From 58c4a0e30fe018157d6f67d990002a28c44b7424 Mon Sep 17 00:00:00 2001
From: Max Williams <max.williams@deliveryhero.com>
Date: Fri, 6 Jul 2018 16:31:55 +0200
Subject: [PATCH] initial commit

---
 aws_auth.tf                                   | 49 +++++++++++++++++--
 data.tf                                       |  8 ---
 .../config-map-aws-auth-map_accounts.yaml.tpl |  1 +
 .../config-map-aws-auth-map_roles.yaml.tpl    |  4 ++
 .../config-map-aws-auth-map_users.yaml.tpl    |  4 ++
 templates/config-map-aws-auth.yaml.tpl        |  7 ++-
 variables.tf                                  | 18 +++++++
 7 files changed, 79 insertions(+), 12 deletions(-)
 create mode 100644 templates/config-map-aws-auth-map_accounts.yaml.tpl
 create mode 100644 templates/config-map-aws-auth-map_roles.yaml.tpl
 create mode 100644 templates/config-map-aws-auth-map_users.yaml.tpl

diff --git a/aws_auth.tf b/aws_auth.tf
index 6038dc5..3dd9159 100644
--- a/aws_auth.tf
+++ b/aws_auth.tf
@@ -1,17 +1,60 @@
 resource "local_file" "config_map_aws_auth" {
   content  = "${data.template_file.config_map_aws_auth.rendered}"
   filename = "${var.config_output_path}/config-map-aws-auth.yaml"
-  count    = "${var.manage_aws_auth ? 1 : 0}"
+  count    = "${var.configure_kubectl_session ? 1 : 0}"
 }
 
-resource "null_resource" "update_config_map_aws_auth" {
+resource "null_resource" "configure_kubectl" {
   provisioner "local-exec" {
     command = "kubectl apply -f ${var.config_output_path}/config-map-aws-auth.yaml --kubeconfig ${var.config_output_path}/kubeconfig"
   }
 
   triggers {
     config_map_rendered = "${data.template_file.config_map_aws_auth.rendered}"
+    kubeconfig_rendered = "${data.template_file.kubeconfig.rendered}"
   }
 
-  count = "${var.manage_aws_auth ? 1 : 0}"
+  count = "${var.configure_kubectl_session ? 1 : 0}"
+}
+
+data "template_file" "config_map_aws_auth" {
+  template = "${file("${path.module}/templates/config-map-aws-auth.yaml.tpl")}"
+
+  vars {
+    worker_role_arn = "${aws_iam_role.workers.arn}"
+    map_users       = "${join("", data.template_file.map_users.*.rendered)}"
+    map_roles       = "${join("", data.template_file.map_roles.*.rendered)}"
+    map_accounts    = "${join("", data.template_file.map_accounts.*.rendered)}"
+  }
+}
+
+data "template_file" "map_users" {
+  count    = "${length(var.map_users)}"
+  template = "${file("${path.module}/templates/config-map-aws-auth-map_users.yaml.tpl")}"
+
+  vars {
+    user_arn = "${lookup(var.map_users[count.index], "user_arn")}"
+    username = "${lookup(var.map_users[count.index], "username")}"
+    group    = "${lookup(var.map_users[count.index], "group")}"
+  }
+}
+
+data "template_file" "map_roles" {
+  count    = "${length(var.map_roles)}"
+  template = "${file("${path.module}/templates/config-map-aws-auth-map_roles.yaml.tpl")}"
+
+  vars {
+    role_arn = "${lookup(var.map_roles[count.index], "role_arn")}"
+    username = "${lookup(var.map_roles[count.index], "username")}"
+    group    = "${lookup(var.map_roles[count.index], "group")}"
+  }
+}
+
+data "template_file" "map_accounts" {
+  count    = "${length(var.map_accounts)}"
+  template = "${file("${path.module}/templates/config-map-aws-auth-map_accounts.yaml.tpl")}"
+
+  vars {
+    account_number = "${element(var.map_accounts, count.index)}"
+  }
 }
diff --git a/data.tf b/data.tf
index 76a7eb6..0273182 100644
--- a/data.tf
+++ b/data.tf
@@ -73,14 +73,6 @@ EOF
   }
 }
 
-data "template_file" "config_map_aws_auth" {
-  template = "${file("${path.module}/templates/config-map-aws-auth.yaml.tpl")}"
-
-  vars {
-    role_arn = "${aws_iam_role.workers.arn}"
-  }
-}
-
 data "template_file" "userdata" {
   template = "${file("${path.module}/templates/userdata.sh.tpl")}"
   count    = "${length(var.worker_groups)}"
diff --git a/templates/config-map-aws-auth-map_accounts.yaml.tpl b/templates/config-map-aws-auth-map_accounts.yaml.tpl
new file mode 100644
index 0000000..26dc507
--- /dev/null
+++ b/templates/config-map-aws-auth-map_accounts.yaml.tpl
@@ -0,0 +1 @@
+    - "${account_number}"
diff --git a/templates/config-map-aws-auth-map_roles.yaml.tpl b/templates/config-map-aws-auth-map_roles.yaml.tpl
new file mode 100644
index 0000000..9f321b7
--- /dev/null
+++ b/templates/config-map-aws-auth-map_roles.yaml.tpl
@@ -0,0 +1,4 @@
+    - rolearn: ${role_arn}
+      username: ${username}
+      groups:
+        - ${group}
diff --git a/templates/config-map-aws-auth-map_users.yaml.tpl b/templates/config-map-aws-auth-map_users.yaml.tpl
new file mode 100644
index 0000000..92499de
--- /dev/null
+++ b/templates/config-map-aws-auth-map_users.yaml.tpl
@@ -0,0 +1,4 @@
+    - userarn: ${user_arn}
+      username: ${username}
+      groups:
+        - ${group}
diff --git a/templates/config-map-aws-auth.yaml.tpl b/templates/config-map-aws-auth.yaml.tpl
index 746817f..8cd42fe 100644
--- a/templates/config-map-aws-auth.yaml.tpl
+++ b/templates/config-map-aws-auth.yaml.tpl
@@ -5,8 +5,13 @@ metadata:
   namespace: kube-system
 data:
   mapRoles: |
-    - rolearn: ${role_arn}
+    - rolearn: ${worker_role_arn}
       username: system:node:{{EC2PrivateDNSName}}
       groups:
         - system:bootstrappers
         - system:nodes
+${map_roles}
+  mapUsers: |
+${map_users}
+  mapAccounts: |
+${map_accounts}
diff --git a/variables.tf b/variables.tf
index 35ccf90..9eb67c0 100644
--- a/variables.tf
+++ b/variables.tf
@@ -32,6 +32,24 @@ variable "manage_aws_auth" {
   default     = true
 }
 
+variable "map_accounts" {
+  description = "Additional AWS account numbers to add to the aws-auth configmap"
+  type        = "list"
+  default     = []
+}
+
+variable "map_roles" {
+  description = "Additional IAM roles to add to the aws-auth configmap"
+  type        = "list"
+  default     = []
+}
+
+variable "map_users" {
+  description = "Additional IAM users to add to the aws-auth configmap"
+  type        = "list"
+  default     = []
+}
+
 variable "subnets" {
   description = "A list of subnets to place the EKS cluster and workers within."
   type        = "list"