templates/config-map-aws-auth.yaml.tpl")}" | ||
|
|
||
| vars { | ||
| worker_role_arn = "${join("", distinct(concat(data.template_file.launch_template_worker_role_arns.*.rendered, data.template_file.worker_role_arns.*.rendered, data.template_file.launch_template_mixed_worker_role_arns.*.rendered)))}" | ||
| map_users = "${join("", data.template_file.map_users.*.rendered)}" | ||
| map_roles = "${join("", data.template_file.map_roles.*.rendered)}" | ||
| map_accounts = "${join("", data.template_file.map_accounts.*.rendered)}" | ||
| template = file("${path.module}/templates/config-map-aws-auth.yaml.tpl") | ||
|
|
||
| vars = { | ||
| worker_role_arn = join( | ||
| "", | ||
| distinct( | ||
| concat( | ||
| data.template_file.launch_template_worker_role_arns.*.rendered, | ||
| data.template_file.worker_role_arns.*.rendered, | ||
| data.template_file.launch_template_mixed_worker_role_arns.*.rendered, | ||
| ), | ||
| ), | ||
| ) | ||
| map_users = join("", data.template_file.map_users.*.rendered) | ||
| map_roles = join("", data.template_file.map_roles.*.rendered) | ||
| map_accounts = join("", data.template_file.map_accounts.*.rendered) | ||
| } | ||
| } | ||
|
|
||
| data "template_file" "map_users" { | ||
| count = "${var.map_users_count}" | ||
| template = "${file("${path.module}/templates/config-map-aws-auth-map_users.yaml.tpl")}" | ||
|
|
||
| vars { | ||
| user_arn = "${lookup(var.map_users[count.index], "user_arn")}" | ||
| username = "${lookup(var.map_users[count.index], "username")}" | ||
| group = "${lookup(var.map_users[count.index], "group")}" | ||
| count = length(var.map_users) | ||
| template = file( | ||
| "${path.module}/templates/config-map-aws-auth-map_users.yaml.tpl", | ||
| ) | ||
|
|
||
| vars = { | ||
| user_arn = var.map_users[count.index]["user_arn"] | ||
| username = var.map_users[count.index]["username"] | ||
| group = var.map_users[count.index]["group"] | ||
| } | ||
| } | ||
|
|
||
| data "template_file" "map_roles" { | ||
| count = "${var.map_roles_count}" | ||
| template = "${file("${path.module}/templates/config-map-aws-auth-map_roles.yaml.tpl")}" | ||
|
|
||
| vars { | ||
| role_arn = "${lookup(var.map_roles[count.index], "role_arn")}" | ||
| username = "${lookup(var.map_roles[count.index], "username")}" | ||
| group = "${lookup(var.map_roles[count.index], "group")}" | ||
| count = length(var.map_roles) | ||
| template = file( | ||
| "${path.module}/templates/config-map-aws-auth-map_roles.yaml.tpl", | ||
| ) | ||
|
|
||
| vars = { | ||
| role_arn = var.map_roles[count.index]["role_arn"] | ||
| username = var.map_roles[count.index]["username"] | ||
| group = var.map_roles[count.index]["group"] | ||
| } | ||
| } | ||
|
|
||
| data "template_file" "map_accounts" { | ||
| count = "${var.map_accounts_count}" | ||
| template = "${file("${path.module}/templates/config-map-aws-auth-map_accounts.yaml.tpl")}" | ||
| count = length(var.map_accounts) | ||
| template = file( | ||
| "${path.module}/templates/config-map-aws-auth-map_accounts.yaml.tpl", | ||
| ) | ||
|
|
||
| vars { | ||
| account_number = "${element(var.map_accounts, count.index)}" | ||
| vars = { | ||
| account_number = var.map_accounts[count.index] | ||
| } | ||
| } | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,83 +1,89 @@ | ||
| resource "aws_cloudwatch_log_group" "this" { | ||
| name = "/aws/eks/${var.cluster_name}/cluster" | ||
| retention_in_days = "${var.cluster_log_retention_in_days}" | ||
| retention_in_days = var.cluster_log_retention_in_days | ||
|
|
||
| count = "${length(var.cluster_enabled_log_types) > 0 ? 1 : 0}" | ||
| count = length(var.cluster_enabled_log_types) > 0 ? 1 : 0 | ||
| } | ||
|
|
||
| resource "aws_eks_cluster" "this" { | ||
| name = "${var.cluster_name}" | ||
| enabled_cluster_log_types = "${var.cluster_enabled_log_types}" | ||
| role_arn = "${local.cluster_iam_role_arn}" | ||
| version = "${var.cluster_version}" | ||
| name = var.cluster_name | ||
| enabled_cluster_log_types = var.cluster_enabled_log_types | ||
| role_arn = local.cluster_iam_role_arn | ||
| version = var.cluster_version | ||
|
|
||
| vpc_config { | ||
| security_group_ids = ["${local.cluster_security_group_id}"] | ||
| subnet_ids = ["${var.subnets}"] | ||
| endpoint_private_access = "${var.cluster_endpoint_private_access}" | ||
| endpoint_public_access = "${var.cluster_endpoint_public_access}" | ||
| security_group_ids = [local.cluster_security_group_id] | ||
| subnet_ids = var.subnets | ||
| endpoint_private_access = var.cluster_endpoint_private_access | ||
| endpoint_public_access = var.cluster_endpoint_public_access | ||
| } | ||
|
|
||
| timeouts { | ||
| create = "${var.cluster_create_timeout}" | ||
| delete = "${var.cluster_delete_timeout}" | ||
| create = var.cluster_create_timeout | ||
| delete = var.cluster_delete_timeout | ||
| } | ||
|
|
||
| depends_on = [ | ||
| "aws_iam_role_policy_attachment.cluster_AmazonEKSClusterPolicy", | ||
| "aws_iam_role_policy_attachment.cluster_AmazonEKSServicePolicy", | ||
| "aws_cloudwatch_log_group.this", | ||
| aws_iam_role_policy_attachment.cluster_AmazonEKSClusterPolicy, | ||
| aws_iam_role_policy_attachment.cluster_AmazonEKSServicePolicy, | ||
| aws_cloudwatch_log_group.this | ||
| ] | ||
| } | ||
|
|
||
| resource "aws_security_group" "cluster" { | ||
| count = "${var.cluster_create_security_group ? 1 : 0}" | ||
| name_prefix = "${var.cluster_name}" | ||
| count = var.cluster_create_security_group ? 1 : 0 | ||
| name_prefix = var.cluster_name | ||
| description = "EKS cluster security group." | ||
| vpc_id = "${var.vpc_id}" | ||
| tags = "${merge(var.tags, map("Name", "${var.cluster_name}-eks_cluster_sg"))}" | ||
| vpc_id = var.vpc_id | ||
| tags = merge( | ||
| var.tags, | ||
| { | ||
| "Name" = "${var.cluster_name}-eks_cluster_sg" | ||
| }, | ||
| ) | ||
| } | ||
|
|
||
| resource "aws_security_group_rule" "cluster_egress_internet" { | ||
| count = "${var.cluster_create_security_group ? 1 : 0}" | ||
| count = var.cluster_create_security_group ? 1 : 0 | ||
| description = "Allow cluster egress access to the Internet." | ||
| protocol = "-1" | ||
| security_group_id = "${aws_security_group.cluster.id}" | ||
| security_group_id = aws_security_group.cluster[0].id | ||
| cidr_blocks = ["0.0.0.0/0"] | ||
| from_port = 0 | ||
| to_port = 0 | ||
| type = "egress" | ||
| } | ||
|
|
||
| resource "aws_security_group_rule" "cluster_https_worker_ingress" { | ||
| count = "${var.cluster_create_security_group ? 1 : 0}" | ||
| count = var.cluster_create_security_group ? 1 : 0 | ||
| description = "Allow pods to communicate with the EKS cluster API." | ||
| protocol = "tcp" | ||
| security_group_id = "${aws_security_group.cluster.id}" | ||
| source_security_group_id = "${local.worker_security_group_id}" | ||
| security_group_id = aws_security_group.cluster[0].id | ||
| source_security_group_id = local.worker_security_group_id | ||
| from_port = 443 | ||
| to_port = 443 | ||
| type = "ingress" | ||
| } | ||
|
|
||
| resource "aws_iam_role" "cluster" { | ||
| count = "${var.manage_cluster_iam_resources ? 1 : 0}" | ||
| name_prefix = "${var.cluster_name}" | ||
| assume_role_policy = "${data.aws_iam_policy_document.cluster_assume_role_policy.json}" | ||
| permissions_boundary = "${var.permissions_boundary}" | ||
| path = "${var.iam_path}" | ||
| count = var.manage_cluster_iam_resources ? 1 : 0 | ||
| name_prefix = var.cluster_name | ||
| assume_role_policy = data.aws_iam_policy_document.cluster_assume_role_policy.json | ||
| permissions_boundary = var.permissions_boundary | ||
| path = var.iam_path | ||
| force_detach_policies = true | ||
| tags = "${var.tags}" | ||
| tags = var.tags | ||
| } | ||
|
|
||
| resource "aws_iam_role_policy_attachment" "cluster_AmazonEKSClusterPolicy" { | ||
| count = "${var.manage_cluster_iam_resources ? 1 : 0}" | ||
| count = var.manage_cluster_iam_resources ? 1 : 0 | ||
| policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy" | ||
| role = "${aws_iam_role.cluster.name}" | ||
| role = aws_iam_role.cluster[0].name | ||
| } | ||
|
|
||
| resource "aws_iam_role_policy_attachment" "cluster_AmazonEKSServicePolicy" { | ||
| count = "${var.manage_cluster_iam_resources ? 1 : 0}" | ||
| count = var.manage_cluster_iam_resources ? 1 : 0 | ||
| policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy" | ||
| role = "${aws_iam_role.cluster.name}" | ||
| role = aws_iam_role.cluster[0].name | ||
| } | ||
|
|
Oops, something went wrong.