mirror of
https://github.com/ysoftdevs/terraform-aws-eks.git
synced 2026-01-17 00:57:28 +01:00
7ffe5fa88f
* fix: Work around path bug in aws-iam-authenticator `aws-iam-authenticator` has an open issue where it will not recognize IAM roles that include paths. This change causes the path supplied to `var.iam_path` to be stripped when generating the `aws-auth` ConfigMap in order to work around this. https://github.com/kubernetes-sigs/aws-iam-authenticator/issues/153 https://github.com/aws/containers-roadmap/issues/926
84 lines
2.5 KiB
HCL
84 lines
2.5 KiB
HCL
data "aws_caller_identity" "current" {
|
|
}
|
|
|
|
locals {
|
|
auth_launch_template_worker_roles = [
|
|
for index in range(0, var.create_eks ? local.worker_group_launch_template_count : 0) : {
|
|
worker_role_arn = "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:role/${element(
|
|
coalescelist(
|
|
aws_iam_instance_profile.workers_launch_template.*.role,
|
|
data.aws_iam_instance_profile.custom_worker_group_launch_template_iam_instance_profile.*.role_name,
|
|
[""]
|
|
),
|
|
index
|
|
)}"
|
|
platform = lookup(
|
|
var.worker_groups_launch_template[index],
|
|
"platform",
|
|
local.workers_group_defaults["platform"]
|
|
)
|
|
}
|
|
]
|
|
|
|
auth_worker_roles = [
|
|
for index in range(0, var.create_eks ? local.worker_group_count : 0) : {
|
|
worker_role_arn = "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:role/${element(
|
|
coalescelist(
|
|
aws_iam_instance_profile.workers.*.role,
|
|
data.aws_iam_instance_profile.custom_worker_group_iam_instance_profile.*.role_name,
|
|
[""]
|
|
),
|
|
index,
|
|
)}"
|
|
platform = lookup(
|
|
var.worker_groups[index],
|
|
"platform",
|
|
local.workers_group_defaults["platform"]
|
|
)
|
|
}
|
|
]
|
|
|
|
# Convert to format needed by aws-auth ConfigMap
|
|
configmap_roles = [
|
|
for role in concat(
|
|
local.auth_launch_template_worker_roles,
|
|
local.auth_worker_roles,
|
|
module.node_groups.aws_auth_roles,
|
|
) :
|
|
{
|
|
# Work around https://github.com/kubernetes-sigs/aws-iam-authenticator/issues/153
|
|
# Strip the leading slash off so that Terraform doesn't think it's a regex
|
|
rolearn = replace(role["worker_role_arn"], replace(var.iam_path, "/^//", ""), "")
|
|
username = "system:node:{{EC2PrivateDNSName}}"
|
|
groups = tolist(concat(
|
|
[
|
|
"system:bootstrappers",
|
|
"system:nodes",
|
|
],
|
|
role["platform"] == "windows" ? ["eks:kube-proxy-windows"] : []
|
|
))
|
|
}
|
|
]
|
|
}
|
|
|
|
resource "kubernetes_config_map" "aws_auth" {
|
|
count = var.create_eks && var.manage_aws_auth ? 1 : 0
|
|
depends_on = [null_resource.wait_for_cluster[0]]
|
|
|
|
metadata {
|
|
name = "aws-auth"
|
|
namespace = "kube-system"
|
|
}
|
|
|
|
data = {
|
|
mapRoles = yamlencode(
|
|
distinct(concat(
|
|
local.configmap_roles,
|
|
var.map_roles,
|
|
))
|
|
)
|
|
mapUsers = yamlencode(var.map_users)
|
|
mapAccounts = yamlencode(var.map_accounts)
|
|
}
|
|
}
|