mirror of
https://github.com/ysoftdevs/terraform-aws-eks.git
synced 2026-01-19 10:08:00 +01:00
59 lines
1.7 KiB
HCL
59 lines
1.7 KiB
HCL
module "iam_assumable_role_admin" {
|
|
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
|
|
version = "3.6.0"
|
|
|
|
create_role = true
|
|
role_name = "cluster-autoscaler"
|
|
provider_url = replace(module.eks.cluster_oidc_issuer_url, "https://", "")
|
|
role_policy_arns = [aws_iam_policy.cluster_autoscaler.arn]
|
|
oidc_fully_qualified_subjects = ["system:serviceaccount:${local.k8s_service_account_namespace}:${local.k8s_service_account_name}"]
|
|
}
|
|
|
|
resource "aws_iam_policy" "cluster_autoscaler" {
|
|
name_prefix = "cluster-autoscaler"
|
|
description = "EKS cluster-autoscaler policy for cluster ${module.eks.cluster_id}"
|
|
policy = data.aws_iam_policy_document.cluster_autoscaler.json
|
|
}
|
|
|
|
data "aws_iam_policy_document" "cluster_autoscaler" {
|
|
statement {
|
|
sid = "clusterAutoscalerAll"
|
|
effect = "Allow"
|
|
|
|
actions = [
|
|
"autoscaling:DescribeAutoScalingGroups",
|
|
"autoscaling:DescribeAutoScalingInstances",
|
|
"autoscaling:DescribeLaunchConfigurations",
|
|
"autoscaling:DescribeTags",
|
|
"ec2:DescribeLaunchTemplateVersions",
|
|
]
|
|
|
|
resources = ["*"]
|
|
}
|
|
|
|
statement {
|
|
sid = "clusterAutoscalerOwn"
|
|
effect = "Allow"
|
|
|
|
actions = [
|
|
"autoscaling:SetDesiredCapacity",
|
|
"autoscaling:TerminateInstanceInAutoScalingGroup",
|
|
"autoscaling:UpdateAutoScalingGroup",
|
|
]
|
|
|
|
resources = ["*"]
|
|
|
|
condition {
|
|
test = "StringEquals"
|
|
variable = "autoscaling:ResourceTag/k8s.io/cluster-autoscaler/${module.eks.cluster_id}"
|
|
values = ["owned"]
|
|
}
|
|
|
|
condition {
|
|
test = "StringEquals"
|
|
variable = "autoscaling:ResourceTag/k8s.io/cluster-autoscaler/enabled"
|
|
values = ["true"]
|
|
}
|
|
}
|
|
}
|