github-mirrors/terraform-aws-eks
1
0
Fork 0
mirror of https://github.com/ysoftdevs/terraform-aws-eks.git synced 2026-03-29 13:41:47 +02:00
Code Issues Packages Projects Releases Wiki Activity

docs: Use IRSA for Node Termination Handler IAM policy attachement in Instance Refresh example (#1373)

Browse Source
This commit is contained in:
Steve Hipwell
2021-05-19 11:40:54 +01:00
committed by GitHub
parent 91545abd75
commit 7c654a62b7
2 changed files with 57 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

85
examples/instance_refresh/main.tf
View File

@@ -1,3 +1,5 @@
# Based on the official aws-node-termination-handler setup guide at https://github.com/aws/aws-node-termination-handler#infrastructure-setup
provider "aws" { provider "aws" {
region = var.region region = var.region
} }
@@ -50,7 +52,7 @@ module "vpc" {
enable_dns_hostnames = true enable_dns_hostnames = true
} }
data "aws_iam_policy_document" "node_term" { data "aws_iam_policy_document" "aws_node_termination_handler" {
statement { statement {
effect = "Allow" effect = "Allow"
actions = [ actions = [
@@ -76,22 +78,17 @@ data "aws_iam_policy_document" "node_term" {
"sqs:ReceiveMessage" "sqs:ReceiveMessage"
] ]
resources = [ resources = [
module.node_term_sqs.sqs_queue_arn module.aws_node_termination_handler_sqs.sqs_queue_arn
] ]
} }
} }
resource "aws_iam_policy" "node_term" { resource "aws_iam_policy" "aws_node_termination_handler" {
name = "node-term-${local.cluster_name}" name = "${local.cluster_name}-aws-node-termination-handler"
policy = data.aws_iam_policy_document.node_term.json policy = data.aws_iam_policy_document.aws_node_termination_handler.json
} }
resource "aws_iam_role_policy_attachment" "node_term_policy" { data "aws_iam_policy_document" "aws_node_termination_handler_events" {
policy_arn = aws_iam_policy.node_term.arn
role = module.eks.worker_iam_role_name
}
data "aws_iam_policy_document" "node_term_events" {
statement { statement {
effect = "Allow" effect = "Allow"
principals { principals {
@@ -110,16 +107,16 @@ data "aws_iam_policy_document" "node_term_events" {
} }
} }
module "node_term_sqs" { module "aws_node_termination_handler_sqs" {
source = "terraform-aws-modules/sqs/aws" source = "terraform-aws-modules/sqs/aws"
version = "~> 3.0.0" version = "~> 3.0.0"
name = local.cluster_name name = local.cluster_name
message_retention_seconds = 300 message_retention_seconds = 300
policy = data.aws_iam_policy_document.node_term_events.json policy = data.aws_iam_policy_document.aws_node_termination_handler_events.json
} }
resource "aws_cloudwatch_event_rule" "node_term_event_rule" { resource "aws_cloudwatch_event_rule" "aws_node_termination_handler_asg" {
name = "${local.cluster_name}-nth-rule" name = "${local.cluster_name}-asg-termination"
description = "Node termination event rule" description = "Node termination event rule"
event_pattern = jsonencode( event_pattern = jsonencode(
{ {
@@ -134,24 +131,46 @@ resource "aws_cloudwatch_event_rule" "node_term_event_rule" {
) )
} }
resource "aws_cloudwatch_event_target" "node_term_event_target" { resource "aws_cloudwatch_event_target" "aws_node_termination_handler_asg" {
rule = aws_cloudwatch_event_rule.node_term_event_rule.name target_id = "${local.cluster_name}-asg-termination"
target_id = "ANTHandler" rule = aws_cloudwatch_event_rule.aws_node_termination_handler_asg.name
arn = module.node_term_sqs.sqs_queue_arn arn = module.aws_node_termination_handler_sqs.sqs_queue_arn
} }
module "node_term_role" { resource "aws_cloudwatch_event_rule" "aws_node_termination_handler_spot" {
name = "${local.cluster_name}-spot-termination"
description = "Node termination event rule"
event_pattern = jsonencode(
{
"source" : [
"aws.ec2"
],
"detail-type" : [
"EC2 Spot Instance Interruption Warning"
]
"resources" : module.eks.workers_asg_arns
}
)
}
resource "aws_cloudwatch_event_target" "aws_node_termination_handler_spot" {
target_id = "${local.cluster_name}-spot-termination"
rule = aws_cloudwatch_event_rule.aws_node_termination_handler_spot.name
arn = module.aws_node_termination_handler_sqs.sqs_queue_arn
}
module "aws_node_termination_handler_role" {
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc" source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
version = "4.1.0" version = "4.1.0"
create_role = true create_role = true
role_description = "IRSA role for ANTH, cluster ${local.cluster_name}" role_description = "IRSA role for ANTH, cluster ${local.cluster_name}"
role_name_prefix = local.cluster_name role_name_prefix = local.cluster_name
provider_url = replace(module.eks.cluster_oidc_issuer_url, "https://", "") provider_url = replace(module.eks.cluster_oidc_issuer_url, "https://", "")
role_policy_arns = [aws_iam_policy.node_term.arn] role_policy_arns = [aws_iam_policy.aws_node_termination_handler.arn]
oidc_fully_qualified_subjects = ["system:serviceaccount:${var.namespace}:${var.serviceaccount}"] oidc_fully_qualified_subjects = ["system:serviceaccount:${var.namespace}:${var.serviceaccount}"]
} }
resource "helm_release" "anth" { resource "helm_release" "aws_node_termination_handler" {
depends_on = [ depends_on = [
module.eks module.eks
] ]
@@ -173,29 +192,35 @@ resource "helm_release" "anth" {
} }
set { set {
name = "serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn" name = "serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"
value = module.node_term_role.iam_role_arn value = module.aws_node_termination_handler_role.iam_role_arn
type = "string" type = "string"
} }
set { set {
name = "enableSqsTerminationDraining" name = "enableSqsTerminationDraining"
value = "true" value = "true"
} }
set {
name = "enableSpotInterruptionDraining"
value = "true"
}
set { set {
name = "queueURL" name = "queueURL"
value = module.node_term_sqs.sqs_queue_id value = module.aws_node_termination_handler_sqs.sqs_queue_id
} }
set { set {
name = "logLevel" name = "logLevel"
value = "DEBUG" value = "debug"
} }
} }
# Creating the lifecycle-hook outside of the ASG resource's `initial_lifecycle_hook` # Creating the lifecycle-hook outside of the ASG resource's `initial_lifecycle_hook`
# ensures that node termination does not require the lifecycle action to be completed, # ensures that node termination does not require the lifecycle action to be completed,
# and thus allows the ASG to be destroyed cleanly. # and thus allows the ASG to be destroyed cleanly.
resource "aws_autoscaling_lifecycle_hook" "node_term" { resource "aws_autoscaling_lifecycle_hook" "aws_node_termination_handler" {
name = "node_term-${local.cluster_name}" for_each = toset(module.eks.workers_asg_names)
autoscaling_group_name = module.eks.workers_asg_names[0]
name = "aws-node-termination-handler"
autoscaling_group_name = each.value
lifecycle_transition = "autoscaling:EC2_INSTANCE_TERMINATING" lifecycle_transition = "autoscaling:EC2_INSTANCE_TERMINATING"
heartbeat_timeout = 300 heartbeat_timeout = 300
default_result = "CONTINUE" default_result = "CONTINUE"
@@ -227,8 +252,8 @@ module "eks" {
key = "foo" key = "foo"
value = "buzz" value = "buzz"
propagate_at_launch = true propagate_at_launch = true
}, }
] ]
}, }
] ]
} }

4
examples/instance_refresh/outputs.tf
View File

@@ -25,10 +25,10 @@ output "region" {
output "sqs_queue_asg_notification_arn" { output "sqs_queue_asg_notification_arn" {
description = "SQS queue ASG notification ARN" description = "SQS queue ASG notification ARN"
value = module.node_term_sqs.sqs_queue_arn value = module.aws_node_termination_handler_sqs.sqs_queue_arn
} }
output "sqs_queue_asg_notification_url" { output "sqs_queue_asg_notification_url" {
description = "SQS queue ASG notification URL" description = "SQS queue ASG notification URL"
value = module.node_term_sqs.sqs_queue_id value = module.aws_node_termination_handler_sqs.sqs_queue_id
} }