github-mirrors/terraform-aws-eks
1
0
Fork 0
mirror of https://github.com/ysoftdevs/terraform-aws-eks.git synced 2026-03-31 06:23:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #49 from bti360/kubeconfig-updates

Browse Source 
Allow Kubeconfig to be more configurable
This commit is contained in:
Brandon J. O'Connor
2018-06-30 16:12:52 -07:00
committed by GitHub
parent c0726f8153 c1ebd58b42
commit 0bbfb04726
5 changed files with 97 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
README.md
View File

@@ -95,15 +95,20 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a
| Name | Description | Type | Default | Required | | Name | Description | Type | Default | Required |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :----: | :------: | :------: | | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :----: | :------: | :------: |
| cluster_name | Name of the EKS cluster. Also used as a prefix in names of related resources. | string | - | yes | | cluster_name | Name of the EKS cluster. Also used as a prefix in names of related resources. | string | - | yes |
| cluster_security_group_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the workers and provide API access to your current IP/32. | string | `` | no | | cluster_security_group_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the workers and provide API access to your current IP/32. | string | `` | no |
| cluster_version | Kubernetes version to use for the EKS cluster. | string | `1.10` | no | | cluster_version | Kubernetes version to use for the EKS cluster. | string | `1.10` | no |
| config_output_path | Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. | string | `./` | no | | config_output_path | Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. | string | `./` | no |
| configure_kubectl_session | Configure the current session's kubectl to use the instantiated EKS cluster. | string | `true` | no | | configure_kubectl_session | Configure the current session's kubectl to use the instantiated EKS cluster. | string | `true` | no |
| kubeconfig_context_name | Name of the kubeconfig context. | map | `aws` | no |
| kubeconfig_user_name | Name of the kubeconfig user. | map | `aws` | no |
| kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | map | `heptio-authenticator-aws` | no |
| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume `["-r", "MyEksRole"]` | map | `<list>` | no |
| kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. `{ AWS_PROFILE = "eks"}` | map | `<map>` | no |
| subnets | A list of subnets to place the EKS cluster and workers within. | list | - | yes | | subnets | A list of subnets to place the EKS cluster and workers within. | list | - | yes |
| tags | A map of tags to add to all resources. | string | `<map>` | no | | tags | A map of tags to add to all resources. | string | `<map>` | no |
| vpc_id | VPC where the cluster and workers will be deployed. | string | - | yes | | vpc_id | VPC where the cluster and workers will be deployed. | string | - | yes |
| worker_groups | A list of maps defining worker group configurations. See workers_group_defaults for valid keys. | list | `<list>` | no | | worker_groups | A list of maps defining worker group configurations. See workers_group_defaults for valid keys. | list | `<list>` | no |
| worker_security_group_id | If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the EKS cluster. | string | `` | no | | worker_security_group_id | If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the EKS cluster. | string | `` | no |
| worker_sg_ingress_from_port | Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443). | string | `1025` | no | | worker_sg_ingress_from_port | Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443). | string | `1025` | no |
| workers_group_defaults | Default values for target groups as defined by the list of maps. | map | `<map>` | no | | workers_group_defaults | Default values for target groups as defined by the list of maps. | map | `<map>` | no |
| workstation_cidr | Override the default ingress rule that allows communication with the EKS cluster API. If not given, will use current IP/32. | string | - | no | | workstation_cidr | Override the default ingress rule that allows communication with the EKS cluster API. If not given, will use current IP/32. | string | - | no |

29
data.tf
View File

@@ -44,14 +44,33 @@ data "aws_iam_policy_document" "cluster_assume_role_policy" {
} }
} }
data template_file kubeconfig { data "template_file" "kubeconfig" {
template = "${file("${path.module}/templates/kubeconfig.tpl")}" template = "${file("${path.module}/templates/kubeconfig.tpl")}"
vars { vars {
cluster_name = "${var.cluster_name}" cluster_name = "${var.cluster_name}"
endpoint = "${aws_eks_cluster.this.endpoint}" endpoint = "${aws_eks_cluster.this.endpoint}"
region = "${data.aws_region.current.name}" region = "${data.aws_region.current.name}"
cluster_auth_base64 = "${aws_eks_cluster.this.certificate_authority.0.data}" cluster_auth_base64 = "${aws_eks_cluster.this.certificate_authority.0.data}"
context_name = "${var.kubeconfig_context_name}"
user_name = "${var.kubeconfig_user_name}"
aws_authenticator_command = "${var.kubeconfig_aws_authenticator_command}"
aws_authenticator_additional_args = "${length(var.kubeconfig_aws_authenticator_additional_args) > 0 ? " - ${join("\n - ", var.kubeconfig_aws_authenticator_additional_args)}" : "" }"
aws_authenticator_env_variables = "${length(var.kubeconfig_aws_authenticator_env_variables) > 0 ? " env:\n${join("\n", data.template_file.aws_authenticator_env_variables.*.rendered)}" : ""}"
}
}
data "template_file" "aws_authenticator_env_variables" {
template = <<EOF
- name: $${key}
value: $${value}
EOF
count = "${length(var.kubeconfig_aws_authenticator_env_variables)}"
vars {
value = "${element(values(var.kubeconfig_aws_authenticator_env_variables), count.index)}"
key = "${element(keys(var.kubeconfig_aws_authenticator_env_variables), count.index)}"
} }
} }

24
templates/config-map-aws-auth.yaml.tpl
View File

@@ -1,12 +1,12 @@
apiVersion: v1 apiVersion: v1
kind: ConfigMap kind: ConfigMap
metadata: metadata:
name: aws-auth name: aws-auth
namespace: kube-system namespace: kube-system
data: data:
mapRoles: | mapRoles: |
- rolearn: ${role_arn} - rolearn: ${role_arn}
username: system:node:{{EC2PrivateDNSName}} username: system:node:{{EC2PrivateDNSName}}
groups: groups:
- system:bootstrappers - system:bootstrappers
- system:nodes - system:nodes

56
templates/kubeconfig.tpl
View File

@@ -1,27 +1,29 @@
apiVersion: v1 apiVersion: v1
preferences: {} preferences: {}
kind: Config kind: Config
clusters: clusters:
- cluster: - cluster:
server: ${endpoint} server: ${endpoint}
certificate-authority-data: ${cluster_auth_base64} certificate-authority-data: ${cluster_auth_base64}
name: kubernetes name: ${cluster_name}
contexts: contexts:
- context: - context:
cluster: kubernetes cluster: ${cluster_name}
user: aws user: ${user_name}
name: aws name: ${context_name}
current-context: aws current-context: ${context_name}
users: users:
- name: aws - name: ${user_name}
user: user:
exec: exec:
apiVersion: client.authentication.k8s.io/v1alpha1 apiVersion: client.authentication.k8s.io/v1alpha1
command: heptio-authenticator-aws command: ${aws_authenticator_command}
args: args:
- "token" - "token"
- "-i" - "-i"
- "${cluster_name}" - "${cluster_name}"
${aws_authenticator_additional_args}
${aws_authenticator_env_variables}

25
variables.tf
View File

@@ -78,3 +78,28 @@ variable "worker_sg_ingress_from_port" {
description = "Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443)." description = "Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443)."
default = "1025" default = "1025"
} }
variable "kubeconfig_context_name" {
description = "Name of the kubeconfig context."
default = "aws"
}
variable "kubeconfig_user_name" {
description = "Name of the kubeconfig user."
default = "aws"
}
variable "kubeconfig_aws_authenticator_command" {
description = "Command to use to to fetch AWS EKS credentials"
default = "heptio-authenticator-aws"
}
variable "kubeconfig_aws_authenticator_additional_args" {
description = "Any additional arguments to pass to the authenticator such as the role to assume [\"-r\", \"MyEksRole\"]"
default = []
}
variable "kubeconfig_aws_authenticator_env_variables" {
description = "Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = \"eks\"}"
default = {}
}