diff --git a/README.md b/README.md index 4e5994d..6adf48b 100644 --- a/README.md +++ b/README.md @@ -24,7 +24,6 @@ A full example leveraging other community modules is contained in the [examples/ ```hcl module "eks" { source = "terraform-aws-modules/eks/aws" - version = "0.1.0" cluster_name = "test-eks-cluster" subnets = ["subnet-abcde012", "subnet-bcde012a"] tags = "${map("Environment", "test")}" @@ -100,6 +99,11 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | cluster_version | Kubernetes version to use for the EKS cluster. | string | `1.10` | no | | config_output_path | Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. | string | `./` | no | | configure_kubectl_session | Configure the current session's kubectl to use the instantiated EKS cluster. | string | `true` | no | +| kubeconfig_context_name | Name of the kubeconfig context. | map | `aws` | no | +| kubeconfig_user_name | Name of the kubeconfig user. | map | `aws` | no | +| kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | map | `heptio-authenticator-aws` | no | +| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume `["-r", "MyEksRole"]` | map | `` | no | +| kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. `{ AWS_PROFILE = "eks"}` | map | `` | no | | subnets | A list of subnets to place the EKS cluster and workers within. | list | - | yes | | tags | A map of tags to add to all resources. | string | `` | no | | vpc_id | VPC where the cluster and workers will be deployed. | string | - | yes | @@ -107,11 +111,7 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | worker_security_group_id | If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the EKS cluster. | string | `` | no | | worker_sg_ingress_from_port | Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443). | string | `1025` | no | | workers_group_defaults | Default values for target groups as defined by the list of maps. | map | `` | no | -| kubeconfig_context_name | Name of the kubeconfig context. | map | `aws` | no | -| kubeconfig_user_name | Name of the kubeconfig user. | map | `aws` | no | -| kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | map | `heptio-authenticator-aws` | no | -| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume `["-r", "MyEksRole"]` | map | `` | no | -| kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. `{ AWS_PROFILE = "eks"}` | map | `` | no | +| workstation_cidr | Override the default ingress rule that allows communication with the EKS cluster API. If not given, will use current IP/32. | string | - | no | ## Outputs diff --git a/cluster.tf b/cluster.tf index 03fe7aa..87ad721 100644 --- a/cluster.tf +++ b/cluster.tf @@ -45,7 +45,7 @@ resource "aws_security_group_rule" "cluster_https_worker_ingress" { } resource "aws_security_group_rule" "cluster_https_cidr_ingress" { - cidr_blocks = ["${local.workstation_external_cidr}"] + cidr_blocks = ["${local.workstation_cidr}"] description = "Allow kubectl communication with the EKS cluster API." protocol = "tcp" security_group_id = "${aws_security_group.cluster.id}" diff --git a/local.tf b/local.tf index 6c3249d..5f6dcdc 100644 --- a/local.tf +++ b/local.tf @@ -3,6 +3,7 @@ locals { cluster_security_group_id = "${var.cluster_security_group_id == "" ? aws_security_group.cluster.id : var.cluster_security_group_id}" worker_security_group_id = "${var.worker_security_group_id == "" ? aws_security_group.workers.id : var.worker_security_group_id}" workstation_external_cidr = "${chomp(data.http.workstation_external_ip.body)}/32" + workstation_cidr = "${coalesce(var.workstation_cidr, local.workstation_external_cidr)}" # Mapping from the node type that we selected and the max number of pods that it can run # Taken from https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-06-05/amazon-eks-nodegroup.yaml diff --git a/variables.tf b/variables.tf index b8a3320..4bfb415 100644 --- a/variables.tf +++ b/variables.tf @@ -7,6 +7,11 @@ variable "cluster_security_group_id" { default = "" } +variable "workstation_cidr" { + description = "Override the default ingress rule that allows communication with the EKS cluster API. If not given, will use current IP/32. " + default = "" +} + variable "cluster_version" { description = "Kubernetes version to use for the EKS cluster." default = "1.10"