Commit Graph

420 Commits

Author SHA1 Message Date
Scott Crooks
7dc56e976b EKS 1.15 Support (#776)
* chore(eks): Support EKS 1.15

* docs(changelog): Adding entry to CHANGELOG

* chore(examples): Removing VPC tags from merged PR #772

* docs(changelog): Adding 'breaking' to CHANGELOG entry
2020-03-11 17:06:55 +01:00
Wolodja Wentland
23c005e5ef Add EKS Secret envelope encryption support (#772)
This adds support for configuring EKS clusters that utilise envelope
encryption for Secrets:

- https://aws.amazon.com/about-aws/whats-new/2020/03/amazon-eks-adds-envelope-encryption-for-secrets-with-aws-kms/

- https://aws.amazon.com/blogs/containers/using-eks-encryption-provider-support-for-defense-in-depth/
2020-03-11 12:26:06 +01:00
Thierno IB. BARRY
2715b01e4e fix max_instance_lifetime for workers (#771)
* fix max_instance_lifetime for workers

* update changelog

* update changelog
2020-03-10 22:01:01 +01:00
Arie Lev
f465e55721 Add ASG cooldown and health_check_grace_period (#770)
* Add default_cooldown/health_check oprions

* Update CHANGELOG.md

* Update CHANGELOG.md

Co-Authored-By: Thierno IB. BARRY <ibrahima.br@gmail.com>

Co-authored-by: Thierno IB. BARRY <ibrahima.br@gmail.com>
2020-03-10 11:20:11 +01:00
Siddarth Prakash
198294c0b6 Add support for ASG max instance lifetime (#769)
Co-authored-by: Thierno IB. BARRY <ibrahima.br@gmail.com>
2020-03-09 23:31:52 +01:00
Craig Rueda
6784824595 'root_encrypted' -> bool (#766) 2020-03-09 23:25:05 +01:00
Yecheng Fu
8382f2c4e8 use the correct policy arns if the region is in CN (#765) 2020-03-09 16:02:53 +01:00
Craig Rueda
276e41f744 Adding encrypted option to root_block_device of launch_configuration (#761)
* Adding encrypted option to root_block_device of launch_configuration

* Updating CHANGELOG.md

* Setting back to empty string
2020-03-06 12:54:12 +01:00
SW
81ded922c8 cluster-autoscaler shouldn't be scheduled on spot (#755)
* cluster-autoscaler shouldn't be scheduled on spot

Update documentation to schedule cluster-autoscaler on normal instances.

* Update CHANGELOG.md
2020-03-04 15:59:58 +01:00
Max Williams
908c656cf5 New release: v9.0.0 (#752)
* New release: v9.0.0

* Resolve comments from barryib
2020-02-27 13:26:13 +01:00
Igor Konforti
da53b5cab3 changing timeout (#736)
* change timeout

* Update README.md

Co-authored-by: Max Williams <max.williams@deliveryhero.com>
2020-02-27 11:41:41 +01:00
Andres De Castro
dda244994d Pin version for kubernetes provider across examples to exactly 1.10.0 (#735)
* Update README.md

* Update main.tf

* Update main.tf

* Update main.tf

* Update main.tf

* Update main.tf

* Update README.md

* Update README.md

* Update CHANGELOG.md

Co-authored-by: Max Williams <max.williams@deliveryhero.com>
2020-02-27 11:36:32 +01:00
Dawid Rogaczewski
3e44835172 change default value for wait_for_cluster_cmd (#750)
* change wait_for_cluster_cmd method

change default method for wait_for_cluster_cmd from curl to wget to solve https://github.com/terraform-aws-modules/terraform-aws-eks/issues/741

* Update CHANGELOG.md

* update docs

Co-authored-by: Max Williams <max.williams@deliveryhero.com>
2020-02-27 11:31:20 +01:00
Ryan Ooi
f2cc9f5039 Revert #631. Add back manage security group flag (#722)
* Revert #631

* fix README lint

* fix README lint for bool
2020-02-27 11:23:41 +01:00
Matthias Splieth
10ca272e5b Add option to set the name of a node group manually (#739) 2020-02-14 10:10:29 +01:00
Daniele Lisi
a9c73b277e Add iam:{Create,Delete}OpenIDProviderConnect to required IAM policies (#729) 2020-02-07 15:33:28 +01:00
ivanguravel
6c42d23c23 Detailed description for enabling Windows nodes for AWS EKS (#727)
* Update faq.md

detailed algorithm for building EKS cluster with Windows nodes

* small description fix

* Update docs/faq.md

Co-Authored-By: Max Williams <max.williams@deliveryhero.com>

* Update faq.md

* Update faq.md

* Update CHANGELOG.md

* Update docs/faq.md

Co-Authored-By: Max Williams <max.williams@deliveryhero.com>

* Update docs/faq.md

Co-Authored-By: Max Williams <max.williams@deliveryhero.com>

* Update docs/faq.md

Co-Authored-By: Max Williams <max.williams@deliveryhero.com>

* Update docs/faq.md

Co-Authored-By: Max Williams <max.williams@deliveryhero.com>

* Update CHANGELOG.md

Co-Authored-By: Max Williams <max.williams@deliveryhero.com>

Co-authored-by: Max Williams <max.williams@deliveryhero.com>
2020-02-06 17:46:38 +01:00
Daniele Lisi
415e123d93 Add iam:GetOpenIDConnectProvider grant to docs/iam-permissions.md (#728)
* Add iam:GetOpenIDConnectProvider grant to docs/iam-permissions.md

* Update CHANGELOG.md
2020-02-06 12:45:45 +01:00
Max Williams
626a393ab9 Remove of autoscaling IAM policy related stuff (#716)
* Disable management of autoscaling IAM policy by default

* remove completely

* update changelog notes

* fix pre-commit stuff

* misc updates

* fmt

* fix changelog

* Removal of tags and update docs

* Change after updating terraform-docs

* Add second tag
2020-02-04 19:34:17 +01:00
Thierno IB. BARRY
92b5c2ad3f bump pre-commit-terraform version (#724) 2020-01-30 15:50:56 +01:00
Max Williams
9032dce006 Add example for IRSA and cluster-autoscaler (#710)
* Add example for IRSA

* remove unused SGs

* remove helm setup part

* simplification and use module

* fix fmt error

* remove unused resource
2020-01-30 15:21:20 +01:00
Max Williams
cca389abab Switch Validate github action to use env vars (#718)
* Switch Validate github action to use env vars

* update changelog after release

* Update CHANGELOG.md

Co-Authored-By: Thierno IB. BARRY <ibrahima.br@gmail.com>

Co-authored-by: Thierno IB. BARRY <ibrahima.br@gmail.com>
2020-01-30 12:27:35 +01:00
Max Williams
dd06c591b5 New release v8.2.0 (#720) 2020-01-29 21:44:49 +01:00
Thierno IB. BARRY
065158a970 fix terraform pre-commit args for terraform-docs (#714)
* fix terraform pre-commit args for terraform-docs

* fix docs with terraform-docs 0.8.x

Signed-off-by: Thierno BARRY <thierno.barry@polyconseil.fr>

* resolve confliting filesx

* update homebrew formulas before install

* update changelog
2020-01-28 18:53:55 +01:00
Andrey Zhelnin
de90ff5d3a Don't create ingress rule if worker security group exists (#715) 2020-01-28 16:34:55 +01:00
Sanjeev Giri
905d9f05a9 Configurable local exec command for waiting until cluster is healthy (#701)
* Configurable local exec command for waiting until cluster is healthy

* readme

* line feeds

* format

* fix readme

* fix readme

* Configurable local exec command for waiting until cluster is healthy (#1)

* Configurable local exec command for waiting until cluster is healthy

* readme

* line feeds

* format

* fix readme

* fix readme

* change log

* Configurable local exec wait 4 cluster op (#2)

* Configurable local exec command for waiting until cluster is healthy

* readme

* line feeds

* format

* fix readme

* fix readme

* change log

* changelog (#3)

* Changelog (#4)

* changelog

* changelog

* simplify wait_for_cluster command

* readme

* no op for manage auth false

* formatting

* docs? not sure

* linter

* specify dependency to wait for cluster more accurately
2020-01-27 16:29:24 +01:00
xM8WVqaG
317b9481ad Update CHANGELOG.md (#695) 2020-01-17 17:35:06 +01:00
Max Williams
c9b9c96cfe new release v8.1.0 (#693) 2020-01-17 16:06:50 +01:00
David Alger
b3a90aac80 Ignore changes to desired_size of node_groups (#691)
* Ignore changes to desired_size of node_groups

Resolves #681

* Update CHANGELOG.md
2020-01-17 14:13:07 +01:00
Steffen Tautenhahn
0ee36d0aee Don't fail on destroy, when provider resource was removed (#667)
* Don't fail on destroy, when provider resource was removed

* Update Changelog

* Node groups submodule (#650)

* WIP Move node_groups to a submodule

* Split the old node_groups file up

* Start moving locals

* Simplify IAM creation logic

* depends_on from the TF docs

* Wire in the variables

* Call module from parent

* Allow to customize the role name. As per workers

* aws_auth ConfigMap for node_groups

* Get the managed_node_groups example to plan

* Get the basic example to plan too

* create_eks = false works

"The true and false result expressions must have consistent types. The
given expressions are object and object, respectively."
Well, that's useful. But apparently set(string) and set() are ok. So
everything else is more complicated. Thanks.

* Update Changelog

* Update README

* Wire in node_groups_defaults

* Remove node_groups from workers_defaults_defaults

* Synchronize random and node_group defaults

* Error: "name_prefix" cannot be longer than 32

* Update READMEs again

* Fix double destroy

Was producing index errors when running destroy on an empty state.

* Remove duplicate iam_role in node_group

I think this logic works. Needs some testing with an externally created
role.

* Fix index fail if node group manually deleted

* Keep aws_auth template in top module

Downside: count causes issues as usual: can't use distinct() in the
child module so there's a template render for every node_group even if
only one role is really in use. Hopefully just output noise instead of
technical issue

* Hack to have node_groups depend on aws_auth etc

The AWS Node Groups create or edit the aws-auth ConfigMap so that nodes
can join the cluster. This breaks the kubernetes resource which cannot
do a force create. Remove the race condition with explicit depend.

Can't pull the IAM role out of the node_group any more.

* Pull variables via the random_pet to cut logic

No point having the same logic in two different places

* Pass all ForceNew variables through the pet

* Do a deep merge of NG labels and tags

* Update README.. again

* Additional managed node outputs #644

Add change from @TBeijin from PR #644

* Remove unused local

* Use more for_each

* Remove the change when create_eks = false

* Make documentation less confusing

* node_group version user configurable

* Pass through raw output from aws_eks_node_groups

* Merge workers defaults in the locals

This simplifies the random_pet and aws_eks_node_group logic. Which was
causing much consernation on the PR.

* Fix typo

Co-authored-by: Max Williams <max.williams@deliveryhero.com>

* Update Changelog

* Add public access endpoint CIDRs option (terraform-aws-eks#647) (#673)

* Add public access endpoint CIDRs option (terraform-aws-eks#647)

* Update required provider version to 2.44.0

* Fix formatting in docs

* Re-generate docs with terraform-docs 0.7.0 and bump pre-commit-terraform version (#668)

* re-generate docs with terraform-docs 0.7.0

* bump pre-commit-terraform version

* Release 8.0.0 (#662)

* Release 8.0.0

* Update changelog

* remove 'defauls' node group

* Make curl silent

* Update Changelog

Co-authored-by: Daniel Piddock <33028589+dpiddockcmp@users.noreply.github.com>
Co-authored-by: Max Williams <max.williams@deliveryhero.com>
Co-authored-by: Siddarth Prakash <1428486+sidprak@users.noreply.github.com>
Co-authored-by: Thierno IB. BARRY <ibrahima.br@gmail.com>
2020-01-15 11:46:13 +01:00
Amit Thakkar
b70a828877 Correcting name of module (#666) 2020-01-15 08:05:10 +01:00
Thierno IB. BARRY
c5f50d5969 Re-generate docs with terraform-docs 0.7.0 and bump pre-commit-terraform version (#668)
* re-generate docs with terraform-docs 0.7.0

* bump pre-commit-terraform version
2020-01-13 14:39:59 +01:00
Siddarth Prakash
82aefb20f5 Add public access endpoint CIDRs option (terraform-aws-eks#647) (#673)
* Add public access endpoint CIDRs option (terraform-aws-eks#647)

* Update required provider version to 2.44.0

* Fix formatting in docs
2020-01-10 00:53:33 +01:00
Max Williams
a9db852d44 Release 8.0.0 (#662)
* Release 8.0.0

* Update changelog

* remove 'defauls' node group

* Make curl silent
2020-01-09 14:10:47 +01:00
Daniel Piddock
11147e9af3 Node groups submodule (#650)
* WIP Move node_groups to a submodule

* Split the old node_groups file up

* Start moving locals

* Simplify IAM creation logic

* depends_on from the TF docs

* Wire in the variables

* Call module from parent

* Allow to customize the role name. As per workers

* aws_auth ConfigMap for node_groups

* Get the managed_node_groups example to plan

* Get the basic example to plan too

* create_eks = false works

"The true and false result expressions must have consistent types. The
given expressions are object and object, respectively."
Well, that's useful. But apparently set(string) and set() are ok. So
everything else is more complicated. Thanks.

* Update Changelog

* Update README

* Wire in node_groups_defaults

* Remove node_groups from workers_defaults_defaults

* Synchronize random and node_group defaults

* Error: "name_prefix" cannot be longer than 32

* Update READMEs again

* Fix double destroy

Was producing index errors when running destroy on an empty state.

* Remove duplicate iam_role in node_group

I think this logic works. Needs some testing with an externally created
role.

* Fix index fail if node group manually deleted

* Keep aws_auth template in top module

Downside: count causes issues as usual: can't use distinct() in the
child module so there's a template render for every node_group even if
only one role is really in use. Hopefully just output noise instead of
technical issue

* Hack to have node_groups depend on aws_auth etc

The AWS Node Groups create or edit the aws-auth ConfigMap so that nodes
can join the cluster. This breaks the kubernetes resource which cannot
do a force create. Remove the race condition with explicit depend.

Can't pull the IAM role out of the node_group any more.

* Pull variables via the random_pet to cut logic

No point having the same logic in two different places

* Pass all ForceNew variables through the pet

* Do a deep merge of NG labels and tags

* Update README.. again

* Additional managed node outputs #644

Add change from @TBeijin from PR #644

* Remove unused local

* Use more for_each

* Remove the change when create_eks = false

* Make documentation less confusing

* node_group version user configurable

* Pass through raw output from aws_eks_node_groups

* Merge workers defaults in the locals

This simplifies the random_pet and aws_eks_node_group logic. Which was
causing much consernation on the PR.

* Fix typo

Co-authored-by: Max Williams <max.williams@deliveryhero.com>
2020-01-09 12:53:08 +01:00
Shaun Cutts
d79c8ab6f2 Wait cluster responsive (#639)
* wait for cluster to respond before creating auth config map

* adds changelog entry

* fixup tf format

* fixup kubernetes required version

* fixup missing local for kubeconfig_filename

* combine wait for cluster into provisioner on cluster; change status check to /healthz on endpoint

* fix: make kubernetes provider version more permissive
2020-01-07 12:28:56 +01:00
Thierno IB. BARRY
c17d17e2c2 add stale app (#657) 2020-01-03 23:12:41 +01:00
Eytan Hanig
ab412fb060 Add the OIDC provider ARN to outputs (#653) 2020-01-03 14:25:09 +01:00
Will Bertelsen
bad9604882 Fix aws-auth config map for managed node groups (#627)
* Fix aws-auth config map for managed node groups

This change adds the IAM role used for each managed node group to the
aws-auth config map. This fixes an issue where managed nodes could not
access the EKS kubernetes API server.

* update changelog

* fix format

* add comment

Co-authored-by: Max Williams <max.williams@deliveryhero.com>
2019-12-20 17:30:40 +01:00
Mukesh Gupta
7c8bcc967b Adding node group iam role arns to outputs (#641) 2019-12-20 16:50:29 +01:00
Ryan Ooi
b7ffc1b591 Control plane security group always whitelist worker security group and revert #186 (#631)
* Updates and revert #186

* update readme

* update changelog

* update changelog
2019-12-20 16:45:01 +01:00
Alaa Qutaish
583c32d286 Add IRSA support (#632) 2019-12-19 16:38:12 +01:00
chewvader
77f947ec91 Cluster oidc issuer url string (#626)
* cluster_oidc_issuer_url to string

change cluster_oidc_issuer_url output to return string

* Update CHANGELOG.md

adding entry to changelog

* Update outputs.tf

Co-Authored-By: Daniel Piddock <33028589+dpiddockcmp@users.noreply.github.com>
2019-12-12 17:44:45 +01:00
Jeff Hastings
11d8ee8631 Fix idempotency with node group remote_access block (#625)
* add kubernetes provider configuration for managed_node_groups example

* use dynamic block for remote_access

* update changelog
2019-12-11 17:50:09 +01:00
Max Williams
7824e8b263 Creating 7.0.1 release (#630) 2019-12-11 17:23:48 +01:00
Daniel Piddock
45a39a098f Minor tweaks to changelog (#629)
* Tweaks to changelog

* Fix examples link

Existing one does not work.
This is a permanent link to maintain the upgrade hints path
2019-12-11 17:08:33 +01:00
Tomislav Tomašić
124ea7c151 Add destroy time flag (#580)
* Add destroy-time flag

* Update changelog

Fix cluster count

* Fix cluster count

* Fix docs

* Fix outputs

* Fix unsupported attribute on cluster_certificate_authority_data output

Co-Authored-By: Daniel Piddock <33028589+dpiddockcmp@users.noreply.github.com>

* Remove unnecessary flatten from cluster_endpoint output

Co-Authored-By: Daniel Piddock <33028589+dpiddockcmp@users.noreply.github.com>

* Improve description of var.enabled

* Fix errors manifesting when used on an existing-cluster

* Update README.md

* Renamed destroy-time flag

* Revert removal of changelog addition entry

* Update flag name in readme

* Update flag variable name

* Update cluster referencing for consistency

* Update flag name to `create_eks`

* Fixed incorrect count-based reference to aws_eks_cluster.this (there's only one)

* Replaced all incorrect aws_eks_cluster.this[count.index] references (there will be just one, so using '[0]').

* Changelog update, explicitly mentioning flag

* Fixed interpolation deprecation warning

* Fixed outputs to support conditional cluster

* Applied create_eks to aws_auth.tf

* Removed unused variable. Updated Changelog. Formatting.

* Fixed references to aws_eks_cluster.this[0] that would raise errors when setting create_eks to false whilst having launch templates or launch configurations configured.

* Readme and example updates.

* Revert "Readme and example updates."

This reverts commit 18a0746355e136010ad54858a1b518406f6a3638.

* Updated readme section of conditionally creation with provider example.

* Added conditions to node_groups.

* Fixed reversed map_roles check

* Update aws_auth.tf

Revert this due to https://github.com/terraform-aws-modules/terraform-aws-eks/pull/611
2019-12-09 10:06:10 +01:00
Daniel Piddock
7c2c4a6aa5 Bump minimum Terraform to 0.12.9 (#617) 2019-12-09 09:59:26 +01:00
Shan K
143642fda8 remove empty [] to mapRoles in aws-auth (revised) (#619) 2019-12-09 09:56:55 +01:00
Shan K
fb61b48c26 Fix PR merge: #606 (#611)
* Update aws_auth.tf

* aws-auth config map
2019-12-05 16:54:13 +01:00