refactor: Refactoring to match the rest of terraform-aws-modules (#1583)

2026-03-20 00:23:46 +01:00 · 2021-09-16 11:35:44 +02:00
parent 619b4a0d48
commit 2bdf7d7dd6
76 changed files with 1350 additions and 1037 deletions
--- a/modules/fargate/README.md
+++ b/modules/fargate/README.md
@@ -1,13 +1,15 @@
-# eks `fargate` submodule
+# EKS `fargate` submodule

 Helper submodule to create and manage resources related to `aws_eks_fargate_profile`.

-## Assumptions
-* Designed for use by the parent module and not directly by end users
-
 ## `fargate_profile` keys
+
 `fargate_profile` is a map of maps. Key of first level will be used as unique value for `for_each` resources and in the `aws_eks_fargate_profile` name. Inner map can take the below values.

+## Example
+
+See example code in `examples/fargate`.
+
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | name | Fargate profile name | `string` | Auto generated in the following format `[cluster_name]-fargate-[fargate_profile_map_key]`| no |
@@ -42,19 +44,18 @@ No modules.
 | [aws_iam_role_policy_attachment.eks_fargate_pod](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
 | [aws_iam_policy_document.eks_fargate_pod_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
 | [aws_iam_role.custom_fargate_iam_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_role) | data source |
+| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |

 ## Inputs

 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
-| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | Name of the EKS cluster. | `string` | n/a | yes |
+| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | Name of the EKS cluster. | `string` | `""` | no |
 | <a name="input_create_eks"></a> [create\_eks](#input\_create\_eks) | Controls if EKS resources should be created (it affects almost all resources) | `bool` | `true` | no |
 | <a name="input_create_fargate_pod_execution_role"></a> [create\_fargate\_pod\_execution\_role](#input\_create\_fargate\_pod\_execution\_role) | Controls if the the IAM Role that provides permissions for the EKS Fargate Profile should be created. | `bool` | `true` | no |
-| <a name="input_eks_depends_on"></a> [eks\_depends\_on](#input\_eks\_depends\_on) | List of references to other resources this submodule depends on. | `any` | `null` | no |
 | <a name="input_fargate_pod_execution_role_name"></a> [fargate\_pod\_execution\_role\_name](#input\_fargate\_pod\_execution\_role\_name) | The IAM Role that provides permissions for the EKS Fargate Profile. | `string` | `null` | no |
 | <a name="input_fargate_profiles"></a> [fargate\_profiles](#input\_fargate\_profiles) | Fargate profiles to create. See `fargate_profile` keys section in README.md for more details | `any` | `{}` | no |
 | <a name="input_iam_path"></a> [iam\_path](#input\_iam\_path) | IAM roles will be created on this path. | `string` | `"/"` | no |
-| <a name="input_iam_policy_arn_prefix"></a> [iam\_policy\_arn\_prefix](#input\_iam\_policy\_arn\_prefix) | IAM policy prefix with the correct AWS partition. | `string` | n/a | yes |
 | <a name="input_permissions_boundary"></a> [permissions\_boundary](#input\_permissions\_boundary) | If provided, all IAM roles will be created with this permissions boundary attached. | `string` | `null` | no |
 | <a name="input_subnets"></a> [subnets](#input\_subnets) | A list of subnets for the EKS Fargate profiles. | `list(string)` | `[]` | no |
 | <a name="input_tags"></a> [tags](#input\_tags) | A map of tags to add to all resources. | `map(string)` | `{}` | no |
--- a/modules/fargate/data.tf
+++ b/modules/fargate/data.tf
@@ -1,17 +0,0 @@
-data "aws_iam_policy_document" "eks_fargate_pod_assume_role" {
-  count = local.create_eks && var.create_fargate_pod_execution_role ? 1 : 0
-  statement {
-    effect  = "Allow"
-    actions = ["sts:AssumeRole"]
-
-    principals {
-      type        = "Service"
-      identifiers = ["eks-fargate-pods.amazonaws.com"]
-    }
-  }
-}
-
-data "aws_iam_role" "custom_fargate_iam_role" {
-  count = local.create_eks && !var.create_fargate_pod_execution_role ? 1 : 0
-  name  = var.fargate_pod_execution_role_name
-}
--- a/modules/fargate/fargate.tf
+++ b/modules/fargate/fargate.tf
@@ -1,33 +0,0 @@
-resource "aws_iam_role" "eks_fargate_pod" {
-  count                = local.create_eks && var.create_fargate_pod_execution_role ? 1 : 0
-  name_prefix          = format("%s-fargate", substr(var.cluster_name, 0, 24))
-  assume_role_policy   = data.aws_iam_policy_document.eks_fargate_pod_assume_role[0].json
-  permissions_boundary = var.permissions_boundary
-  tags                 = var.tags
-  path                 = var.iam_path
-}
-
-resource "aws_iam_role_policy_attachment" "eks_fargate_pod" {
-  count      = local.create_eks && var.create_fargate_pod_execution_role ? 1 : 0
-  policy_arn = "${var.iam_policy_arn_prefix}/AmazonEKSFargatePodExecutionRolePolicy"
-  role       = aws_iam_role.eks_fargate_pod[0].name
-}
-
-resource "aws_eks_fargate_profile" "this" {
-  for_each               = local.create_eks ? local.fargate_profiles_expanded : {}
-  cluster_name           = var.cluster_name
-  fargate_profile_name   = lookup(each.value, "name", format("%s-fargate-%s", var.cluster_name, replace(each.key, "_", "-")))
-  pod_execution_role_arn = local.pod_execution_role_arn
-  subnet_ids             = lookup(each.value, "subnets", var.subnets)
-  tags                   = each.value.tags
-
-  dynamic "selector" {
-    for_each = each.value.selectors
-    content {
-      namespace = selector.value["namespace"]
-      labels    = lookup(selector.value, "labels", {})
-    }
-  }
-
-  depends_on = [var.eks_depends_on]
-}
--- a/modules/fargate/locals.tf
+++ b/modules/fargate/locals.tf
@@ -1,10 +0,0 @@
-locals {
-  create_eks              = var.create_eks && length(var.fargate_profiles) > 0
-  pod_execution_role_arn  = var.create_fargate_pod_execution_role ? element(concat(aws_iam_role.eks_fargate_pod.*.arn, [""]), 0) : element(concat(data.aws_iam_role.custom_fargate_iam_role.*.arn, [""]), 0)
-  pod_execution_role_name = var.create_fargate_pod_execution_role ? element(concat(aws_iam_role.eks_fargate_pod.*.name, [""]), 0) : element(concat(data.aws_iam_role.custom_fargate_iam_role.*.name, [""]), 0)
-
-  fargate_profiles_expanded = { for k, v in var.fargate_profiles : k => merge(
-    v,
-    { tags = merge(var.tags, lookup(v, "tags", {})) },
-  ) if var.create_eks }
-}
--- a/modules/fargate/main.tf
+++ b/modules/fargate/main.tf
@@ -0,0 +1,67 @@
+locals {
+  create_eks = var.create_eks && length(var.fargate_profiles) > 0
+
+  pod_execution_role_arn  = coalescelist(aws_iam_role.eks_fargate_pod.*.arn, data.aws_iam_role.custom_fargate_iam_role.*.arn, [""])[0]
+  pod_execution_role_name = coalescelist(aws_iam_role.eks_fargate_pod.*.name, data.aws_iam_role.custom_fargate_iam_role.*.name, [""])[0]
+
+  fargate_profiles = { for k, v in var.fargate_profiles : k => v if var.create_eks }
+}
+
+data "aws_partition" "current" {}
+
+data "aws_iam_policy_document" "eks_fargate_pod_assume_role" {
+  count = local.create_eks && var.create_fargate_pod_execution_role ? 1 : 0
+
+  statement {
+    effect  = "Allow"
+    actions = ["sts:AssumeRole"]
+
+    principals {
+      type        = "Service"
+      identifiers = ["eks-fargate-pods.amazonaws.com"]
+    }
+  }
+}
+
+data "aws_iam_role" "custom_fargate_iam_role" {
+  count = local.create_eks && !var.create_fargate_pod_execution_role ? 1 : 0
+
+  name = var.fargate_pod_execution_role_name
+}
+
+resource "aws_iam_role" "eks_fargate_pod" {
+  count = local.create_eks && var.create_fargate_pod_execution_role ? 1 : 0
+
+  name_prefix          = format("%s-fargate", substr(var.cluster_name, 0, 24))
+  assume_role_policy   = data.aws_iam_policy_document.eks_fargate_pod_assume_role[0].json
+  permissions_boundary = var.permissions_boundary
+  tags                 = var.tags
+  path                 = var.iam_path
+}
+
+resource "aws_iam_role_policy_attachment" "eks_fargate_pod" {
+  count = local.create_eks && var.create_fargate_pod_execution_role ? 1 : 0
+
+  policy_arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy"
+  role       = aws_iam_role.eks_fargate_pod[0].name
+}
+
+resource "aws_eks_fargate_profile" "this" {
+  for_each = local.fargate_profiles
+
+  cluster_name           = var.cluster_name
+  fargate_profile_name   = lookup(each.value, "name", format("%s-fargate-%s", var.cluster_name, replace(each.key, "_", "-")))
+  pod_execution_role_arn = local.pod_execution_role_arn
+  subnet_ids             = lookup(each.value, "subnets", var.subnets)
+
+  dynamic "selector" {
+    for_each = each.value.selectors
+
+    content {
+      namespace = selector.value["namespace"]
+      labels    = lookup(selector.value, "labels", {})
+    }
+  }
+
+  tags = merge(var.tags, lookup(each.value, "tags", {}))
+}
--- a/modules/fargate/variables.tf
+++ b/modules/fargate/variables.tf
@@ -1,31 +1,27 @@
-variable "cluster_name" {
-  description = "Name of the EKS cluster."
-  type        = string
-}
-
 variable "create_eks" {
  description = "Controls if EKS resources should be created (it affects almost all resources)"
  type        = bool
  default     = true
 }

-variable "iam_path" {
-  description = "IAM roles will be created on this path."
-  type        = string
-  default     = "/"
-}
-
-variable "iam_policy_arn_prefix" {
-  description = "IAM policy prefix with the correct AWS partition."
-  type        = string
-}
-
 variable "create_fargate_pod_execution_role" {
  description = "Controls if the the IAM Role that provides permissions for the EKS Fargate Profile should be created."
  type        = bool
  default     = true
 }

+variable "cluster_name" {
+  description = "Name of the EKS cluster."
+  type        = string
+  default     = ""
+}
+
+variable "iam_path" {
+  description = "IAM roles will be created on this path."
+  type        = string
+  default     = "/"
+}
+
 variable "fargate_pod_execution_role_name" {
  description = "The IAM Role that provides permissions for the EKS Fargate Profile."
  type        = string
@@ -55,11 +51,3 @@ variable "tags" {
  type        = map(string)
  default     = {}
 }
-
-# Hack for a homemade `depends_on` https://discuss.hashicorp.com/t/tips-howto-implement-module-depends-on-emulation/2305/2
-# Will be removed in Terraform 0.13 with the support of module's `depends_on` https://github.com/hashicorp/terraform/issues/10462
-variable "eks_depends_on" {
-  description = "List of references to other resources this submodule depends on."
-  type        = any
-  default     = null
-}