From f881745f0062ad6b425500321b7c31465c6afbad Mon Sep 17 00:00:00 2001 From: Max Williams Date: Mon, 9 Jul 2018 10:40:25 +0200 Subject: [PATCH 01/19] formatting and minor cosmetic fixes --- README.md | 10 +++++----- cluster.tf | 2 +- data.tf | 16 ++++++++-------- outputs.tf | 10 +++++----- workers.tf | 16 ++++++++-------- 5 files changed, 27 insertions(+), 27 deletions(-) diff --git a/README.md b/README.md index 38fac85..4ca0414 100644 --- a/README.md +++ b/README.md @@ -98,18 +98,18 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | cluster_security_group_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the workers and provide API access to your current IP/32. | string | `` | no | | cluster_version | Kubernetes version to use for the EKS cluster. | string | `1.10` | no | | config_output_path | Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. | string | `./` | no | -| configure_kubectl_session | Configure the current session's kubectl to use the instantiated EKS cluster. | string | `true` | no | -| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | string | `` | no | +| configure_kubectl_session | Configure the current session's kubectl to use the instantiated EKS cluster. | boolean | `true` | no | +| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | list | `` | no | | kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | string | `heptio-authenticator-aws` | no | | kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | string | `` | no | | kubeconfig_name | Override the default name used for items kubeconfig. | string | `` | no | | subnets | A list of subnets to place the EKS cluster and workers within. | list | - | yes | -| tags | A map of tags to add to all resources. | string | `` | no | +| tags | A map of tags to add to all resources. | map | `` | no | | vpc_id | VPC where the cluster and workers will be deployed. | string | - | yes | -| worker_groups | A list of maps defining worker group configurations. See workers_group_defaults for valid keys. | list | `` | no | +| worker_groups | A list of maps defining worker group configurations. See workers_group_defaults for valid keys. | list | `` | no | | worker_security_group_id | If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the EKS cluster. | string | `` | no | | worker_sg_ingress_from_port | Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443). | string | `1025` | no | -| workers_group_defaults | Default values for target groups as defined by the list of maps. | map | `` | no | +| workers_group_defaults | Default values for target groups as defined by the list of maps. | map | `` | no | | workstation_cidr | Override the default ingress rule that allows communication with the EKS cluster API. If not given, will use current IP/32. | string | `` | no | ## Outputs diff --git a/cluster.tf b/cluster.tf index 87ad721..3abe774 100644 --- a/cluster.tf +++ b/cluster.tf @@ -1,4 +1,4 @@ -resource "aws_eks_cluster" "this" { +resource "aws_eks_cluster" "cluster" { name = "${var.cluster_name}" role_arn = "${aws_iam_role.cluster.arn}" version = "${var.cluster_version}" diff --git a/data.tf b/data.tf index 9d54f87..1a47420 100644 --- a/data.tf +++ b/data.tf @@ -48,11 +48,11 @@ data "template_file" "kubeconfig" { template = "${file("${path.module}/templates/kubeconfig.tpl")}" vars { - cluster_name = "${var.cluster_name}" + cluster_name = "${aws_eks_cluster.cluster.name}" + endpoint = "${aws_eks_cluster.cluster.endpoint}" kubeconfig_name = "${local.kubeconfig_name}" - endpoint = "${aws_eks_cluster.this.endpoint}" region = "${data.aws_region.current.name}" - cluster_auth_base64 = "${aws_eks_cluster.this.certificate_authority.0.data}" + cluster_auth_base64 = "${aws_eks_cluster.cluster.certificate_authority.0.data}" aws_authenticator_command = "${var.kubeconfig_aws_authenticator_command}" aws_authenticator_additional_args = "${length(var.kubeconfig_aws_authenticator_additional_args) > 0 ? " - ${join("\n - ", var.kubeconfig_aws_authenticator_additional_args)}" : "" }" aws_authenticator_env_variables = "${length(var.kubeconfig_aws_authenticator_env_variables) > 0 ? " env:\n${join("\n", data.template_file.aws_authenticator_env_variables.*.rendered)}" : ""}" @@ -73,7 +73,7 @@ EOF } } -data template_file config_map_aws_auth { +data "template_file" "config_map_aws_auth" { template = "${file("${path.module}/templates/config-map-aws-auth.yaml.tpl")}" vars { @@ -81,15 +81,15 @@ data template_file config_map_aws_auth { } } -data template_file userdata { +data "template_file" "userdata" { template = "${file("${path.module}/templates/userdata.sh.tpl")}" count = "${length(var.worker_groups)}" vars { region = "${data.aws_region.current.name}" - cluster_name = "${var.cluster_name}" - endpoint = "${aws_eks_cluster.this.endpoint}" - cluster_auth_base64 = "${aws_eks_cluster.this.certificate_authority.0.data}" + cluster_name = "${aws_eks_cluster.cluster.name}" + endpoint = "${aws_eks_cluster.cluster.endpoint}" + cluster_auth_base64 = "${aws_eks_cluster.cluster.certificate_authority.0.data}" max_pod_count = "${lookup(local.max_pod_per_node, lookup(var.worker_groups[count.index], "instance_type", lookup(var.workers_group_defaults, "instance_type")))}" pre_userdata = "${lookup(var.worker_groups[count.index], "pre_userdata",lookup(var.workers_group_defaults, "pre_userdata"))}" additional_userdata = "${lookup(var.worker_groups[count.index], "additional_userdata",lookup(var.workers_group_defaults, "additional_userdata"))}" diff --git a/outputs.tf b/outputs.tf index 9f5a16f..f893792 100644 --- a/outputs.tf +++ b/outputs.tf @@ -1,27 +1,27 @@ output "cluster_id" { description = "The name/id of the EKS cluster." - value = "${aws_eks_cluster.this.id}" + value = "${aws_eks_cluster.cluster.id}" } # Though documented, not yet supported # output "cluster_arn" { # description = "The Amazon Resource Name (ARN) of the cluster." -# value = "${aws_eks_cluster.this.arn}" +# value = "${aws_eks_cluster.cluster.arn}" # } output "cluster_certificate_authority_data" { description = "Nested attribute containing certificate-authority-data for your cluster. This is the base64 encoded certificate data required to communicate with your cluster." - value = "${aws_eks_cluster.this.certificate_authority.0.data}" + value = "${aws_eks_cluster.cluster.certificate_authority.0.data}" } output "cluster_endpoint" { description = "The endpoint for your EKS Kubernetes API." - value = "${aws_eks_cluster.this.endpoint}" + value = "${aws_eks_cluster.cluster.endpoint}" } output "cluster_version" { description = "The Kubernetes server version for the EKS cluster." - value = "${aws_eks_cluster.this.version}" + value = "${aws_eks_cluster.cluster.version}" } output "cluster_security_group_id" { diff --git a/workers.tf b/workers.tf index e83412f..18b3dda 100644 --- a/workers.tf +++ b/workers.tf @@ -1,5 +1,5 @@ resource "aws_autoscaling_group" "workers" { - name_prefix = "${var.cluster_name}-${lookup(var.worker_groups[count.index], "name", count.index)}" + name_prefix = "${aws_eks_cluster.cluster.name}-${lookup(var.worker_groups[count.index], "name", count.index)}" desired_capacity = "${lookup(var.worker_groups[count.index], "asg_desired_capacity", lookup(var.workers_group_defaults, "asg_desired_capacity"))}" max_size = "${lookup(var.worker_groups[count.index], "asg_max_size",lookup(var.workers_group_defaults, "asg_max_size"))}" min_size = "${lookup(var.worker_groups[count.index], "asg_min_size",lookup(var.workers_group_defaults, "asg_min_size"))}" @@ -9,8 +9,8 @@ resource "aws_autoscaling_group" "workers" { tags = ["${concat( list( - map("key", "Name", "value", "${var.cluster_name}-${lookup(var.worker_groups[count.index], "name", count.index)}-eks_asg", "propagate_at_launch", true), - map("key", "kubernetes.io/cluster/${var.cluster_name}", "value", "owned", "propagate_at_launch", true), + map("key", "Name", "value", "${aws_eks_cluster.cluster.name}-${lookup(var.worker_groups[count.index], "name", count.index)}-eks_asg", "propagate_at_launch", true), + map("key", "kubernetes.io/cluster/${aws_eks_cluster.cluster.name}", "value", "owned", "propagate_at_launch", true), ), local.asg_tags) }"] @@ -21,7 +21,7 @@ resource "aws_autoscaling_group" "workers" { } resource "aws_launch_configuration" "workers" { - name_prefix = "${var.cluster_name}-${lookup(var.worker_groups[count.index], "name", count.index)}" + name_prefix = "${aws_eks_cluster.cluster.name}-${lookup(var.worker_groups[count.index], "name", count.index)}" associate_public_ip_address = "${lookup(var.worker_groups[count.index], "public_ip", lookup(var.workers_group_defaults, "public_ip"))}" security_groups = ["${local.worker_security_group_id}"] iam_instance_profile = "${aws_iam_instance_profile.workers.id}" @@ -42,11 +42,11 @@ resource "aws_launch_configuration" "workers" { } resource "aws_security_group" "workers" { - name_prefix = "${var.cluster_name}" + name_prefix = "${aws_eks_cluster.cluster.name}" description = "Security group for all nodes in the cluster." vpc_id = "${var.vpc_id}" count = "${var.worker_security_group_id == "" ? 1 : 0}" - tags = "${merge(var.tags, map("Name", "${var.cluster_name}-eks_worker_sg", "kubernetes.io/cluster/${var.cluster_name}", "owned" + tags = "${merge(var.tags, map("Name", "${aws_eks_cluster.cluster.name}-eks_worker_sg", "kubernetes.io/cluster/${aws_eks_cluster.cluster.name}", "owned" ))}" } @@ -84,12 +84,12 @@ resource "aws_security_group_rule" "workers_ingress_cluster" { } resource "aws_iam_role" "workers" { - name_prefix = "${var.cluster_name}" + name_prefix = "${aws_eks_cluster.cluster.name}" assume_role_policy = "${data.aws_iam_policy_document.workers_assume_role_policy.json}" } resource "aws_iam_instance_profile" "workers" { - name_prefix = "${var.cluster_name}" + name_prefix = "${aws_eks_cluster.cluster.name}" role = "${aws_iam_role.workers.name}" } From 1a1d92da6636cdca1c2fea233cc40a8fc902ce4e Mon Sep 17 00:00:00 2001 From: Max Williams Date: Mon, 9 Jul 2018 10:53:14 +0200 Subject: [PATCH 02/19] Splitting aws-auth and kubectl related resources as they are not related --- README.md | 3 ++- aws_auth.tf | 18 ++++++++++++++++++ kubectl.tf | 21 +-------------------- variables.tf | 9 +++++++-- 4 files changed, 28 insertions(+), 23 deletions(-) create mode 100644 aws_auth.tf diff --git a/README.md b/README.md index 38fac85..3df5bf3 100644 --- a/README.md +++ b/README.md @@ -98,7 +98,8 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | cluster_security_group_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the workers and provide API access to your current IP/32. | string | `` | no | | cluster_version | Kubernetes version to use for the EKS cluster. | string | `1.10` | no | | config_output_path | Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. | string | `./` | no | -| configure_kubectl_session | Configure the current session's kubectl to use the instantiated EKS cluster. | string | `true` | no | +| manage_aws_auth | Whether to write and apply the aws-auth configmap file. | boolean | `true` | no | +| write_kubeconfig | Whether to write a kubeconfig file containing the cluster configuration. | boolean | `true` | no | | kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | string | `` | no | | kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | string | `heptio-authenticator-aws` | no | | kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | string | `` | no | diff --git a/aws_auth.tf b/aws_auth.tf new file mode 100644 index 0000000..79e35cc --- /dev/null +++ b/aws_auth.tf @@ -0,0 +1,18 @@ +resource "local_file" "config_map_aws_auth" { + content = "${data.template_file.config_map_aws_auth.rendered}" + filename = "${var.config_output_path}/config-map-aws-auth.yaml" + count = "${var.manage_aws_auth ? 1 : 0}" +} + +resource "null_resource" "configure_kubectl" { + provisioner "local-exec" { + command = "kubectl apply -f ${var.config_output_path}/config-map-aws-auth.yaml --kubeconfig ${var.config_output_path}/kubeconfig" + } + + triggers { + config_map_rendered = "${data.template_file.config_map_aws_auth.rendered}" + kubeconfig_rendered = "${data.template_file.kubeconfig.rendered}" + } + + count = "${var.manage_aws_auth ? 1 : 0}" +} diff --git a/kubectl.tf b/kubectl.tf index 4c56a62..ec39963 100644 --- a/kubectl.tf +++ b/kubectl.tf @@ -1,24 +1,5 @@ resource "local_file" "kubeconfig" { content = "${data.template_file.kubeconfig.rendered}" filename = "${var.config_output_path}/kubeconfig_${var.cluster_name}" - count = "${var.configure_kubectl_session ? 1 : 0}" -} - -resource "local_file" "config_map_aws_auth" { - content = "${data.template_file.config_map_aws_auth.rendered}" - filename = "${var.config_output_path}/config-map-aws-auth_${var.cluster_name}.yaml" - count = "${var.configure_kubectl_session ? 1 : 0}" -} - -resource "null_resource" "configure_kubectl" { - provisioner "local-exec" { - command = "kubectl apply -f ${var.config_output_path}/config-map-aws-auth_${var.cluster_name}.yaml --kubeconfig ${var.config_output_path}/kubeconfig_${var.cluster_name}" - } - - triggers { - config_map_rendered = "${data.template_file.config_map_aws_auth.rendered}" - kubeconfig_rendered = "${data.template_file.kubeconfig.rendered}" - } - - count = "${var.configure_kubectl_session ? 1 : 0}" + count = "${var.write_kubeconfig ? 1 : 0}" } diff --git a/variables.tf b/variables.tf index 1302a48..c6dc071 100644 --- a/variables.tf +++ b/variables.tf @@ -22,8 +22,13 @@ variable "config_output_path" { default = "./" } -variable "configure_kubectl_session" { - description = "Configure the current session's kubectl to use the instantiated EKS cluster." +variable "write_kubeconfig" { + description = "Whether to write a kubeconfig file containing the cluster configuration" + default = true +} + +variable "manage_aws_auth" { + description = "Whether to write and apply the aws-auth configmap file" default = true } From 11cd282ec19974375d1f84356818b7c7abd18ce3 Mon Sep 17 00:00:00 2001 From: Max Williams Date: Tue, 10 Jul 2018 10:15:08 +0200 Subject: [PATCH 03/19] reverting some changes after feedback --- README.md | 12 ++++++------ cluster.tf | 2 +- data.tf | 12 ++++++------ outputs.tf | 10 +++++----- workers.tf | 16 ++++++++-------- 5 files changed, 26 insertions(+), 26 deletions(-) diff --git a/README.md b/README.md index 4ca0414..e9d81c5 100644 --- a/README.md +++ b/README.md @@ -98,18 +98,18 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | cluster_security_group_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the workers and provide API access to your current IP/32. | string | `` | no | | cluster_version | Kubernetes version to use for the EKS cluster. | string | `1.10` | no | | config_output_path | Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. | string | `./` | no | -| configure_kubectl_session | Configure the current session's kubectl to use the instantiated EKS cluster. | boolean | `true` | no | -| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | list | `` | no | +| configure_kubectl_session | Configure the current session's kubectl to use the instantiated EKS cluster. | string | `true` | no | +| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | list | `` | no | | kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | string | `heptio-authenticator-aws` | no | -| kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | string | `` | no | +| kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | map | `` | no | | kubeconfig_name | Override the default name used for items kubeconfig. | string | `` | no | | subnets | A list of subnets to place the EKS cluster and workers within. | list | - | yes | -| tags | A map of tags to add to all resources. | map | `` | no | +| tags | A map of tags to add to all resources. | map | `` | no | | vpc_id | VPC where the cluster and workers will be deployed. | string | - | yes | -| worker_groups | A list of maps defining worker group configurations. See workers_group_defaults for valid keys. | list | `` | no | +| worker_groups | A list of maps defining worker group configurations. See workers_group_defaults for valid keys. | list | `` | no | | worker_security_group_id | If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the EKS cluster. | string | `` | no | | worker_sg_ingress_from_port | Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443). | string | `1025` | no | -| workers_group_defaults | Default values for target groups as defined by the list of maps. | map | `` | no | +| workers_group_defaults | Default values for target groups as defined by the list of maps. | map | `` | no | | workstation_cidr | Override the default ingress rule that allows communication with the EKS cluster API. If not given, will use current IP/32. | string | `` | no | ## Outputs diff --git a/cluster.tf b/cluster.tf index 3abe774..87ad721 100644 --- a/cluster.tf +++ b/cluster.tf @@ -1,4 +1,4 @@ -resource "aws_eks_cluster" "cluster" { +resource "aws_eks_cluster" "this" { name = "${var.cluster_name}" role_arn = "${aws_iam_role.cluster.arn}" version = "${var.cluster_version}" diff --git a/data.tf b/data.tf index 1a47420..76a7eb6 100644 --- a/data.tf +++ b/data.tf @@ -48,11 +48,11 @@ data "template_file" "kubeconfig" { template = "${file("${path.module}/templates/kubeconfig.tpl")}" vars { - cluster_name = "${aws_eks_cluster.cluster.name}" - endpoint = "${aws_eks_cluster.cluster.endpoint}" + cluster_name = "${aws_eks_cluster.this.name}" kubeconfig_name = "${local.kubeconfig_name}" + endpoint = "${aws_eks_cluster.this.endpoint}" region = "${data.aws_region.current.name}" - cluster_auth_base64 = "${aws_eks_cluster.cluster.certificate_authority.0.data}" + cluster_auth_base64 = "${aws_eks_cluster.this.certificate_authority.0.data}" aws_authenticator_command = "${var.kubeconfig_aws_authenticator_command}" aws_authenticator_additional_args = "${length(var.kubeconfig_aws_authenticator_additional_args) > 0 ? " - ${join("\n - ", var.kubeconfig_aws_authenticator_additional_args)}" : "" }" aws_authenticator_env_variables = "${length(var.kubeconfig_aws_authenticator_env_variables) > 0 ? " env:\n${join("\n", data.template_file.aws_authenticator_env_variables.*.rendered)}" : ""}" @@ -87,9 +87,9 @@ data "template_file" "userdata" { vars { region = "${data.aws_region.current.name}" - cluster_name = "${aws_eks_cluster.cluster.name}" - endpoint = "${aws_eks_cluster.cluster.endpoint}" - cluster_auth_base64 = "${aws_eks_cluster.cluster.certificate_authority.0.data}" + cluster_name = "${aws_eks_cluster.this.name}" + endpoint = "${aws_eks_cluster.this.endpoint}" + cluster_auth_base64 = "${aws_eks_cluster.this.certificate_authority.0.data}" max_pod_count = "${lookup(local.max_pod_per_node, lookup(var.worker_groups[count.index], "instance_type", lookup(var.workers_group_defaults, "instance_type")))}" pre_userdata = "${lookup(var.worker_groups[count.index], "pre_userdata",lookup(var.workers_group_defaults, "pre_userdata"))}" additional_userdata = "${lookup(var.worker_groups[count.index], "additional_userdata",lookup(var.workers_group_defaults, "additional_userdata"))}" diff --git a/outputs.tf b/outputs.tf index f893792..9f5a16f 100644 --- a/outputs.tf +++ b/outputs.tf @@ -1,27 +1,27 @@ output "cluster_id" { description = "The name/id of the EKS cluster." - value = "${aws_eks_cluster.cluster.id}" + value = "${aws_eks_cluster.this.id}" } # Though documented, not yet supported # output "cluster_arn" { # description = "The Amazon Resource Name (ARN) of the cluster." -# value = "${aws_eks_cluster.cluster.arn}" +# value = "${aws_eks_cluster.this.arn}" # } output "cluster_certificate_authority_data" { description = "Nested attribute containing certificate-authority-data for your cluster. This is the base64 encoded certificate data required to communicate with your cluster." - value = "${aws_eks_cluster.cluster.certificate_authority.0.data}" + value = "${aws_eks_cluster.this.certificate_authority.0.data}" } output "cluster_endpoint" { description = "The endpoint for your EKS Kubernetes API." - value = "${aws_eks_cluster.cluster.endpoint}" + value = "${aws_eks_cluster.this.endpoint}" } output "cluster_version" { description = "The Kubernetes server version for the EKS cluster." - value = "${aws_eks_cluster.cluster.version}" + value = "${aws_eks_cluster.this.version}" } output "cluster_security_group_id" { diff --git a/workers.tf b/workers.tf index 18b3dda..ac0b157 100644 --- a/workers.tf +++ b/workers.tf @@ -1,5 +1,5 @@ resource "aws_autoscaling_group" "workers" { - name_prefix = "${aws_eks_cluster.cluster.name}-${lookup(var.worker_groups[count.index], "name", count.index)}" + name_prefix = "${aws_eks_cluster.this.name}-${lookup(var.worker_groups[count.index], "name", count.index)}" desired_capacity = "${lookup(var.worker_groups[count.index], "asg_desired_capacity", lookup(var.workers_group_defaults, "asg_desired_capacity"))}" max_size = "${lookup(var.worker_groups[count.index], "asg_max_size",lookup(var.workers_group_defaults, "asg_max_size"))}" min_size = "${lookup(var.worker_groups[count.index], "asg_min_size",lookup(var.workers_group_defaults, "asg_min_size"))}" @@ -9,8 +9,8 @@ resource "aws_autoscaling_group" "workers" { tags = ["${concat( list( - map("key", "Name", "value", "${aws_eks_cluster.cluster.name}-${lookup(var.worker_groups[count.index], "name", count.index)}-eks_asg", "propagate_at_launch", true), - map("key", "kubernetes.io/cluster/${aws_eks_cluster.cluster.name}", "value", "owned", "propagate_at_launch", true), + map("key", "Name", "value", "${aws_eks_cluster.this.name}-${lookup(var.worker_groups[count.index], "name", count.index)}-eks_asg", "propagate_at_launch", true), + map("key", "kubernetes.io/cluster/${aws_eks_cluster.this.name}", "value", "owned", "propagate_at_launch", true), ), local.asg_tags) }"] @@ -21,7 +21,7 @@ resource "aws_autoscaling_group" "workers" { } resource "aws_launch_configuration" "workers" { - name_prefix = "${aws_eks_cluster.cluster.name}-${lookup(var.worker_groups[count.index], "name", count.index)}" + name_prefix = "${aws_eks_cluster.this.name}-${lookup(var.worker_groups[count.index], "name", count.index)}" associate_public_ip_address = "${lookup(var.worker_groups[count.index], "public_ip", lookup(var.workers_group_defaults, "public_ip"))}" security_groups = ["${local.worker_security_group_id}"] iam_instance_profile = "${aws_iam_instance_profile.workers.id}" @@ -42,11 +42,11 @@ resource "aws_launch_configuration" "workers" { } resource "aws_security_group" "workers" { - name_prefix = "${aws_eks_cluster.cluster.name}" + name_prefix = "${aws_eks_cluster.this.name}" description = "Security group for all nodes in the cluster." vpc_id = "${var.vpc_id}" count = "${var.worker_security_group_id == "" ? 1 : 0}" - tags = "${merge(var.tags, map("Name", "${aws_eks_cluster.cluster.name}-eks_worker_sg", "kubernetes.io/cluster/${aws_eks_cluster.cluster.name}", "owned" + tags = "${merge(var.tags, map("Name", "${aws_eks_cluster.this.name}-eks_worker_sg", "kubernetes.io/cluster/${aws_eks_cluster.this.name}", "owned" ))}" } @@ -84,12 +84,12 @@ resource "aws_security_group_rule" "workers_ingress_cluster" { } resource "aws_iam_role" "workers" { - name_prefix = "${aws_eks_cluster.cluster.name}" + name_prefix = "${aws_eks_cluster.this.name}" assume_role_policy = "${data.aws_iam_policy_document.workers_assume_role_policy.json}" } resource "aws_iam_instance_profile" "workers" { - name_prefix = "${aws_eks_cluster.cluster.name}" + name_prefix = "${aws_eks_cluster.this.name}" role = "${aws_iam_role.workers.name}" } From 2a0a595940d17877f3d60b007a4844da638904d4 Mon Sep 17 00:00:00 2001 From: Max Williams Date: Mon, 9 Jul 2018 12:29:11 +0200 Subject: [PATCH 04/19] renaming resource and removing trigger --- README.md | 4 ++-- aws_auth.tf | 3 +-- 2 files changed, 3 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 3df5bf3..62eed49 100644 --- a/README.md +++ b/README.md @@ -98,8 +98,8 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | cluster_security_group_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the workers and provide API access to your current IP/32. | string | `` | no | | cluster_version | Kubernetes version to use for the EKS cluster. | string | `1.10` | no | | config_output_path | Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. | string | `./` | no | -| manage_aws_auth | Whether to write and apply the aws-auth configmap file. | boolean | `true` | no | -| write_kubeconfig | Whether to write a kubeconfig file containing the cluster configuration. | boolean | `true` | no | +| manage_aws_auth | Whether to write and apply the aws-auth configmap file. | string | `true` | no | +| write_kubeconfig | Whether to write a kubeconfig file containing the cluster configuration. | string | `true` | no | | kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | string | `` | no | | kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | string | `heptio-authenticator-aws` | no | | kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | string | `` | no | diff --git a/aws_auth.tf b/aws_auth.tf index 79e35cc..6038dc5 100644 --- a/aws_auth.tf +++ b/aws_auth.tf @@ -4,14 +4,13 @@ resource "local_file" "config_map_aws_auth" { count = "${var.manage_aws_auth ? 1 : 0}" } -resource "null_resource" "configure_kubectl" { +resource "null_resource" "update_config_map_aws_auth" { provisioner "local-exec" { command = "kubectl apply -f ${var.config_output_path}/config-map-aws-auth.yaml --kubeconfig ${var.config_output_path}/kubeconfig" } triggers { config_map_rendered = "${data.template_file.config_map_aws_auth.rendered}" - kubeconfig_rendered = "${data.template_file.kubeconfig.rendered}" } count = "${var.manage_aws_auth ? 1 : 0}" From f238e43c014b38acb5144db41c641271b38ab950 Mon Sep 17 00:00:00 2001 From: Max Williams Date: Tue, 10 Jul 2018 12:55:38 +0200 Subject: [PATCH 05/19] adding types to fix the output of terraform-docs command --- README.md | 1 + variables.tf | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index e9d81c5..fb0b265 100644 --- a/README.md +++ b/README.md @@ -126,3 +126,4 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | worker_iam_role_name | IAM role name attached to EKS workers | | worker_security_group_id | Security group ID attached to the EKS workers. | | workers_asg_arns | IDs of the autoscaling groups containing workers. | + diff --git a/variables.tf b/variables.tf index 1302a48..63c09b7 100644 --- a/variables.tf +++ b/variables.tf @@ -34,6 +34,7 @@ variable "subnets" { variable "tags" { description = "A map of tags to add to all resources." + type = "map" default = {} } @@ -87,15 +88,17 @@ variable "kubeconfig_aws_authenticator_command" { variable "kubeconfig_aws_authenticator_additional_args" { description = "Any additional arguments to pass to the authenticator such as the role to assume [\"-r\", \"MyEksRole\"]" + type = "list" default = [] } variable "kubeconfig_aws_authenticator_env_variables" { description = "Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = \"eks\"}" + type = "map" default = {} } variable "kubeconfig_name" { - description = "Override the default name used for items kubeconfig" + description = "Override the default name used for items kubeconfig." default = "" } From 4dce83bd9604e7d0d1da014086a7cd84972bdf8f Mon Sep 17 00:00:00 2001 From: Max Williams Date: Tue, 10 Jul 2018 12:56:54 +0200 Subject: [PATCH 06/19] updates after running terraform-docs --- README.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 62eed49..1cd024b 100644 --- a/README.md +++ b/README.md @@ -98,12 +98,11 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | cluster_security_group_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the workers and provide API access to your current IP/32. | string | `` | no | | cluster_version | Kubernetes version to use for the EKS cluster. | string | `1.10` | no | | config_output_path | Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. | string | `./` | no | -| manage_aws_auth | Whether to write and apply the aws-auth configmap file. | string | `true` | no | -| write_kubeconfig | Whether to write a kubeconfig file containing the cluster configuration. | string | `true` | no | | kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | string | `` | no | | kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | string | `heptio-authenticator-aws` | no | | kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | string | `` | no | -| kubeconfig_name | Override the default name used for items kubeconfig. | string | `` | no | +| kubeconfig_name | Override the default name used for items kubeconfig | string | `` | no | +| manage_aws_auth | Whether to write and apply the aws-auth configmap file | string | `true` | no | | subnets | A list of subnets to place the EKS cluster and workers within. | list | - | yes | | tags | A map of tags to add to all resources. | string | `` | no | | vpc_id | VPC where the cluster and workers will be deployed. | string | - | yes | @@ -112,6 +111,7 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | worker_sg_ingress_from_port | Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443). | string | `1025` | no | | workers_group_defaults | Default values for target groups as defined by the list of maps. | map | `` | no | | workstation_cidr | Override the default ingress rule that allows communication with the EKS cluster API. If not given, will use current IP/32. | string | `` | no | +| write_kubeconfig | Whether to write a kubeconfig file containing the cluster configuration | string | `true` | no | ## Outputs @@ -127,3 +127,4 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | worker_iam_role_name | IAM role name attached to EKS workers | | worker_security_group_id | Security group ID attached to the EKS workers. | | workers_asg_arns | IDs of the autoscaling groups containing workers. | + From b4756a57f7af7c6c8acb9404c640ef5946eb0585 Mon Sep 17 00:00:00 2001 From: ccantoni Date: Tue, 10 Jul 2018 10:40:49 -0400 Subject: [PATCH 07/19] Updating heptio-authenticator-aws to aws-iam-authenticator since the heptio project was moved and renamed. --- .gitignore | 1 + README.md | 4 ++-- main.tf | 2 +- variables.tf | 2 +- 4 files changed, 5 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index e787fbf..8382e2a 100644 --- a/.gitignore +++ b/.gitignore @@ -11,3 +11,4 @@ kubeconfig config-map-aws-auth.yaml eks-admin-cluster-role-binding.yaml eks-admin-service-account.yaml +.idea/ diff --git a/README.md b/README.md index 38fac85..0ed4f32 100644 --- a/README.md +++ b/README.md @@ -15,7 +15,7 @@ Read the [AWS docs on EKS to get connected to the k8s dashboard](https://docs.aw * You want to create an EKS cluster and an autoscaling group of workers for the cluster. * You want these resources to exist within security groups that allow communication and coordination. These can be user provided or created within the module. * You've created a Virtual Private Cloud (VPC) and subnets where you intend to put the EKS resources. -* If using the default variable value (`true`) for `configure_kubectl_session`, it's required that both [`kubectl`](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) (>=1.10) and [`heptio-authenticator-aws`](https://github.com/heptio/authenticator#4-set-up-kubectl-to-use-heptio-authenticator-for-aws-tokens) are installed and on your shell's PATH. +* If using the default variable value (`true`) for `configure_kubectl_session`, it's required that both [`kubectl`](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) (>=1.10) and [`aws-iam-authenticator`](https://github.com/kubernetes-sigs/aws-iam-authenticator#4-set-up-kubectl-to-use-authentication-tokens-provided-by-aws-iam-authenticator-for-kubernetes) are installed and on your shell's PATH. ## Usage example @@ -100,7 +100,7 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | config_output_path | Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. | string | `./` | no | | configure_kubectl_session | Configure the current session's kubectl to use the instantiated EKS cluster. | string | `true` | no | | kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | string | `` | no | -| kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | string | `heptio-authenticator-aws` | no | +| kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | string | `aws-iam-authenticator` | no | | kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | string | `` | no | | kubeconfig_name | Override the default name used for items kubeconfig. | string | `` | no | | subnets | A list of subnets to place the EKS cluster and workers within. | list | - | yes | diff --git a/main.tf b/main.tf index 7c2f06b..085c0c4 100644 --- a/main.tf +++ b/main.tf @@ -16,7 +16,7 @@ ** You want to create an EKS cluster and an autoscaling group of workers for the cluster. ** You want these resources to exist within security groups that allow communication and coordination. These can be user provided or created within the module. ** You've created a Virtual Private Cloud (VPC) and subnets where you intend to put the EKS resources. -** If using the default variable value (`true`) for `configure_kubectl_session`, it's required that both [`kubectl`](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) (>=1.10) and [`heptio-authenticator-aws`](https://github.com/heptio/authenticator#4-set-up-kubectl-to-use-heptio-authenticator-for-aws-tokens) are installed and on your shell's PATH. +** If using the default variable value (`true`) for `configure_kubectl_session`, it's required that both [`kubectl`](https://kubernetes.io/docs/tasks/tools/install-kubectl/#install-kubectl) (>=1.10) and [`aws-iam-authenticator`](https://github.com/kubernetes-sigs/aws-iam-authenticator#4-set-up-kubectl-to-use-authentication-tokens-provided-by-aws-iam-authenticator-for-kubernetes) are installed and on your shell's PATH. * ## Usage example diff --git a/variables.tf b/variables.tf index 1302a48..41b04e7 100644 --- a/variables.tf +++ b/variables.tf @@ -82,7 +82,7 @@ variable "worker_sg_ingress_from_port" { variable "kubeconfig_aws_authenticator_command" { description = "Command to use to to fetch AWS EKS credentials" - default = "heptio-authenticator-aws" + default = "aws-iam-authenticator" } variable "kubeconfig_aws_authenticator_additional_args" { From 58c4a0e30fe018157d6f67d990002a28c44b7424 Mon Sep 17 00:00:00 2001 From: Max Williams Date: Fri, 6 Jul 2018 16:31:55 +0200 Subject: [PATCH 08/19] initial commit --- aws_auth.tf | 49 +++++++++++++++++-- data.tf | 8 --- .../config-map-aws-auth-map_accounts.yaml.tpl | 1 + .../config-map-aws-auth-map_roles.yaml.tpl | 4 ++ .../config-map-aws-auth-map_users.yaml.tpl | 4 ++ templates/config-map-aws-auth.yaml.tpl | 7 ++- variables.tf | 18 +++++++ 7 files changed, 79 insertions(+), 12 deletions(-) create mode 100644 templates/config-map-aws-auth-map_accounts.yaml.tpl create mode 100644 templates/config-map-aws-auth-map_roles.yaml.tpl create mode 100644 templates/config-map-aws-auth-map_users.yaml.tpl diff --git a/aws_auth.tf b/aws_auth.tf index 6038dc5..3dd9159 100644 --- a/aws_auth.tf +++ b/aws_auth.tf @@ -1,17 +1,60 @@ resource "local_file" "config_map_aws_auth" { content = "${data.template_file.config_map_aws_auth.rendered}" filename = "${var.config_output_path}/config-map-aws-auth.yaml" - count = "${var.manage_aws_auth ? 1 : 0}" + count = "${var.configure_kubectl_session ? 1 : 0}" } -resource "null_resource" "update_config_map_aws_auth" { +resource "null_resource" "configure_kubectl" { provisioner "local-exec" { command = "kubectl apply -f ${var.config_output_path}/config-map-aws-auth.yaml --kubeconfig ${var.config_output_path}/kubeconfig" } triggers { config_map_rendered = "${data.template_file.config_map_aws_auth.rendered}" + kubeconfig_rendered = "${data.template_file.kubeconfig.rendered}" } - count = "${var.manage_aws_auth ? 1 : 0}" + count = "${var.configure_kubectl_session ? 1 : 0}" +} + +data "template_file" "config_map_aws_auth" { + template = "${file("${path.module}/templates/config-map-aws-auth.yaml.tpl")}" + + vars { + worker_role_arn = "${aws_iam_role.workers.arn}" + map_users = "${join("", data.template_file.map_users.*.rendered)}" + map_roles = "${join("", data.template_file.map_roles.*.rendered)}" + map_accounts = "${join("", data.template_file.map_accounts.*.rendered)}" + } +} + +data "template_file" "map_users" { + count = "${length(var.map_users)}" + template = "${file("${path.module}/templates/config-map-aws-auth-map_users.yaml.tpl")}" + + vars { + user_arn = "${lookup(var.map_users[count.index], "user_arn")}" + username = "${lookup(var.map_users[count.index], "username")}" + group = "${lookup(var.map_users[count.index], "group")}" + } +} + +data "template_file" "map_roles" { + count = "${length(var.map_roles)}" + template = "${file("${path.module}/templates/config-map-aws-auth-map_roles.yaml.tpl")}" + + vars { + role_arn = "${lookup(var.map_roles[count.index], "role_arn")}" + username = "${lookup(var.map_roles[count.index], "username")}" + group = "${lookup(var.map_roles[count.index], "group")}" + } +} + +data "template_file" "map_accounts" { + count = "${length(var.map_accounts)}" + template = "${file("${path.module}/templates/config-map-aws-auth-map_accounts.yaml.tpl")}" + + vars { + account_number = "${element(var.map_accounts, count.index)}" + } } diff --git a/data.tf b/data.tf index 76a7eb6..0273182 100644 --- a/data.tf +++ b/data.tf @@ -73,14 +73,6 @@ EOF } } -data "template_file" "config_map_aws_auth" { - template = "${file("${path.module}/templates/config-map-aws-auth.yaml.tpl")}" - - vars { - role_arn = "${aws_iam_role.workers.arn}" - } -} - data "template_file" "userdata" { template = "${file("${path.module}/templates/userdata.sh.tpl")}" count = "${length(var.worker_groups)}" diff --git a/templates/config-map-aws-auth-map_accounts.yaml.tpl b/templates/config-map-aws-auth-map_accounts.yaml.tpl new file mode 100644 index 0000000..26dc507 --- /dev/null +++ b/templates/config-map-aws-auth-map_accounts.yaml.tpl @@ -0,0 +1 @@ + - "${account_number}" diff --git a/templates/config-map-aws-auth-map_roles.yaml.tpl b/templates/config-map-aws-auth-map_roles.yaml.tpl new file mode 100644 index 0000000..9f321b7 --- /dev/null +++ b/templates/config-map-aws-auth-map_roles.yaml.tpl @@ -0,0 +1,4 @@ + - rolearn: ${role_arn} + username: ${username} + groups: + - ${group} diff --git a/templates/config-map-aws-auth-map_users.yaml.tpl b/templates/config-map-aws-auth-map_users.yaml.tpl new file mode 100644 index 0000000..92499de --- /dev/null +++ b/templates/config-map-aws-auth-map_users.yaml.tpl @@ -0,0 +1,4 @@ + - userarn: ${user_arn} + username: ${username} + groups: + - ${group} diff --git a/templates/config-map-aws-auth.yaml.tpl b/templates/config-map-aws-auth.yaml.tpl index 746817f..8cd42fe 100644 --- a/templates/config-map-aws-auth.yaml.tpl +++ b/templates/config-map-aws-auth.yaml.tpl @@ -5,8 +5,13 @@ metadata: namespace: kube-system data: mapRoles: | - - rolearn: ${role_arn} + - rolearn: ${worker_role_arn} username: system:node:{{EC2PrivateDNSName}} groups: - system:bootstrappers - system:nodes +${map_roles} + mapUsers: | +${map_users} + mapAccounts: | +${map_accounts} diff --git a/variables.tf b/variables.tf index 35ccf90..9eb67c0 100644 --- a/variables.tf +++ b/variables.tf @@ -32,6 +32,24 @@ variable "manage_aws_auth" { default = true } +variable "map_accounts" { + description = "Additional AWS account numbers to add to the aws-auth configmap" + type = "list" + default = [] +} + +variable "map_roles" { + description = "Additional IAM roles to add to the aws-auth configmap" + type = "list" + default = [] +} + +variable "map_users" { + description = "Additional IAM users to add to the aws-auth configmap" + type = "list" + default = [] +} + variable "subnets" { description = "A list of subnets to place the EKS cluster and workers within." type = "list" From 2775f35547d51203392b1d17655fc2e78e134e3f Mon Sep 17 00:00:00 2001 From: Max Williams Date: Tue, 10 Jul 2018 12:28:52 +0200 Subject: [PATCH 09/19] updating changelog, variables and readme --- CHANGELOG.md | 6 ++++++ README.md | 13 ++++++++----- variables.tf | 6 +++--- 3 files changed, 17 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2b2d754..a838e80 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](http://keepachangelog.com/) and this project adheres to [Semantic Versioning](http://semver.org/). +## [[v1.4.0](https://github.com/terraform-aws-modules/terraform-aws-eks/compare/v1.3.0...v1.4.0)] - 2018-07-12] + +### Added + +- New variables `map_accounts`, `map_roles` and `map_users` in order to manage additional entries in the `aws-auth` configmap. (by @max-rocket-internet) + ## [[v1.3.0](https://github.com/terraform-aws-modules/terraform-aws-eks/compare/v1.2.0...v1.3.0)] - 2018-07-??] ### Added diff --git a/README.md b/README.md index 9ca9f01..34c6233 100644 --- a/README.md +++ b/README.md @@ -99,11 +99,13 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | cluster_version | Kubernetes version to use for the EKS cluster. | string | `1.10` | no | | config_output_path | Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. | string | `./` | no | | configure_kubectl_session | Configure the current session's kubectl to use the instantiated EKS cluster. | string | `true` | no | -| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume. ["-r", "MyEksRole"] | list | `` | no | -| kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials. | string | `heptio-authenticator-aws` | no | -| kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator. e.g. { AWS_PROFILE = "eks"} | map | `` | no | -| kubeconfig_name | Override the default name used for items kubeconfig. | string | `` | no | -| manage_aws_auth | Whether to write and apply the aws-auth configmap file. | string | `true` | no | +| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | string | `` | no | +| kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | string | `heptio-authenticator-aws` | no | +| kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | string | `` | no | +| kubeconfig_name | Override the default name used for items kubeconfig | string | `` | no | +| map_accounts | Additional AWS account numbers to add to the aws-auth configmap. | list | `` | no | +| map_roles | Additional IAM roles to add to the aws-auth configmap. | list | `` | no | +| map_users | Additional IAM users to add to the aws-auth configmap. | list | `` | no | | subnets | A list of subnets to place the EKS cluster and workers within. | list | - | yes | | tags | A map of tags to add to all resources. | map | `` | no | | vpc_id | VPC where the cluster and workers will be deployed. | string | - | yes | @@ -128,3 +130,4 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | worker_iam_role_name | IAM role name attached to EKS workers | | worker_security_group_id | Security group ID attached to the EKS workers. | | workers_asg_arns | IDs of the autoscaling groups containing workers. | + diff --git a/variables.tf b/variables.tf index 9eb67c0..7855e5f 100644 --- a/variables.tf +++ b/variables.tf @@ -33,19 +33,19 @@ variable "manage_aws_auth" { } variable "map_accounts" { - description = "Additional AWS account numbers to add to the aws-auth configmap" + description = "Additional AWS account numbers to add to the aws-auth configmap." type = "list" default = [] } variable "map_roles" { - description = "Additional IAM roles to add to the aws-auth configmap" + description = "Additional IAM roles to add to the aws-auth configmap." type = "list" default = [] } variable "map_users" { - description = "Additional IAM users to add to the aws-auth configmap" + description = "Additional IAM users to add to the aws-auth configmap." type = "list" default = [] } From bb9e24102188801bf55c3c3990faf36e1900fe0d Mon Sep 17 00:00:00 2001 From: Max Williams Date: Tue, 10 Jul 2018 12:40:12 +0200 Subject: [PATCH 10/19] finishing doc, tests etc --- README.md | 9 +++--- aws_auth.tf | 4 +-- examples/eks_test_fixture/main.tf | 3 ++ examples/eks_test_fixture/variables.tf | 38 ++++++++++++++++++++++++++ variables.tf | 6 ++-- 5 files changed, 50 insertions(+), 10 deletions(-) diff --git a/README.md b/README.md index 34c6233..693a2c0 100644 --- a/README.md +++ b/README.md @@ -63,7 +63,7 @@ Generate them like so: ```bash go get github.com/segmentio/terraform-docs -terraform-docs md ./ | cat -s | ghead -n -1 > README.md +terraform-docs md ./ | cat -s > README.md ``` ## Contributing @@ -103,9 +103,9 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | string | `heptio-authenticator-aws` | no | | kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | string | `` | no | | kubeconfig_name | Override the default name used for items kubeconfig | string | `` | no | -| map_accounts | Additional AWS account numbers to add to the aws-auth configmap. | list | `` | no | -| map_roles | Additional IAM roles to add to the aws-auth configmap. | list | `` | no | -| map_users | Additional IAM users to add to the aws-auth configmap. | list | `` | no | +| map_accounts | Additional AWS account numbers to add to the aws-auth configmap. See examples/eks_test_fixture/variables.tf for example format. | list | `` | no | +| map_roles | Additional IAM roles to add to the aws-auth configmap. See examples/eks_test_fixture/variables.tf for example format. | list | `` | no | +| map_users | Additional IAM users to add to the aws-auth configmap. See examples/eks_test_fixture/variables.tf for example format. | list | `` | no | | subnets | A list of subnets to place the EKS cluster and workers within. | list | - | yes | | tags | A map of tags to add to all resources. | map | `` | no | | vpc_id | VPC where the cluster and workers will be deployed. | string | - | yes | @@ -130,4 +130,3 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | worker_iam_role_name | IAM role name attached to EKS workers | | worker_security_group_id | Security group ID attached to the EKS workers. | | workers_asg_arns | IDs of the autoscaling groups containing workers. | - diff --git a/aws_auth.tf b/aws_auth.tf index 3dd9159..ec32361 100644 --- a/aws_auth.tf +++ b/aws_auth.tf @@ -1,12 +1,12 @@ resource "local_file" "config_map_aws_auth" { content = "${data.template_file.config_map_aws_auth.rendered}" - filename = "${var.config_output_path}/config-map-aws-auth.yaml" + filename = "${var.config_output_path}/config-map-aws-auth_${var.cluster_name}.yaml" count = "${var.configure_kubectl_session ? 1 : 0}" } resource "null_resource" "configure_kubectl" { provisioner "local-exec" { - command = "kubectl apply -f ${var.config_output_path}/config-map-aws-auth.yaml --kubeconfig ${var.config_output_path}/kubeconfig" + command = "kubectl apply -f ${var.config_output_path}/config-map-aws-auth_${var.cluster_name}.yaml --kubeconfig ${var.config_output_path}/kubeconfig_${var.cluster_name}" } triggers { diff --git a/examples/eks_test_fixture/main.tf b/examples/eks_test_fixture/main.tf index def2f32..6134a27 100644 --- a/examples/eks_test_fixture/main.tf +++ b/examples/eks_test_fixture/main.tf @@ -70,4 +70,7 @@ module "eks" { tags = "${local.tags}" vpc_id = "${module.vpc.vpc_id}" worker_groups = "${local.worker_groups}" + map_roles = "${var.map_roles}" + map_users = "${var.map_users}" + map_accounts = "${var.map_accounts}" } diff --git a/examples/eks_test_fixture/variables.tf b/examples/eks_test_fixture/variables.tf index 81b8dbe..8d840bd 100644 --- a/examples/eks_test_fixture/variables.tf +++ b/examples/eks_test_fixture/variables.tf @@ -1,3 +1,41 @@ variable "region" { default = "us-west-2" } + +variable "map_accounts" { + description = "Additional AWS account numbers to add to the aws-auth configmap." + type = "list" + default = [ + "777777777777", + "888888888888" + ] +} + +variable "map_roles" { + description = "Additional IAM roles to add to the aws-auth configmap." + type = "list" + default = [ + { + role_arn = "arn:aws:iam::66666666666:role/role1" + username = "role1" + group = "system:masters" + } + ] +} + +variable "map_users" { + description = "Additional IAM users to add to the aws-auth configmap." + type = "list" + default = [ + { + user_arn = "arn:aws:iam::66666666666:user/user1" + username = "user1" + group = "system:masters" + }, + { + user_arn = "arn:aws:iam::66666666666:user/user2" + username = "user2" + group = "system:masters" + } + ] +} diff --git a/variables.tf b/variables.tf index 7855e5f..0bc65dc 100644 --- a/variables.tf +++ b/variables.tf @@ -33,19 +33,19 @@ variable "manage_aws_auth" { } variable "map_accounts" { - description = "Additional AWS account numbers to add to the aws-auth configmap." + description = "Additional AWS account numbers to add to the aws-auth configmap. See examples/eks_test_fixture/variables.tf for example format." type = "list" default = [] } variable "map_roles" { - description = "Additional IAM roles to add to the aws-auth configmap." + description = "Additional IAM roles to add to the aws-auth configmap. See examples/eks_test_fixture/variables.tf for example format." type = "list" default = [] } variable "map_users" { - description = "Additional IAM users to add to the aws-auth configmap." + description = "Additional IAM users to add to the aws-auth configmap. See examples/eks_test_fixture/variables.tf for example format." type = "list" default = [] } From 46ad6259ce79ff846c564e4420f4a26ac3c27547 Mon Sep 17 00:00:00 2001 From: Igor Borodin Date: Wed, 11 Jul 2018 11:32:09 +0300 Subject: [PATCH 11/19] Adding worker_iam_role_arn to module outputs --- outputs.tf | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/outputs.tf b/outputs.tf index 9f5a16f..bda7bf0 100644 --- a/outputs.tf +++ b/outputs.tf @@ -53,3 +53,8 @@ output "worker_iam_role_name" { description = "IAM role name attached to EKS workers" value = "${aws_iam_role.workers.name}" } + +output "worker_iam_role_arn" { + description = "IAM role ID attached to EKS workers" + value = "${aws_iam_role.workers.arn}" +} From 72a40c7d4e74e8d5fb3e88a0338429f0c3b5c5ba Mon Sep 17 00:00:00 2001 From: Igor Borodin Date: Wed, 11 Jul 2018 11:38:27 +0300 Subject: [PATCH 12/19] Updating docs and changelog --- CHANGELOG.md | 1 + README.md | 1 + 2 files changed, 2 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2b2d754..b913efb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,6 +10,7 @@ project adheres to [Semantic Versioning](http://semver.org/). ### Added - kubelet_node_labels worker group option allows setting --node-labels= in kubelet. (Hat-tip, @bshelton229 👒) +- `worker_iam_role_arn` added to outputs. Sweet, @hatemosphere 🔥 ### Changed diff --git a/README.md b/README.md index 900e048..15e3872 100644 --- a/README.md +++ b/README.md @@ -126,5 +126,6 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | config_map_aws_auth | A kubernetes configuration to authenticate to this EKS cluster. | | kubeconfig | kubectl config file contents for this EKS cluster. | | worker_iam_role_name | IAM role name attached to EKS workers | +| worker_iam_role_arn | IAM role ID attached to EKS workers | | worker_security_group_id | Security group ID attached to the EKS workers. | | workers_asg_arns | IDs of the autoscaling groups containing workers. | From e4263868e82037d78feeed7be95abf89353220d4 Mon Sep 17 00:00:00 2001 From: Max Williams Date: Wed, 11 Jul 2018 10:43:09 +0200 Subject: [PATCH 13/19] terraform fmt fix --- examples/eks_test_fixture/variables.tf | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/examples/eks_test_fixture/variables.tf b/examples/eks_test_fixture/variables.tf index 8d840bd..1c5f631 100644 --- a/examples/eks_test_fixture/variables.tf +++ b/examples/eks_test_fixture/variables.tf @@ -5,37 +5,40 @@ variable "region" { variable "map_accounts" { description = "Additional AWS account numbers to add to the aws-auth configmap." type = "list" - default = [ + + default = [ "777777777777", - "888888888888" + "888888888888", ] } variable "map_roles" { description = "Additional IAM roles to add to the aws-auth configmap." type = "list" - default = [ + + default = [ { role_arn = "arn:aws:iam::66666666666:role/role1" username = "role1" - group = "system:masters" - } + group = "system:masters" + }, ] } variable "map_users" { description = "Additional IAM users to add to the aws-auth configmap." type = "list" - default = [ + + default = [ { user_arn = "arn:aws:iam::66666666666:user/user1" username = "user1" - group = "system:masters" + group = "system:masters" }, { user_arn = "arn:aws:iam::66666666666:user/user2" username = "user2" - group = "system:masters" - } + group = "system:masters" + }, ] } From bad2e5ba982f8340c0a5157b744b6995a3dbe336 Mon Sep 17 00:00:00 2001 From: Max Williams Date: Wed, 11 Jul 2018 10:43:34 +0200 Subject: [PATCH 14/19] update readme with new doc update method and variable descriptions --- README.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 693a2c0..90e4dec 100644 --- a/README.md +++ b/README.md @@ -63,7 +63,7 @@ Generate them like so: ```bash go get github.com/segmentio/terraform-docs -terraform-docs md ./ | cat -s > README.md +terraform-docs md ./ | cat -s | ghead -n -1 > README.md ``` ## Contributing @@ -98,11 +98,11 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | cluster_security_group_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the workers and provide API access to your current IP/32. | string | `` | no | | cluster_version | Kubernetes version to use for the EKS cluster. | string | `1.10` | no | | config_output_path | Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. | string | `./` | no | -| configure_kubectl_session | Configure the current session's kubectl to use the instantiated EKS cluster. | string | `true` | no | -| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | string | `` | no | +| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | list | `` | no | | kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | string | `heptio-authenticator-aws` | no | -| kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | string | `` | no | -| kubeconfig_name | Override the default name used for items kubeconfig | string | `` | no | +| kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | map | `` | no | +| kubeconfig_name | Override the default name used for items kubeconfig. | string | `` | no | +| manage_aws_auth | Whether to write and apply the aws-auth configmap file | string | `true` | no | | map_accounts | Additional AWS account numbers to add to the aws-auth configmap. See examples/eks_test_fixture/variables.tf for example format. | list | `` | no | | map_roles | Additional IAM roles to add to the aws-auth configmap. See examples/eks_test_fixture/variables.tf for example format. | list | `` | no | | map_users | Additional IAM users to add to the aws-auth configmap. See examples/eks_test_fixture/variables.tf for example format. | list | `` | no | From 6f886e6d37a28ecdca0ad8a538b2727d3be59442 Mon Sep 17 00:00:00 2001 From: Max Williams Date: Wed, 11 Jul 2018 10:48:44 +0200 Subject: [PATCH 15/19] fixing readme.md Merge remote-tracking branch 'origin/aws-auth_enhancemnts' into aws-auth_enhancemnts --- .gitignore | 1 + README.md | 4 ++-- aws_auth.tf | 5 ++--- variables.tf | 4 ++-- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.gitignore b/.gitignore index e787fbf..8382e2a 100644 --- a/.gitignore +++ b/.gitignore @@ -11,3 +11,4 @@ kubeconfig config-map-aws-auth.yaml eks-admin-cluster-role-binding.yaml eks-admin-service-account.yaml +.idea/ diff --git a/README.md b/README.md index 90e4dec..652b778 100644 --- a/README.md +++ b/README.md @@ -102,7 +102,7 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | string | `heptio-authenticator-aws` | no | | kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | map | `` | no | | kubeconfig_name | Override the default name used for items kubeconfig. | string | `` | no | -| manage_aws_auth | Whether to write and apply the aws-auth configmap file | string | `true` | no | +| manage_aws_auth | Whether to write and apply the aws-auth configmap file. | string | `true` | no | | map_accounts | Additional AWS account numbers to add to the aws-auth configmap. See examples/eks_test_fixture/variables.tf for example format. | list | `` | no | | map_roles | Additional IAM roles to add to the aws-auth configmap. See examples/eks_test_fixture/variables.tf for example format. | list | `` | no | | map_users | Additional IAM users to add to the aws-auth configmap. See examples/eks_test_fixture/variables.tf for example format. | list | `` | no | @@ -114,7 +114,7 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | worker_sg_ingress_from_port | Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443). | string | `1025` | no | | workers_group_defaults | Default values for target groups as defined by the list of maps. | map | `` | no | | workstation_cidr | Override the default ingress rule that allows communication with the EKS cluster API. If not given, will use current IP/32. | string | `` | no | -| write_kubeconfig | Whether to write a kubeconfig file containing the cluster configuration | string | `true` | no | +| write_kubeconfig | Whether to write a kubeconfig file containing the cluster configuration. | string | `true` | no | ## Outputs diff --git a/aws_auth.tf b/aws_auth.tf index ec32361..10edceb 100644 --- a/aws_auth.tf +++ b/aws_auth.tf @@ -1,17 +1,16 @@ resource "local_file" "config_map_aws_auth" { content = "${data.template_file.config_map_aws_auth.rendered}" filename = "${var.config_output_path}/config-map-aws-auth_${var.cluster_name}.yaml" - count = "${var.configure_kubectl_session ? 1 : 0}" + count = "${var.manage_aws_auth ? 1 : 0}" } -resource "null_resource" "configure_kubectl" { +resource "null_resource" "update_config_map_aws_auth" { provisioner "local-exec" { command = "kubectl apply -f ${var.config_output_path}/config-map-aws-auth_${var.cluster_name}.yaml --kubeconfig ${var.config_output_path}/kubeconfig_${var.cluster_name}" } triggers { config_map_rendered = "${data.template_file.config_map_aws_auth.rendered}" - kubeconfig_rendered = "${data.template_file.kubeconfig.rendered}" } count = "${var.configure_kubectl_session ? 1 : 0}" diff --git a/variables.tf b/variables.tf index 0bc65dc..d5c4b4a 100644 --- a/variables.tf +++ b/variables.tf @@ -23,12 +23,12 @@ variable "config_output_path" { } variable "write_kubeconfig" { - description = "Whether to write a kubeconfig file containing the cluster configuration" + description = "Whether to write a kubeconfig file containing the cluster configuration." default = true } variable "manage_aws_auth" { - description = "Whether to write and apply the aws-auth configmap file" + description = "Whether to write and apply the aws-auth configmap file." default = true } From 12b67f3e1f6817de1e20d9adb3a94e8d3c74c2bb Mon Sep 17 00:00:00 2001 From: Brandon O'Connor Date: Wed, 11 Jul 2018 02:36:21 -0700 Subject: [PATCH 16/19] staging the 1.3.0 release. Will revisit the changelog --- CHANGELOG.md | 21 +++++++++++---------- README.md | 8 ++++---- local.tf | 3 +-- variables.tf | 8 ++++---- version | 2 +- 5 files changed, 21 insertions(+), 21 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3fe3786..b905aeb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,23 +5,24 @@ All notable changes to this project will be documented in this file. The format is based on [Keep a Changelog](http://keepachangelog.com/) and this project adheres to [Semantic Versioning](http://semver.org/). -## [[v1.4.0](https://github.com/terraform-aws-modules/terraform-aws-eks/compare/v1.3.0...v1.4.0)] - 2018-07-12] +## [[v1.4.0](https://github.com/terraform-aws-modules/terraform-aws-eks/compare/v1.3.0...HEAD)] - 2018-07-??] + +### Added + +- Some excellent feature. (you're on fire, @me 🔥) + +### Changed + +- A very thoughtful change. (Boomshakalaka, @self 🏀) + +## [[v1.3.0](https://github.com/terraform-aws-modules/terraform-aws-eks/compare/v1.2.0...v1.3.0)] - 2018-07-11] ### Added - New variables `map_accounts`, `map_roles` and `map_users` in order to manage additional entries in the `aws-auth` configmap. (by @max-rocket-internet) - -## [[v1.3.0](https://github.com/terraform-aws-modules/terraform-aws-eks/compare/v1.2.0...v1.3.0)] - 2018-07-??] - -### Added - - kubelet_node_labels worker group option allows setting --node-labels= in kubelet. (Hat-tip, @bshelton229 👒) - `worker_iam_role_arn` added to outputs. Sweet, @hatemosphere 🔥 -### Changed - -- your excellent change. (Boomshakalaka, @self 🏀) - ## [[v1.2.0](https://github.com/terraform-aws-modules/terraform-aws-eks/compare/v1.1.0...v1.2.0)] - 2018-07-01] ### Added diff --git a/README.md b/README.md index 01bd300..45e6f36 100644 --- a/README.md +++ b/README.md @@ -98,9 +98,9 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | cluster_security_group_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the workers and provide API access to your current IP/32. | string | `` | no | | cluster_version | Kubernetes version to use for the EKS cluster. | string | `1.10` | no | | config_output_path | Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. | string | `./` | no | -| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | list | `` | no | -| kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | string | `heptio-authenticator-aws` | no | -| kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | map | `` | no | +| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume. e.g. ["-r", "MyEksRole"]. | list | `` | no | +| kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials. | string | `aws-iam-authenticator` | no | +| kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator. e.g. { AWS_PROFILE = "eks"}. | map | `` | no | | kubeconfig_name | Override the default name used for items kubeconfig. | string | `` | no | | manage_aws_auth | Whether to write and apply the aws-auth configmap file. | string | `true` | no | | map_accounts | Additional AWS account numbers to add to the aws-auth configmap. See examples/eks_test_fixture/variables.tf for example format. | list | `` | no | @@ -127,7 +127,7 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | cluster_version | The Kubernetes server version for the EKS cluster. | | config_map_aws_auth | A kubernetes configuration to authenticate to this EKS cluster. | | kubeconfig | kubectl config file contents for this EKS cluster. | -| worker_iam_role_name | IAM role name attached to EKS workers | | worker_iam_role_arn | IAM role ID attached to EKS workers | +| worker_iam_role_name | IAM role name attached to EKS workers | | worker_security_group_id | Security group ID attached to the EKS workers. | | workers_asg_arns | IDs of the autoscaling groups containing workers. | diff --git a/local.tf b/local.tf index 9c87d73..87611ec 100644 --- a/local.tf +++ b/local.tf @@ -8,8 +8,7 @@ locals { worker_security_group_id = "${coalesce(join("", aws_security_group.workers.*.id), var.worker_security_group_id)}" workstation_external_cidr = "${chomp(data.http.workstation_external_ip.body)}/32" workstation_cidr = "${coalesce(var.workstation_cidr, local.workstation_external_cidr)}" - - kubeconfig_name = "${var.kubeconfig_name == "" ? "eks_${var.cluster_name}" : var.kubeconfig_name}" + kubeconfig_name = "${var.kubeconfig_name == "" ? "eks_${var.cluster_name}" : var.kubeconfig_name}" # Mapping from the node type that we selected and the max number of pods that it can run # Taken from https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-06-05/amazon-eks-nodegroup.yaml diff --git a/variables.tf b/variables.tf index fc80514..762a89a 100644 --- a/variables.tf +++ b/variables.tf @@ -8,7 +8,7 @@ variable "cluster_security_group_id" { } variable "workstation_cidr" { - description = "Override the default ingress rule that allows communication with the EKS cluster API. If not given, will use current IP/32. " + description = "Override the default ingress rule that allows communication with the EKS cluster API. If not given, will use current IP/32. " default = "" } @@ -105,18 +105,18 @@ variable "worker_sg_ingress_from_port" { } variable "kubeconfig_aws_authenticator_command" { - description = "Command to use to to fetch AWS EKS credentials" + description = "Command to use to to fetch AWS EKS credentials." default = "aws-iam-authenticator" } variable "kubeconfig_aws_authenticator_additional_args" { - description = "Any additional arguments to pass to the authenticator such as the role to assume [\"-r\", \"MyEksRole\"]" + description = "Any additional arguments to pass to the authenticator such as the role to assume. e.g. [\"-r\", \"MyEksRole\"]." type = "list" default = [] } variable "kubeconfig_aws_authenticator_env_variables" { - description = "Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = \"eks\"}" + description = "Environment variables that should be used when executing the authenticator. e.g. { AWS_PROFILE = \"eks\"}." type = "map" default = {} } diff --git a/version b/version index 79127d8..18fa8e7 100644 --- a/version +++ b/version @@ -1 +1 @@ -v1.2.0 +v1.3.0 From 399f1f213e6969b7a0bffece2b9c09a8f6257cf3 Mon Sep 17 00:00:00 2001 From: Bryan Shelton Date: Sat, 7 Jul 2018 19:05:48 -0700 Subject: [PATCH 17/19] Optionally define worker subnets --- variables.tf | 1 + workers.tf | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/variables.tf b/variables.tf index fc80514..876c9a6 100644 --- a/variables.tf +++ b/variables.tf @@ -91,6 +91,7 @@ variable "workers_group_defaults" { ebs_optimized = true # sets whether to use ebs optimization on supported types. public_ip = false # Associate a public ip address with a worker kubelet_node_labels = "" # This string is passed directly to kubelet via --node-lables= if set. It should be comma delimited with no spaces. If left empty no --node-labels switch is added. + subnets = "" # A comma delimited string of subnets to place the worker nodes in. i.e. subnet-123,subnet-456,subnet-789 } } diff --git a/workers.tf b/workers.tf index ac0b157..1184de4 100644 --- a/workers.tf +++ b/workers.tf @@ -4,7 +4,7 @@ resource "aws_autoscaling_group" "workers" { max_size = "${lookup(var.worker_groups[count.index], "asg_max_size",lookup(var.workers_group_defaults, "asg_max_size"))}" min_size = "${lookup(var.worker_groups[count.index], "asg_min_size",lookup(var.workers_group_defaults, "asg_min_size"))}" launch_configuration = "${element(aws_launch_configuration.workers.*.id, count.index)}" - vpc_zone_identifier = ["${var.subnets}"] + vpc_zone_identifier = ["${split(",", coalesce(lookup(var.worker_groups[count.index], "subnets", ""), join(",", var.subnets)))}"] count = "${length(var.worker_groups)}" tags = ["${concat( From 66e34033872cfbd9e406024f30effbeb54a14de1 Mon Sep 17 00:00:00 2001 From: Brandon O'Connor Date: Wed, 11 Jul 2018 23:32:48 -0700 Subject: [PATCH 18/19] test fixture produced an error for the path of kubectl being .// removed the extra slash to fix --- .gitignore | 4 ++-- aws_auth.tf | 4 ++-- kubectl.tf | 2 +- variables.tf | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.gitignore b/.gitignore index 8382e2a..9c5b19c 100644 --- a/.gitignore +++ b/.gitignore @@ -7,8 +7,8 @@ .kitchen.local.yml Gemfile.lock terraform.tfstate.d/ -kubeconfig -config-map-aws-auth.yaml eks-admin-cluster-role-binding.yaml eks-admin-service-account.yaml .idea/ +config-map-aws-auth*.yaml +kubeconfig_* diff --git a/aws_auth.tf b/aws_auth.tf index 6b19dbc..b0bbb32 100644 --- a/aws_auth.tf +++ b/aws_auth.tf @@ -1,12 +1,12 @@ resource "local_file" "config_map_aws_auth" { content = "${data.template_file.config_map_aws_auth.rendered}" - filename = "${var.config_output_path}/config-map-aws-auth_${var.cluster_name}.yaml" + filename = "${var.config_output_path}config-map-aws-auth_${var.cluster_name}.yaml" count = "${var.manage_aws_auth ? 1 : 0}" } resource "null_resource" "update_config_map_aws_auth" { provisioner "local-exec" { - command = "kubectl apply -f ${var.config_output_path}/config-map-aws-auth_${var.cluster_name}.yaml --kubeconfig ${var.config_output_path}/kubeconfig_${var.cluster_name}" + command = "kubectl apply -f ${var.config_output_path}config-map-aws-auth_${var.cluster_name}.yaml --kubeconfig ${var.config_output_path}kubeconfig_${var.cluster_name}" } triggers { diff --git a/kubectl.tf b/kubectl.tf index ec39963..e39cc8c 100644 --- a/kubectl.tf +++ b/kubectl.tf @@ -1,5 +1,5 @@ resource "local_file" "kubeconfig" { content = "${data.template_file.kubeconfig.rendered}" - filename = "${var.config_output_path}/kubeconfig_${var.cluster_name}" + filename = "${var.config_output_path}kubeconfig_${var.cluster_name}" count = "${var.write_kubeconfig ? 1 : 0}" } diff --git a/variables.tf b/variables.tf index 762a89a..45369c4 100644 --- a/variables.tf +++ b/variables.tf @@ -18,7 +18,7 @@ variable "cluster_version" { } variable "config_output_path" { - description = "Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory." + description = "Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. Should end in a forward slash / ." default = "./" } From 69d7a3ce4a5d51c91569b078947efdbd10e3b1eb Mon Sep 17 00:00:00 2001 From: Brandon O'Connor Date: Wed, 11 Jul 2018 23:47:35 -0700 Subject: [PATCH 19/19] releasing 1.3.0 --- CHANGELOG.md | 8 ++++++-- README.md | 4 ++-- main.tf | 2 +- 3 files changed, 9 insertions(+), 5 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b905aeb..7e21051 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,11 +9,11 @@ project adheres to [Semantic Versioning](http://semver.org/). ### Added -- Some excellent feature. (you're on fire, @me 🔥) +- A tiny but mighty feature. (you're on fire, @me 🔥) ### Changed -- A very thoughtful change. (Boomshakalaka, @self 🏀) +- A subtle but thoughtful change. (Boomshakalaka, @self 🏀) ## [[v1.3.0](https://github.com/terraform-aws-modules/terraform-aws-eks/compare/v1.2.0...v1.3.0)] - 2018-07-11] @@ -23,6 +23,10 @@ project adheres to [Semantic Versioning](http://semver.org/). - kubelet_node_labels worker group option allows setting --node-labels= in kubelet. (Hat-tip, @bshelton229 👒) - `worker_iam_role_arn` added to outputs. Sweet, @hatemosphere 🔥 +### Changed + +- Worker subnets able to be specified as a dedicated list per autoscaling group. (up top, @bshelton229 🙏) + ## [[v1.2.0](https://github.com/terraform-aws-modules/terraform-aws-eks/compare/v1.1.0...v1.2.0)] - 2018-07-01] ### Added diff --git a/README.md b/README.md index 45e6f36..788c906 100644 --- a/README.md +++ b/README.md @@ -63,7 +63,7 @@ Generate them like so: ```bash go get github.com/segmentio/terraform-docs -terraform-docs md ./ | cat -s | ghead -n -1 > README.md +terraform-docs md ./ | cat -s | tail -r | tail -n +2 | tail -r > README.md ``` ## Contributing @@ -97,7 +97,7 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | cluster_name | Name of the EKS cluster. Also used as a prefix in names of related resources. | string | - | yes | | cluster_security_group_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the workers and provide API access to your current IP/32. | string | `` | no | | cluster_version | Kubernetes version to use for the EKS cluster. | string | `1.10` | no | -| config_output_path | Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. | string | `./` | no | +| config_output_path | Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. Should end in a forward slash / . | string | `./` | no | | kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume. e.g. ["-r", "MyEksRole"]. | list | `` | no | | kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials. | string | `aws-iam-authenticator` | no | | kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator. e.g. { AWS_PROFILE = "eks"}. | map | `` | no | diff --git a/main.tf b/main.tf index 085c0c4..4cdb012 100644 --- a/main.tf +++ b/main.tf @@ -64,7 +64,7 @@ * ```bash * go get github.com/segmentio/terraform-docs -* terraform-docs md ./ | cat -s | ghead -n -1 > README.md +* terraform-docs md ./ | cat -s | tail -r | tail -n +2 | tail -r > README.md * ``` * ## Contributing