Skip to content

Commit ca01916

Browse files
yutachaosyutachaos
committed
feat: Added appmesh controller support
1 parent 724651e commit ca01916

File tree

3 files changed

+125
-0
lines changed

3 files changed

+125
-0
lines changed

‎modules/iam-role-for-service-accounts-eks/README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ Creates an IAM role which can be assumed by AWS EKS `ServiceAccount`s with optio
1111
- [Karpenter](https://github.com/aws/karpenter/blob/main/website/content/en/preview/getting-started/cloudformation.yaml)
1212
- [Load Balancer Controller](https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/install/iam_policy.json)
1313
- [Load Balancer Controller Target Group Binding Only](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/deploy/installation/#iam-permission-subset-for-those-who-use-targetgroupbinding-only-and-dont-plan-to-use-the-aws-load-balancer-controller-to-manage-security-group-rules)
14+
- [Appmesh Controller](https://github.com/aws/aws-app-mesh-controller-for-k8s/blob/master/config/iam/controller-iam-policy.json)
1415
- [Managed Service for Prometheus](https://docs.aws.amazon.com/prometheus/latest/userguide/set-up-irsa.html)
1516
- [Node Termination Handler](https://github.com/aws/aws-node-termination-handler#5-create-an-iam-role-for-the-pods)
1617
- [VPC CNI](https://docs.aws.amazon.com/eks/latest/userguide/cni-iam-role.html)
@@ -115,6 +116,7 @@ No modules.
115116
| Name | Type |
116117
|------|------|
117118
| [aws_iam_policy.amazon_managed_service_prometheus](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
119+
| [aws_iam_policy.appmesh_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
118120
| [aws_iam_policy.cert_manager](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
119121
| [aws_iam_policy.cluster_autoscaler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
120122
| [aws_iam_policy.ebs_csi](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
@@ -129,6 +131,7 @@ No modules.
129131
| [aws_iam_policy.vpc_cni](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
130132
| [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
131133
| [aws_iam_role_policy_attachment.amazon_managed_service_prometheus](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
134+
| [aws_iam_role_policy_attachment.appmesh_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
132135
| [aws_iam_role_policy_attachment.cert_manager](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
133136
| [aws_iam_role_policy_attachment.cluster_autoscaler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
134137
| [aws_iam_role_policy_attachment.ebs_csi](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
@@ -144,6 +147,7 @@ No modules.
144147
| [aws_iam_role_policy_attachment.vpc_cni](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
145148
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
146149
| [aws_iam_policy_document.amazon_managed_service_prometheus](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
150+
| [aws_iam_policy_document.appmesh_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
147151
| [aws_iam_policy_document.cert_manager](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
148152
| [aws_iam_policy_document.cluster_autoscaler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
149153
| [aws_iam_policy_document.ebs_csi](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
@@ -166,6 +170,7 @@ No modules.
166170
| <a name="input_amazon_managed_service_prometheus_workspace_arns"></a> [amazon\_managed\_service\_prometheus\_workspace\_arns](#input\_amazon\_managed\_service\_prometheus\_workspace\_arns) | List of AMP Workspace ARNs to read and write metrics | `list(string)` | <pre>[<br> "*"<br>]</pre> | no |
167171
| <a name="input_assume_role_condition_test"></a> [assume\_role\_condition\_test](#input\_assume\_role\_condition\_test) | Name of the [IAM condition operator](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html) to evaluate when assuming the role | `string` | `"StringEquals"` | no |
168172
| <a name="input_attach_amazon_managed_service_prometheus_policy"></a> [attach\_amazon\_managed\_service\_prometheus\_policy](#input\_attach\_amazon\_managed\_service\_prometheus\_policy) | Determines whether to attach the Amazon Managed Service for Prometheus IAM policy to the role | `bool` | `false` | no |
173+
| <a name="input_attach_appmesh_controller_policy"></a> [attach\_appmesh\_controller\_policy](#input\_attach\_appmesh\_controller\_policy) | Determines whether to attach the Appmesh Controller policy to the role | `bool` | `false` | no |
169174
| <a name="input_attach_cert_manager_policy"></a> [attach\_cert\_manager\_policy](#input\_attach\_cert\_manager\_policy) | Determines whether to attach the Cert Manager IAM policy to the role | `bool` | `false` | no |
170175
| <a name="input_attach_cluster_autoscaler_policy"></a> [attach\_cluster\_autoscaler\_policy](#input\_attach\_cluster\_autoscaler\_policy) | Determines whether to attach the Cluster Autoscaler IAM policy to the role | `bool` | `false` | no |
171176
| <a name="input_attach_ebs_csi_policy"></a> [attach\_ebs\_csi\_policy](#input\_attach\_ebs\_csi\_policy) | Determines whether to attach the EBS CSI IAM policy to the role | `bool` | `false` | no |

‎modules/iam-role-for-service-accounts-eks/policies.tf‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -894,6 +894,119 @@ resource "aws_iam_role_policy_attachment" "load_balancer_controller_targetgroup_
894894
policy_arn = aws_iam_policy.load_balancer_controller_targetgroup_only[0].arn
895895
}
896896

897+
################################################################################
898+
# Appmesh Controller
899+
################################################################################
900+
# https://github.com/aws/eks-charts/tree/master/stable/appmesh-controller#prerequisites
901+
# https://raw.githubusercontent.com/aws/aws-app-mesh-controller-for-k8s/master/config/iam/controller-iam-policy.json
902+
data "aws_iam_policy_document" "appmesh_controller" {
903+
count = var.create_role && var.attach_appmesh_controller_policy ? 1 : 0
904+
905+
statement {
906+
actions = [
907+
"appmesh:ListVirtualRouters",
908+
"appmesh:ListVirtualServices",
909+
"appmesh:ListRoutes",
910+
"appmesh:ListGatewayRoutes",
911+
"appmesh:ListMeshes",
912+
"appmesh:ListVirtualNodes",
913+
"appmesh:ListVirtualGateways",
914+
"appmesh:DescribeMesh",
915+
"appmesh:DescribeVirtualRouter",
916+
"appmesh:DescribeRoute",
917+
"appmesh:DescribeVirtualNode",
918+
"appmesh:DescribeVirtualGateway",
919+
"appmesh:DescribeGatewayRoute",
920+
"appmesh:DescribeVirtualService",
921+
"appmesh:CreateMesh",
922+
"appmesh:CreateVirtualRouter",
923+
"appmesh:CreateVirtualGateway",
924+
"appmesh:CreateVirtualService",
925+
"appmesh:CreateGatewayRoute",
926+
"appmesh:CreateRoute",
927+
"appmesh:CreateVirtualNode",
928+
"appmesh:UpdateMesh",
929+
"appmesh:UpdateRoute",
930+
"appmesh:UpdateVirtualGateway",
931+
"appmesh:UpdateVirtualRouter",
932+
"appmesh:UpdateGatewayRoute",
933+
"appmesh:UpdateVirtualService",
934+
"appmesh:UpdateVirtualNode",
935+
"appmesh:DeleteMesh",
936+
"appmesh:DeleteRoute",
937+
"appmesh:DeleteVirtualRouter",
938+
"appmesh:DeleteGatewayRoute",
939+
"appmesh:DeleteVirtualService",
940+
"appmesh:DeleteVirtualNode",
941+
"appmesh:DeleteVirtualGateway"
942+
]
943+
resources = ["*"]
944+
}
945+
946+
statement {
947+
actions = [
948+
"arn:aws:iam::*:role/aws-service-role/appmesh.amazonaws.com/AWSServiceRoleForAppMesh"
949+
]
950+
resources = ["*"]
951+
condition {
952+
test = "StringLike"
953+
variable = "iam:AWSServiceName"
954+
values = ["appmesh.amazonaws.com"]
955+
}
956+
}
957+
958+
statement {
959+
actions = [
960+
"acm:ListCertificates",
961+
"acm:DescribeCertificate",
962+
"acm-pca:DescribeCertificateAuthority",
963+
"acm-pca:ListCertificateAuthorities"
964+
]
965+
resources = ["*"]
966+
}
967+
968+
statement {
969+
actions = [
970+
"servicediscovery:CreateService",
971+
"servicediscovery:DeleteService",
972+
"servicediscovery:GetService",
973+
"servicediscovery:GetInstance",
974+
"servicediscovery:RegisterInstance",
975+
"servicediscovery:DeregisterInstance",
976+
"servicediscovery:ListInstances",
977+
"servicediscovery:ListNamespaces",
978+
"servicediscovery:ListServices",
979+
"servicediscovery:GetInstancesHealthStatus",
980+
"servicediscovery:UpdateInstanceCustomHealthStatus",
981+
"servicediscovery:GetOperation",
982+
"route53:GetHealthCheck",
983+
"route53:CreateHealthCheck",
984+
"route53:UpdateHealthCheck",
985+
"route53:ChangeResourceRecordSets",
986+
"route53:DeleteHealthCheck"
987+
]
988+
resources = ["*"]
989+
}
990+
}
991+
992+
resource "aws_iam_policy" "appmesh_controller" {
993+
count = var.create_role && var.attach_appmesh_controller_policy ? 1 : 0
994+
995+
name_prefix = "AmazonEKS_Appmesh_Controller-"
996+
path = var.role_path
997+
description = "Provides permissions to for appmesh controller"
998+
policy = data.aws_iam_policy_document.appmesh_controller[0].json
999+
1000+
tags = var.tags
1001+
}
1002+
1003+
resource "aws_iam_role_policy_attachment" "appmesh_controller" {
1004+
count = var.create_role && var.attach_appmesh_controller_policy ? 1 : 0
1005+
1006+
role = aws_iam_role.this[0].name
1007+
policy_arn = aws_iam_policy.appmesh_controller[0].arn
1008+
}
1009+
8971010
################################################################################
8981011
# Amazon Managed Service for Prometheus Policy
8991012
################################################################################

‎modules/iam-role-for-service-accounts-eks/variables.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,13 @@ variable "attach_load_balancer_controller_targetgroup_binding_only_policy" {
212212
default = false
213213
}
214214

215+
# AWS Appmesh Controller
216+
variable "attach_appmesh_controller_policy" {
217+
description = "Determines whether to attach the Appmesh Controller policy to the role"
218+
type = bool
219+
default = false
220+
}
221+
215222
# Amazon Managed Service for Prometheus
216223
variable "attach_amazon_managed_service_prometheus_policy" {
217224
description = "Determines whether to attach the Amazon Managed Service for Prometheus IAM policy to the role"

0 commit comments

Comments
 (0)