github-mirrors/terraform-aws-eks
1
0
Fork 0
mirror of https://github.com/ysoftdevs/terraform-aws-eks.git synced 2026-03-27 11:51:07 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix: Ensure the correct service CIDR and IP family is used in the rendered user data (#2963)

Browse Source 
* fix: Ensuring the correct service CIDR and IP family is used in the rendered user data

* chore: Updates from testing and validating

* chore: Fix example destroy instructions

* fix: Only require `cluster_service_cidr` when `create = true`

* chore: Clean up commented out code and add note on check length
This commit is contained in:
Bryant Biggs
2024-03-12 10:36:19 -04:00
committed by GitHub
parent 907f70cffd
commit aeb9f0c990
55 changed files with 384 additions and 148 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
modules/fargate-profile/README.md
View File

@@ -28,7 +28,7 @@ module "fargate_profile" {
| Name | Version |
|------|---------|
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3 |
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.2 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.40 |
## Providers

27
modules/fargate-profile/main.tf
View File

@@ -2,9 +2,17 @@ data "aws_partition" "current" {}
data "aws_caller_identity" "current" {}
locals {
create_iam_role = var.create && var.create_iam_role
iam_role_name = coalesce(var.iam_role_name, var.name, "fargate-profile")
iam_role_policy_prefix = "arn:${data.aws_partition.current.partition}:iam::aws:policy"
cni_policy = var.cluster_ip_family == "ipv6" ? "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:policy/AmazonEKS_CNI_IPv6_Policy" : "${local.iam_role_policy_prefix}/AmazonEKS_CNI_Policy"
ipv4_cni_policy = { for k, v in {
AmazonEKS_CNI_Policy = "${local.iam_role_policy_prefix}/AmazonEKS_CNI_Policy"
} : k => v if var.iam_role_attach_cni_policy && var.cluster_ip_family == "ipv4" }
ipv6_cni_policy = { for k, v in {
AmazonEKS_CNI_IPv6_Policy = "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:policy/AmazonEKS_CNI_IPv6_Policy"
} : k => v if var.iam_role_attach_cni_policy && var.cluster_ip_family == "ipv6" }
}
################################################################################
@@ -12,7 +20,7 @@ locals {
################################################################################
data "aws_iam_policy_document" "assume_role_policy" {
count = var.create && var.create_iam_role ? 1 : 0
count = local.create_iam_role ? 1 : 0
statement {
effect = "Allow"
@@ -26,7 +34,7 @@ data "aws_iam_policy_document" "assume_role_policy" {
}
resource "aws_iam_role" "this" {
count = var.create && var.create_iam_role ? 1 : 0
count = local.create_iam_role ? 1 : 0
name = var.iam_role_use_name_prefix ? null : local.iam_role_name
name_prefix = var.iam_role_use_name_prefix ? "${local.iam_role_name}-" : null
@@ -41,17 +49,20 @@ resource "aws_iam_role" "this" {
}
resource "aws_iam_role_policy_attachment" "this" {
for_each = { for k, v in toset(compact([
"${local.iam_role_policy_prefix}/AmazonEKSFargatePodExecutionRolePolicy",
var.iam_role_attach_cni_policy ? local.cni_policy : "",
])) : k => v if var.create && var.create_iam_role }
for_each = { for k, v in merge(
{
AmazonEKSFargatePodExecutionRolePolicy = "${local.iam_role_policy_prefix}/AmazonEKSFargatePodExecutionRolePolicy"
},
local.ipv4_cni_policy,
local.ipv6_cni_policy
) : k => v if local.create_iam_role }
policy_arn = each.value
role = aws_iam_role.this[0].name
}
resource "aws_iam_role_policy_attachment" "additional" {
for_each = { for k, v in var.iam_role_additional_policies : k => v if var.create && var.create_iam_role }
for_each = { for k, v in var.iam_role_additional_policies : k => v if local.create_iam_role }
policy_arn = each.value
role = aws_iam_role.this[0].name

15
modules/fargate-profile/migrations.tf Normal file
View File

@@ -0,0 +1,15 @@
################################################################################
# Migrations: v20.8 -> v20.9
################################################################################
# Node IAM role policy attachment
# Commercial partition only - `moved` does now allow multiple moves to same target
moved {
from = aws_iam_role_policy_attachment.this["arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy"]
to = aws_iam_role_policy_attachment.this["AmazonEKSFargatePodExecutionRolePolicy"]
}
moved {
from = aws_iam_role_policy_attachment.this["arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"]
to = aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"]
}

2
modules/fargate-profile/versions.tf
View File

@@ -1,5 +1,5 @@
terraform {
required_version = ">= 1.3"
required_version = ">= 1.3.2"
required_providers {
aws = {