mirror of
https://github.com/ysoftdevs/terraform-aws-eks.git
synced 2026-03-27 20:01:06 +01:00
fix: Update examples to show integration and usage of new IRSA submodule (#1882)
This commit is contained in:
Bryant Biggs
@@ -40,10 +40,10 @@ Note that this example may create resources which cost money. Run `terraform des
|
||||
|
||||
| Name | Source | Version |
|
||||
|------|--------|---------|
|
||||
| <a name="module_aws_node_termination_handler_role"></a> [aws\_node\_termination\_handler\_role](#module\_aws\_node\_termination\_handler\_role) | terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc | ~> 4.0 |
|
||||
| <a name="module_aws_node_termination_handler_sqs"></a> [aws\_node\_termination\_handler\_sqs](#module\_aws\_node\_termination\_handler\_sqs) | terraform-aws-modules/sqs/aws | ~> 3.0 |
|
||||
| <a name="module_cluster_autoscaler_irsa"></a> [cluster\_autoscaler\_irsa](#module\_cluster\_autoscaler\_irsa) | terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks | ~> 4.12 |
|
||||
| <a name="module_eks"></a> [eks](#module\_eks) | ../.. | n/a |
|
||||
| <a name="module_iam_assumable_role_cluster_autoscaler"></a> [iam\_assumable\_role\_cluster\_autoscaler](#module\_iam\_assumable\_role\_cluster\_autoscaler) | terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc | ~> 4.0 |
|
||||
| <a name="module_node_termination_handler_irsa"></a> [node\_termination\_handler\_irsa](#module\_node\_termination\_handler\_irsa) | terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks | ~> 4.12 |
|
||||
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3.0 |
|
||||
|
||||
## Resources
|
||||
@@ -55,17 +55,13 @@ Note that this example may create resources which cost money. Run `terraform des
|
||||
| [aws_cloudwatch_event_rule.aws_node_termination_handler_spot](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource |
|
||||
| [aws_cloudwatch_event_target.aws_node_termination_handler_asg](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource |
|
||||
| [aws_cloudwatch_event_target.aws_node_termination_handler_spot](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource |
|
||||
| [aws_iam_policy.aws_node_termination_handler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
|
||||
| [aws_iam_policy.cluster_autoscaler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
|
||||
| [helm_release.aws_node_termination_handler](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
|
||||
| [helm_release.cluster_autoscaler](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
|
||||
| [null_resource.apply](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
|
||||
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
|
||||
| [aws_eks_cluster_auth.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
|
||||
| [aws_eks_cluster_auth.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
|
||||
| [aws_iam_policy_document.aws_node_termination_handler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
|
||||
| [aws_iam_policy_document.aws_node_termination_handler_sqs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
|
||||
| [aws_iam_policy_document.cluster_autoscaler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
|
||||
|
||||
## Inputs
|
||||
|
||||
|
||||
@@ -32,7 +32,7 @@ resource "helm_release" "cluster_autoscaler" {
|
||||
|
||||
set {
|
||||
name = "rbac.serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"
|
||||
value = module.iam_assumable_role_cluster_autoscaler.iam_role_arn
|
||||
value = module.cluster_autoscaler_irsa.iam_role_arn
|
||||
type = "string"
|
||||
}
|
||||
|
||||
@@ -57,63 +57,24 @@ resource "helm_release" "cluster_autoscaler" {
|
||||
]
|
||||
}
|
||||
|
||||
module "iam_assumable_role_cluster_autoscaler" {
|
||||
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
|
||||
version = "~> 4.0"
|
||||
module "cluster_autoscaler_irsa" {
|
||||
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
|
||||
version = "~> 4.12"
|
||||
|
||||
create_role = true
|
||||
role_name_prefix = "cluster-autoscaler"
|
||||
role_description = "IRSA role for cluster autoscaler"
|
||||
|
||||
provider_url = replace(module.eks.cluster_oidc_issuer_url, "https://", "")
|
||||
role_policy_arns = [aws_iam_policy.cluster_autoscaler.arn]
|
||||
oidc_fully_qualified_subjects = ["system:serviceaccount:kube-system:cluster-autoscaler-aws"]
|
||||
oidc_fully_qualified_audiences = ["sts.amazonaws.com"]
|
||||
attach_cluster_autoscaler_policy = true
|
||||
cluster_autoscaler_cluster_ids = [module.eks.cluster_id]
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
resource "aws_iam_policy" "cluster_autoscaler" {
|
||||
name = "KarpenterControllerPolicy-refresh"
|
||||
policy = data.aws_iam_policy_document.cluster_autoscaler.json
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
data "aws_iam_policy_document" "cluster_autoscaler" {
|
||||
statement {
|
||||
sid = "clusterAutoscalerAll"
|
||||
actions = [
|
||||
"autoscaling:DescribeAutoScalingGroups",
|
||||
"autoscaling:DescribeAutoScalingInstances",
|
||||
"autoscaling:DescribeLaunchConfigurations",
|
||||
"autoscaling:DescribeTags",
|
||||
"ec2:DescribeLaunchTemplateVersions",
|
||||
]
|
||||
resources = ["*"]
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "clusterAutoscalerOwn"
|
||||
actions = [
|
||||
"autoscaling:SetDesiredCapacity",
|
||||
"autoscaling:TerminateInstanceInAutoScalingGroup",
|
||||
"autoscaling:UpdateAutoScalingGroup",
|
||||
]
|
||||
resources = ["*"]
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "autoscaling:ResourceTag/k8s.io/cluster-autoscaler/${module.eks.cluster_id}"
|
||||
values = ["owned"]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "autoscaling:ResourceTag/k8s.io/cluster-autoscaler/enabled"
|
||||
values = ["true"]
|
||||
oidc_providers = {
|
||||
main = {
|
||||
provider_arn = module.eks.oidc_provider_arn
|
||||
namespace_service_accounts = ["kube-system:cluster-autoscaler-aws"]
|
||||
}
|
||||
}
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
################################################################################
|
||||
@@ -142,7 +103,7 @@ resource "helm_release" "aws_node_termination_handler" {
|
||||
|
||||
set {
|
||||
name = "serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"
|
||||
value = module.aws_node_termination_handler_role.iam_role_arn
|
||||
value = module.node_termination_handler_irsa.iam_role_arn
|
||||
type = "string"
|
||||
}
|
||||
|
||||
@@ -172,53 +133,26 @@ resource "helm_release" "aws_node_termination_handler" {
|
||||
]
|
||||
}
|
||||
|
||||
module "aws_node_termination_handler_role" {
|
||||
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
|
||||
version = "~> 4.0"
|
||||
module "node_termination_handler_irsa" {
|
||||
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
|
||||
version = "~> 4.12"
|
||||
|
||||
create_role = true
|
||||
role_name_prefix = "node-termination-handler"
|
||||
role_description = "IRSA role for node termination handler"
|
||||
|
||||
provider_url = replace(module.eks.cluster_oidc_issuer_url, "https://", "")
|
||||
role_policy_arns = [aws_iam_policy.aws_node_termination_handler.arn]
|
||||
oidc_fully_qualified_subjects = ["system:serviceaccount:kube-system:aws-node-termination-handler"]
|
||||
oidc_fully_qualified_audiences = ["sts.amazonaws.com"]
|
||||
attach_node_termination_handler_policy = true
|
||||
node_termination_handler_sqs_queue_arns = [module.aws_node_termination_handler_sqs.sqs_queue_arn]
|
||||
|
||||
oidc_providers = {
|
||||
main = {
|
||||
provider_arn = module.eks.oidc_provider_arn
|
||||
namespace_service_accounts = ["kube-system:aws-node-termination-handler"]
|
||||
}
|
||||
}
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
resource "aws_iam_policy" "aws_node_termination_handler" {
|
||||
name = "${local.name}-aws-node-termination-handler"
|
||||
policy = data.aws_iam_policy_document.aws_node_termination_handler.json
|
||||
|
||||
tags = local.tags
|
||||
}
|
||||
|
||||
data "aws_iam_policy_document" "aws_node_termination_handler" {
|
||||
statement {
|
||||
actions = [
|
||||
"ec2:DescribeInstances",
|
||||
"autoscaling:DescribeAutoScalingInstances",
|
||||
"autoscaling:DescribeTags",
|
||||
]
|
||||
resources = ["*"]
|
||||
}
|
||||
|
||||
statement {
|
||||
actions = ["autoscaling:CompleteLifecycleAction"]
|
||||
resources = [for group in module.eks.self_managed_node_groups : group.autoscaling_group_arn]
|
||||
}
|
||||
|
||||
statement {
|
||||
actions = [
|
||||
"sqs:DeleteMessage",
|
||||
"sqs:ReceiveMessage"
|
||||
]
|
||||
resources = [module.aws_node_termination_handler_sqs.sqs_queue_arn]
|
||||
}
|
||||
}
|
||||
|
||||
module "aws_node_termination_handler_sqs" {
|
||||
source = "terraform-aws-modules/sqs/aws"
|
||||
version = "~> 3.0"
|
||||
|
||||
Reference in New Issue
Block a user