mirror of
https://github.com/ysoftdevs/terraform-aws-eks.git
synced 2026-03-20 16:43:46 +01:00
feat!: Removed support for launch configuration and replace count with for_each (#1680)
This commit is contained in:
Bryant Biggs
319
main.tf
319
main.tf
@@ -1,24 +1,20 @@
|
||||
resource "aws_cloudwatch_log_group" "this" {
|
||||
count = length(var.cluster_enabled_log_types) > 0 && var.create_eks ? 1 : 0
|
||||
data "aws_partition" "current" {}
|
||||
|
||||
name = "/aws/eks/${var.cluster_name}/cluster"
|
||||
retention_in_days = var.cluster_log_retention_in_days
|
||||
kms_key_id = var.cluster_log_kms_key_id
|
||||
|
||||
tags = var.tags
|
||||
}
|
||||
################################################################################
|
||||
# Cluster
|
||||
################################################################################
|
||||
|
||||
resource "aws_eks_cluster" "this" {
|
||||
count = var.create_eks ? 1 : 0
|
||||
count = var.create ? 1 : 0
|
||||
|
||||
name = var.cluster_name
|
||||
enabled_cluster_log_types = var.cluster_enabled_log_types
|
||||
role_arn = local.cluster_iam_role_arn
|
||||
role_arn = try(aws_iam_role.this[0].arn, var.iam_role_arn)
|
||||
version = var.cluster_version
|
||||
enabled_cluster_log_types = var.cluster_enabled_log_types
|
||||
|
||||
vpc_config {
|
||||
security_group_ids = compact([local.cluster_security_group_id])
|
||||
subnet_ids = var.subnets
|
||||
security_group_ids = distinct(concat(var.cluster_additional_security_group_ids, [local.cluster_security_group_id]))
|
||||
subnet_ids = var.subnet_ids
|
||||
endpoint_private_access = var.cluster_endpoint_private_access
|
||||
endpoint_public_access = var.cluster_endpoint_public_access
|
||||
public_access_cidrs = var.cluster_endpoint_public_access_cidrs
|
||||
@@ -45,188 +41,221 @@ resource "aws_eks_cluster" "this" {
|
||||
)
|
||||
|
||||
timeouts {
|
||||
create = var.cluster_create_timeout
|
||||
delete = var.cluster_delete_timeout
|
||||
update = var.cluster_update_timeout
|
||||
create = lookup(var.cluster_timeouts, "create", null)
|
||||
delete = lookup(var.cluster_timeouts, "update", null)
|
||||
update = lookup(var.cluster_timeouts, "delete", null)
|
||||
}
|
||||
|
||||
depends_on = [
|
||||
aws_security_group_rule.cluster_egress_internet,
|
||||
aws_security_group_rule.cluster_https_worker_ingress,
|
||||
aws_iam_role_policy_attachment.cluster_AmazonEKSClusterPolicy,
|
||||
aws_iam_role_policy_attachment.cluster_AmazonEKSServicePolicy,
|
||||
aws_iam_role_policy_attachment.cluster_AmazonEKSVPCResourceControllerPolicy,
|
||||
aws_iam_role_policy_attachment.this,
|
||||
aws_security_group_rule.cluster,
|
||||
aws_security_group_rule.node,
|
||||
aws_cloudwatch_log_group.this
|
||||
]
|
||||
}
|
||||
|
||||
resource "aws_security_group" "cluster" {
|
||||
count = var.cluster_create_security_group && var.create_eks ? 1 : 0
|
||||
resource "aws_cloudwatch_log_group" "this" {
|
||||
count = var.create && var.create_cloudwatch_log_group ? 1 : 0
|
||||
|
||||
name_prefix = var.cluster_name
|
||||
description = "EKS cluster security group."
|
||||
name = "/aws/eks/${var.cluster_name}/cluster"
|
||||
retention_in_days = var.cloudwatch_log_group_retention_in_days
|
||||
kms_key_id = var.cloudwatch_log_group_kms_key_id
|
||||
|
||||
tags = var.tags
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Cluster Security Group
|
||||
# Defaults follow https://docs.aws.amazon.com/eks/latest/userguide/sec-group-reqs.html
|
||||
################################################################################
|
||||
|
||||
locals {
|
||||
cluster_sg_name = coalesce(var.cluster_security_group_name, "${var.cluster_name}-cluster")
|
||||
create_cluster_sg = var.create && var.create_cluster_security_group
|
||||
|
||||
cluster_security_group_id = local.create_cluster_sg ? aws_security_group.cluster[0].id : var.cluster_security_group_id
|
||||
|
||||
cluster_security_group_rules = {
|
||||
ingress_nodes_443 = {
|
||||
description = "Node groups to cluster API"
|
||||
protocol = "tcp"
|
||||
from_port = 443
|
||||
to_port = 443
|
||||
type = "ingress"
|
||||
source_node_security_group = true
|
||||
}
|
||||
egress_nodes_443 = {
|
||||
description = "Cluster API to node groups"
|
||||
protocol = "tcp"
|
||||
from_port = 443
|
||||
to_port = 443
|
||||
type = "egress"
|
||||
source_node_security_group = true
|
||||
}
|
||||
egress_nodes_kubelet = {
|
||||
description = "Cluster API to node kubelets"
|
||||
protocol = "tcp"
|
||||
from_port = 10250
|
||||
to_port = 10250
|
||||
type = "egress"
|
||||
source_node_security_group = true
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_security_group" "cluster" {
|
||||
count = local.create_cluster_sg ? 1 : 0
|
||||
|
||||
name = var.cluster_security_group_use_name_prefix ? null : local.cluster_sg_name
|
||||
name_prefix = var.cluster_security_group_use_name_prefix ? "${local.cluster_sg_name}-" : null
|
||||
description = var.cluster_security_group_description
|
||||
vpc_id = var.vpc_id
|
||||
|
||||
tags = merge(
|
||||
var.tags,
|
||||
{
|
||||
"Name" = "${var.cluster_name}-eks_cluster_sg"
|
||||
},
|
||||
{ "Name" = local.cluster_sg_name },
|
||||
var.cluster_security_group_tags
|
||||
)
|
||||
}
|
||||
|
||||
resource "aws_security_group_rule" "cluster_egress_internet" {
|
||||
count = var.cluster_create_security_group && var.create_eks ? 1 : 0
|
||||
resource "aws_security_group_rule" "cluster" {
|
||||
for_each = local.create_cluster_sg ? merge(local.cluster_security_group_rules, var.cluster_security_group_additional_rules) : {}
|
||||
|
||||
description = "Allow cluster egress access to the Internet."
|
||||
protocol = "-1"
|
||||
security_group_id = local.cluster_security_group_id
|
||||
cidr_blocks = var.cluster_egress_cidrs
|
||||
from_port = 0
|
||||
to_port = 0
|
||||
type = "egress"
|
||||
# Required
|
||||
security_group_id = aws_security_group.cluster[0].id
|
||||
protocol = each.value.protocol
|
||||
from_port = each.value.from_port
|
||||
to_port = each.value.to_port
|
||||
type = each.value.type
|
||||
|
||||
# Optional
|
||||
description = try(each.value.description, null)
|
||||
cidr_blocks = try(each.value.cidr_blocks, null)
|
||||
ipv6_cidr_blocks = try(each.value.ipv6_cidr_blocks, null)
|
||||
prefix_list_ids = try(each.value.prefix_list_ids, [])
|
||||
self = try(each.value.self, null)
|
||||
source_security_group_id = try(
|
||||
each.value.source_security_group_id,
|
||||
try(each.value.source_node_security_group, false) ? local.node_security_group_id : null
|
||||
)
|
||||
}
|
||||
|
||||
resource "aws_security_group_rule" "cluster_https_worker_ingress" {
|
||||
count = var.cluster_create_security_group && var.create_eks && var.worker_create_security_group ? 1 : 0
|
||||
################################################################################
|
||||
# IRSA
|
||||
# Note - this is different from EKS identity provider
|
||||
################################################################################
|
||||
|
||||
description = "Allow pods to communicate with the EKS cluster API."
|
||||
protocol = "tcp"
|
||||
security_group_id = local.cluster_security_group_id
|
||||
source_security_group_id = local.worker_security_group_id
|
||||
from_port = 443
|
||||
to_port = 443
|
||||
type = "ingress"
|
||||
data "tls_certificate" "this" {
|
||||
count = var.create && var.enable_irsa ? 1 : 0
|
||||
|
||||
url = aws_eks_cluster.this[0].identity[0].oidc[0].issuer
|
||||
}
|
||||
|
||||
resource "aws_security_group_rule" "cluster_private_access_cidrs_source" {
|
||||
for_each = var.create_eks && var.cluster_create_endpoint_private_access_sg_rule && var.cluster_endpoint_private_access && var.cluster_endpoint_private_access_cidrs != null ? toset(var.cluster_endpoint_private_access_cidrs) : []
|
||||
resource "aws_iam_openid_connect_provider" "oidc_provider" {
|
||||
count = var.create && var.enable_irsa ? 1 : 0
|
||||
|
||||
description = "Allow private K8S API ingress from custom CIDR source."
|
||||
type = "ingress"
|
||||
from_port = 443
|
||||
to_port = 443
|
||||
protocol = "tcp"
|
||||
cidr_blocks = [each.value]
|
||||
client_id_list = distinct(compact(concat(["sts.${data.aws_partition.current.dns_suffix}"], var.openid_connect_audiences)))
|
||||
thumbprint_list = [data.tls_certificate.this[0].certificates[0].sha1_fingerprint]
|
||||
url = aws_eks_cluster.this[0].identity[0].oidc[0].issuer
|
||||
|
||||
security_group_id = aws_eks_cluster.this[0].vpc_config[0].cluster_security_group_id
|
||||
tags = merge(
|
||||
{ Name = "${var.cluster_name}-eks-irsa" },
|
||||
var.tags
|
||||
)
|
||||
}
|
||||
|
||||
resource "aws_security_group_rule" "cluster_private_access_sg_source" {
|
||||
count = var.create_eks && var.cluster_create_endpoint_private_access_sg_rule && var.cluster_endpoint_private_access && var.cluster_endpoint_private_access_sg != null ? length(var.cluster_endpoint_private_access_sg) : 0
|
||||
################################################################################
|
||||
# IAM Role
|
||||
################################################################################
|
||||
|
||||
description = "Allow private K8S API ingress from custom Security Groups source."
|
||||
type = "ingress"
|
||||
from_port = 443
|
||||
to_port = 443
|
||||
protocol = "tcp"
|
||||
source_security_group_id = var.cluster_endpoint_private_access_sg[count.index]
|
||||
|
||||
security_group_id = aws_eks_cluster.this[0].vpc_config[0].cluster_security_group_id
|
||||
locals {
|
||||
iam_role_name = coalesce(var.iam_role_name, "${var.cluster_name}-cluster")
|
||||
policy_arn_prefix = "arn:${data.aws_partition.current.partition}:iam::aws:policy"
|
||||
}
|
||||
|
||||
resource "aws_iam_role" "cluster" {
|
||||
count = var.manage_cluster_iam_resources && var.create_eks ? 1 : 0
|
||||
data "aws_iam_policy_document" "assume_role_policy" {
|
||||
count = var.create && var.create_iam_role ? 1 : 0
|
||||
|
||||
name_prefix = var.cluster_iam_role_name != "" ? null : var.cluster_name
|
||||
name = var.cluster_iam_role_name != "" ? var.cluster_iam_role_name : null
|
||||
assume_role_policy = data.aws_iam_policy_document.cluster_assume_role_policy.json
|
||||
permissions_boundary = var.permissions_boundary
|
||||
path = var.iam_path
|
||||
statement {
|
||||
sid = "EKSClusterAssumeRole"
|
||||
actions = ["sts:AssumeRole"]
|
||||
|
||||
principals {
|
||||
type = "Service"
|
||||
identifiers = ["eks.amazonaws.com"]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_iam_role" "this" {
|
||||
count = var.create && var.create_iam_role ? 1 : 0
|
||||
|
||||
name = var.iam_role_use_name_prefix ? null : local.iam_role_name
|
||||
name_prefix = var.iam_role_use_name_prefix ? "${local.iam_role_name}-" : null
|
||||
path = var.iam_role_path
|
||||
description = var.iam_role_description
|
||||
|
||||
assume_role_policy = data.aws_iam_policy_document.assume_role_policy[0].json
|
||||
permissions_boundary = var.iam_role_permissions_boundary
|
||||
force_detach_policies = true
|
||||
|
||||
tags = var.tags
|
||||
tags = merge(var.tags, var.iam_role_tags)
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy_attachment" "cluster_AmazonEKSClusterPolicy" {
|
||||
count = var.manage_cluster_iam_resources && var.create_eks ? 1 : 0
|
||||
# Policies attached ref https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_node_group
|
||||
resource "aws_iam_role_policy_attachment" "this" {
|
||||
for_each = var.create && var.create_iam_role ? toset(compact(distinct(concat([
|
||||
"${local.policy_arn_prefix}/AmazonEKSClusterPolicy",
|
||||
"${local.policy_arn_prefix}/AmazonEKSVPCResourceController",
|
||||
], var.iam_role_additional_policies)))) : toset([])
|
||||
|
||||
policy_arn = "${local.policy_arn_prefix}/AmazonEKSClusterPolicy"
|
||||
role = local.cluster_iam_role_name
|
||||
policy_arn = each.value
|
||||
role = aws_iam_role.this[0].name
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy_attachment" "cluster_AmazonEKSServicePolicy" {
|
||||
count = var.manage_cluster_iam_resources && var.create_eks ? 1 : 0
|
||||
################################################################################
|
||||
# EKS Addons
|
||||
################################################################################
|
||||
|
||||
policy_arn = "${local.policy_arn_prefix}/AmazonEKSServicePolicy"
|
||||
role = local.cluster_iam_role_name
|
||||
}
|
||||
resource "aws_eks_addon" "this" {
|
||||
for_each = { for k, v in var.cluster_addons : k => v if var.create }
|
||||
|
||||
resource "aws_iam_role_policy_attachment" "cluster_AmazonEKSVPCResourceControllerPolicy" {
|
||||
count = var.manage_cluster_iam_resources && var.create_eks ? 1 : 0
|
||||
cluster_name = aws_eks_cluster.this[0].name
|
||||
addon_name = try(each.value.name, each.key)
|
||||
|
||||
policy_arn = "${local.policy_arn_prefix}/AmazonEKSVPCResourceController"
|
||||
role = local.cluster_iam_role_name
|
||||
}
|
||||
addon_version = lookup(each.value, "addon_version", null)
|
||||
resolve_conflicts = lookup(each.value, "resolve_conflicts", null)
|
||||
service_account_role_arn = lookup(each.value, "service_account_role_arn", null)
|
||||
|
||||
/*
|
||||
Adding a policy to cluster IAM role that allow permissions
|
||||
required to create AWSServiceRoleForElasticLoadBalancing service-linked role by EKS during ELB provisioning
|
||||
*/
|
||||
|
||||
data "aws_iam_policy_document" "cluster_elb_sl_role_creation" {
|
||||
count = var.manage_cluster_iam_resources && var.create_eks ? 1 : 0
|
||||
|
||||
statement {
|
||||
effect = "Allow"
|
||||
actions = [
|
||||
"ec2:DescribeAccountAttributes",
|
||||
"ec2:DescribeInternetGateways",
|
||||
"ec2:DescribeAddresses"
|
||||
lifecycle {
|
||||
ignore_changes = [
|
||||
modified_at
|
||||
]
|
||||
resources = ["*"]
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_iam_policy" "cluster_elb_sl_role_creation" {
|
||||
count = var.manage_cluster_iam_resources && var.create_eks ? 1 : 0
|
||||
|
||||
name_prefix = "${var.cluster_name}-elb-sl-role-creation"
|
||||
description = "Permissions for EKS to create AWSServiceRoleForElasticLoadBalancing service-linked role"
|
||||
policy = data.aws_iam_policy_document.cluster_elb_sl_role_creation[0].json
|
||||
path = var.iam_path
|
||||
|
||||
tags = var.tags
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy_attachment" "cluster_elb_sl_role_creation" {
|
||||
count = var.manage_cluster_iam_resources && var.create_eks ? 1 : 0
|
||||
################################################################################
|
||||
# EKS Identity Provider
|
||||
# Note - this is different from IRSA
|
||||
################################################################################
|
||||
|
||||
policy_arn = aws_iam_policy.cluster_elb_sl_role_creation[0].arn
|
||||
role = local.cluster_iam_role_name
|
||||
}
|
||||
resource "aws_eks_identity_provider_config" "this" {
|
||||
for_each = { for k, v in var.cluster_identity_providers : k => v if var.create }
|
||||
|
||||
/*
|
||||
Adding a policy to cluster IAM role that deny permissions to logs:CreateLogGroup
|
||||
it is not needed since we create the log group ourselve in this module, and it is causing trouble during cleanup/deletion
|
||||
*/
|
||||
cluster_name = aws_eks_cluster.this[0].name
|
||||
|
||||
data "aws_iam_policy_document" "cluster_deny_log_group" {
|
||||
count = var.manage_cluster_iam_resources && var.create_eks ? 1 : 0
|
||||
|
||||
statement {
|
||||
effect = "Deny"
|
||||
actions = [
|
||||
"logs:CreateLogGroup"
|
||||
]
|
||||
resources = ["*"]
|
||||
oidc {
|
||||
client_id = each.value.client_id
|
||||
groups_claim = lookup(each.value, "groups_claim", null)
|
||||
groups_prefix = lookup(each.value, "groups_prefix", null)
|
||||
identity_provider_config_name = try(each.value.identity_provider_config_name, each.key)
|
||||
issuer_url = each.value.issuer_url
|
||||
required_claims = lookup(each.value, "required_claims", null)
|
||||
username_claim = lookup(each.value, "username_claim", null)
|
||||
username_prefix = lookup(each.value, "username_prefix", null)
|
||||
}
|
||||
}
|
||||
|
||||
resource "aws_iam_policy" "cluster_deny_log_group" {
|
||||
count = var.manage_cluster_iam_resources && var.create_eks ? 1 : 0
|
||||
|
||||
name_prefix = "${var.cluster_name}-deny-log-group"
|
||||
description = "Deny CreateLogGroup"
|
||||
policy = data.aws_iam_policy_document.cluster_deny_log_group[0].json
|
||||
path = var.iam_path
|
||||
|
||||
tags = var.tags
|
||||
}
|
||||
|
||||
resource "aws_iam_role_policy_attachment" "cluster_deny_log_group" {
|
||||
count = var.manage_cluster_iam_resources && var.create_eks ? 1 : 0
|
||||
|
||||
policy_arn = aws_iam_policy.cluster_deny_log_group[0].arn
|
||||
role = local.cluster_iam_role_name
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user