diff --git a/.github/workflows/pre-commit.yaml b/.github/workflows/pre-commit.yaml new file mode 100644 index 0000000..573f90d --- /dev/null +++ b/.github/workflows/pre-commit.yaml @@ -0,0 +1,65 @@ +name: pre-commit + +on: + workflow_dispatch: + pull_request: + branches: + - main + - master + +permissions: + contents: read + +concurrency: + group: pre-commit-${{ github.ref }} + cancel-in-progress: false + +env: + # renovate: datasource=github-releases depName=asdf-vm/asdf + ASDF_VERSION: 31e8c93004abd76253d186b8896785895069749b # v0.15.0 # pragma: allowlist secret + +jobs: + pre-commit: + runs-on: ubuntu-24.04 + steps: + - name: Checkout + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + + - name: Setup ASDF + uses: asdf-vm/actions/setup@05e0d2ed97b598bfce82fd30daf324ae0c4570e6 # v3.0.2 + + - name: Cache ASDF + uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 + id: asdf-cache + with: + # https://github.com/asdf-vm/asdf/blob/master/.gitignore + path: | + ~/.asdf/installs + ~/.asdf/plugins + ~/.asdf/shims + key: ${{ runner.os }}-asdf-${{ hashFiles('.tool-versions') }} + restore-keys: ${{ runner.os }}-asdf- + + - name: Install ASDF + uses: asdf-vm/actions/install@05e0d2ed97b598bfce82fd30daf324ae0c4570e6 # v3.0.2 + if: ${{ steps.asdf-cache.outputs.cache-hit != 'true' }} + with: + asdf_branch: ${{ env.ASDF_VERSION }} + + - name: Reshim installed ASDF tools + shell: bash + run: asdf reshim + + - name: Cache pip + uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 + with: + path: ~/.cache/pip/ + key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements*.txt', '.pre-commit-config.yaml') }} + restore-keys: | + ${{ runner.os }}-pip- + + - name: Install pip dependencies + run: pip install -r requirements.txt + + - name: Run pre-commit + run: pre-commit run --show-diff-on-failure --color=always --all-files diff --git a/.github/workflows/release-drafter.yaml b/.github/workflows/release-drafter.yaml new file mode 100644 index 0000000..67303c3 --- /dev/null +++ b/.github/workflows/release-drafter.yaml @@ -0,0 +1,28 @@ +name: Release drafter + +on: + push: + branches: + - main + - master + + pull_request: + types: + - opened + - reopened + - synchronize + - labeled + +permissions: + contents: write + pull-requests: read + +jobs: + release-drafter: + runs-on: ubuntu-24.04 + steps: + - uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6.1.0 + with: + config-name: RELEASE_DRAFTER.yml + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/template-sync.yaml b/.github/workflows/template-sync.yaml new file mode 100644 index 0000000..025d2d2 --- /dev/null +++ b/.github/workflows/template-sync.yaml @@ -0,0 +1,95 @@ +name: Template sync + +on: + workflow_dispatch: + schedule: + - cron: '0 0 * * *' # every day at midnight + +permissions: {} + +concurrency: + group: pre-commit + cancel-in-progress: false + +env: + # renovate: datasource=github-releases depName=asdf-vm/asdf + ASDF_VERSION: 31e8c93004abd76253d186b8896785895069749b # v0.15.0 # pragma: allowlist secret + +jobs: + universal-addon: + if: github.repository != 'lablabs/terraform-aws-eks-universal-addon' + runs-on: ubuntu-24.04 + steps: + - name: Generate GitHub App token + id: template-sync-app-token + uses: actions/create-github-app-token@3ff1caaa28b64c9cc276ce0a02e2ff584f3900c5 # v2.0.2 + with: + app-id: ${{ secrets.LARA_TEMPLATE_SYNC_APP_ID }} + private-key: ${{ secrets.LARA_TEMPLATE_SYNC_APP_PRIVATE_KEY }} + repositories: ${{ github.event.repository.name }} + owner: ${{ github.repository_owner }} + + - name: Checkout + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + token: ${{ steps.template-sync-app-token.outputs.token }} # needed for private repositories + + - name: Sync universal-addon template + uses: AndreasAugustin/actions-template-sync@bcb94410a4f1dffdfe5eaabc8234c3b8e76ebc5b # v2.5.1 + with: + source_gh_token: ${{ steps.template-sync-app-token.outputs.token }} + source_repo_path: lablabs/terraform-aws-eks-universal-addon + upstream_branch: main + + target_gh_token: ${{ steps.template-sync-app-token.outputs.token }} + + git_remote_pull_params: --allow-unrelated-histories --squash --strategy=recursive --no-tags -X theirs + + pr_labels: kind/sync + pr_branch_name_prefix: "feat/universal-addon-sync" + pr_title: "feat(sync): sync universal-addon changes" + pr_commit_msg: "feat(sync): sync universal-addon changes" + + is_pr_cleanup: true + + - name: Setup ASDF + uses: asdf-vm/actions/setup@05e0d2ed97b598bfce82fd30daf324ae0c4570e6 # v3.0.2 + + - name: Cache ASDF + uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 + id: asdf-cache + with: + # https://github.com/asdf-vm/asdf/blob/master/.gitignore + path: | + ~/.asdf/installs + ~/.asdf/plugins + ~/.asdf/shims + key: ${{ runner.os }}-asdf-${{ hashFiles('.tool-versions') }} + restore-keys: ${{ runner.os }}-asdf- + + - name: Install ASDF + uses: asdf-vm/actions/install@05e0d2ed97b598bfce82fd30daf324ae0c4570e6 # v3.0.2 + if: ${{ steps.asdf-cache.outputs.cache-hit != 'true' }} + with: + asdf_branch: ${{ env.ASDF_VERSION }} + + - name: Reshim installed ASDF tools + shell: bash + run: asdf reshim + + - name: Cache pip + uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 + with: + path: ~/.cache/pip/ + key: ${{ runner.os }}-pip-${{ hashFiles('.pre-commit-config.yaml') }} + restore-keys: | + ${{ runner.os }}-pip- + + - name: Update README.md + run: pre-commit run --show-diff-on-failure --color=always terraform_docs --all-files || true + + - name: Commit and push README.md + uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9.1.4 + with: + add: README.md + message: "docs: update README.md" diff --git a/.github/workflows/validate.yaml b/.github/workflows/validate.yaml index 2b9e3e7..cfac965 100644 --- a/.github/workflows/validate.yaml +++ b/.github/workflows/validate.yaml @@ -11,42 +11,41 @@ on: - master jobs: - versionExtract: + extract-version: name: Extract min/max Terraform versions - runs-on: ubuntu-22.04 + runs-on: ubuntu-24.04 steps: - name: Checkout - uses: actions/checkout@v3 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Extract Terraform min/max versions - id: minMax - uses: clowdhaus/terraform-min-max@main + id: terraform-min-max + uses: clowdhaus/terraform-min-max@f489335873df04c3ce04b5e73f385a726d910039 # v1.3.2 with: directory: . outputs: - minVersion: ${{ steps.minMax.outputs.minVersion }} - maxVersion: ${{ steps.minMax.outputs.maxVersion }} + minVersion: ${{ steps.terraform-min-max.outputs.minVersion }} + maxVersion: ${{ steps.terraform-min-max.outputs.maxVersion }} terraform-validate: - runs-on: ubuntu-22.04 - needs: versionExtract + runs-on: ubuntu-24.04 + needs: extract-version strategy: matrix: tf_ver: - - ${{ needs.versionExtract.outputs.minVersion }} - - ${{ needs.versionExtract.outputs.maxVersion }} - + - ${{ needs.extract-version.outputs.minVersion }} + - ${{ needs.extract-version.outputs.maxVersion }} steps: - - uses: actions/checkout@v3 - - uses: hashicorp/setup-terraform@v2 - with: - terraform_version: ${{ matrix.tf_ver }} - - - name: Terraform Init - id: init - run: terraform init - - - name: Terraform Validate - id: validate - run: terraform validate + - name: Checkout + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + + - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2 + with: + terraform_version: ${{ matrix.tf_ver }} + + - name: Terraform Init + run: terraform init + + - name: Terraform Validate + run: terraform validate diff --git a/.gitignore b/.gitignore index dd32dc8..18221f8 100644 --- a/.gitignore +++ b/.gitignore @@ -32,5 +32,3 @@ override.tf.json # Ignore CLI configuration files .terraformrc terraform.rc - -.terraform.lock.hcl diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 18025ae..dee312a 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,32 +1,49 @@ repos: - repo: https://github.com/pre-commit/pre-commit-hooks - rev: v4.4.0 + rev: v5.0.0 hooks: - id: trailing-whitespace + args: ["--markdown-linebreak-ext=md"] - id: check-merge-conflict - id: detect-aws-credentials - args: ['--allow-missing-credentials'] + args: ["--allow-missing-credentials"] - id: detect-private-key - id: end-of-file-fixer - repo: https://github.com/antonbabenko/pre-commit-terraform - rev: v1.83.1 + rev: v1.96.3 hooks: - - id: terraform_fmt - - id: terraform_tflint - args: - - --args=--config=__GIT_WORKING_DIR__/.tflint.hcl - - id: terraform_validate - - id: terraform_checkov - args: - - '--args=--skip-check CKV_TF_1' #CKV_TF_1: "Ensure Terraform module sources use a commit hash" - - id: terraform_docs - args: - - '--args=--config=.terraform-docs.yml' + - id: terraform_validate + - id: terraform_fmt + - id: terraform_providers_lock + args: + - --hook-config=--mode=only-check-is-current-lockfile-cross-platform + - --args=-platform=darwin_amd64 + - --args=-platform=darwin_arm64 + - --args=-platform=linux_amd64 + - id: terraform_tflint + args: + - --args=--config=__GIT_WORKING_DIR__/.tflint.hcl + - id: terraform_checkov + args: + - "--args=--quiet --skip-check CKV_TF_1" #CKV_TF_1: "Ensure Terraform module sources use a commit hash" + - id: terraform_docs + args: + - "--args=--config=.terraform-docs.yml" - repo: https://github.com/Yelp/detect-secrets - rev: v1.4.0 + rev: v1.5.0 hooks: - id: detect-secrets - args: ['--baseline', '.secrets.baseline'] + args: ["--baseline", ".secrets.baseline"] exclude: terraform.tfstate + + - repo: local + hooks: + - id: sync-variables + name: Sync module variables + entry: ./scripts/sync-variables.py + language: system + types: [python] + always_run: true + pass_filenames: false diff --git a/.secrets.baseline b/.secrets.baseline index eaf7047..45f65d3 100644 --- a/.secrets.baseline +++ b/.secrets.baseline @@ -1,5 +1,5 @@ { - "version": "1.3.0", + "version": "1.5.0", "plugins_used": [ { "name": "ArtifactoryDetector" @@ -20,9 +20,15 @@ { "name": "CloudantDetector" }, + { + "name": "DiscordBotTokenDetector" + }, { "name": "GitHubTokenDetector" }, + { + "name": "GitLabTokenDetector" + }, { "name": "HexHighEntropyString", "limit": 3.0 @@ -33,6 +39,9 @@ { "name": "IbmCosHmacDetector" }, + { + "name": "IPPublicDetector" + }, { "name": "JwtTokenDetector" }, @@ -46,9 +55,15 @@ { "name": "NpmDetector" }, + { + "name": "OpenAIDetector" + }, { "name": "PrivateKeyDetector" }, + { + "name": "PypiTokenDetector" + }, { "name": "SendGridDetector" }, @@ -64,6 +79,9 @@ { "name": "StripeDetector" }, + { + "name": "TelegramBotTokenDetector" + }, { "name": "TwilioKeyDetector" } @@ -109,5 +127,5 @@ } ], "results": {}, - "generated_at": "2022-07-28T10:50:47Z" + "generated_at": "2025-03-28T07:59:49Z" } diff --git a/.templatesyncignore b/.templatesyncignore new file mode 100644 index 0000000..7901ba9 --- /dev/null +++ b/.templatesyncignore @@ -0,0 +1,10 @@ +modules +examples/basic/main.tf +main.tf +variables.tf +README.md +.secrets.baseline +.github/workflows/renovate.yaml +renovate.json +addon-oidc.tf +variables-addon-oidc.tf diff --git a/.terraform-docs.yml b/.terraform-docs.yml index cb998c2..d45d422 100644 --- a/.terraform-docs.yml +++ b/.terraform-docs.yml @@ -1,11 +1,28 @@ formatter: markdown table +header-from: main.tf +footer-from: docs/.footer.md + +content: |- + {{ .Header }} + {{ include "docs/.addon.md" }} + {{ .Requirements }} + {{ .Providers }} + {{ .Modules }} + {{ .Resources }} + {{ include "docs/.inputs.md" }} + {{ .Inputs }} + {{ .Outputs }} + {{ .Footer }} + output: - mode: inject + file: README.md + mode: replace template: |- - + {{ .Content }} - + + {{- printf "\n" -}} sections: hide: @@ -13,3 +30,7 @@ sections: sort: by: required + +settings: + default: false + required: false diff --git a/.terraform.lock.hcl b/.terraform.lock.hcl new file mode 100644 index 0000000..a1b3c67 --- /dev/null +++ b/.terraform.lock.hcl @@ -0,0 +1,99 @@ +# This file is maintained automatically by "terraform init". +# Manual edits may be lost in future updates. + +provider "registry.terraform.io/cloudposse/utils" { + version = "1.19.2" + constraints = ">= 0.17.0" + hashes = [ + "h1:0Ch7BTulKB1jXOm0AV7d5f1bdMKEyZc1BA+PZ6cXkAY=", + "h1:gqYR81ADrA9HeWCMnEOg/x9RIMce6dwOXOC/DxjsYto=", + "h1:yy3kB4scsoyM81yyyUMPxuJXeFvexBL5KMrCKrjrUkE=", + "h1:zeLrxuXDYEA5+hArYpigYKZJiIB57WQ3nn7VGTc0QDc=", + "zh:1002d1c3f458b569119b31eb2f732c093922b7f86aa59d999d77c3f3ca297f53", + "zh:367ca0d95bf24db1ff6632da94affe1ac0b51679e00f6ca3f1b8f927b9724c3b", + "zh:3e48ef23e276d18a88405926f39b476d40fb543859f2fcfc316f70501071c1ed", + "zh:3fe9d58ee267423e65c9c52cb486dda1eb59973f42eea9d84fe4c842108fdb73", + "zh:5e9ee6099ee56c30c3dfec935f749b3cef9ad2d4c6d8ad2cf39ee87587fc496d", + "zh:6babf986f8af41c739f1e441a4c0512262ff8bc36892f9506839b126138fce25", + "zh:6d9e659f1e18e409149ed8090ced8894317f37cdf234b34fe86b5aba354d559b", + "zh:828109b900c0fa9240bd48358423034817ab3a81d706b29d84a0e10401766ae4", + "zh:aff0d59c6ba5713a09e11a4f14dad048d787569e92ed4d6aa4b7778d39f52d31", + "zh:b7f469e47d1f94b276590809388ac216f59e1f4fb2d6b950c3f9fcbe9e4e2161", + "zh:b9003915fcbdd74c9e02ba11935daa6110516bf434bfee58f738ae3f2a595c2b", + "zh:dea118d95fe434b9089321e6db7573a882bd8b36d89fe2527e9adefa538561e1", + "zh:e18ef6d2be2cee7b8d0ac03c5eec362fd132c8f2b48da3999a280a4d778ec6ea", + "zh:f317eb941a57e6a899afa44ed6dc12a5c51228fcdf1b3043823346f3887facc9", + ] +} + +provider "registry.terraform.io/hashicorp/aws" { + version = "5.42.0" + constraints = "~> 5.0" + hashes = [ + "h1:0lkSSlK45Qil9fO1kFy8RXVC/k6qfC4LDZIaCKnWcUc=", + "h1:Gwe5HXZYD/3M5j6LwKhp8amb1SraCR9p+G96d381RVc=", + "h1:Wjmg0WFQxZ7J7OeZ/SY+NW4JRe/jKJEut5tVb51z++4=", + "h1:Yxsj34z606m8wssYDHyleuBlQ9i+94MHwRs38thQPZU=", + "zh:0fb12bd56a3ad777b29f957c56dd2119776dbc01b6074458f597990e368c82de", + "zh:16e99c13bef6e3777f67c240c916f57c01c9c142254cfb2720e08281ff906447", + "zh:218268f5fe73bcb19e9a996f781ab66df0da9e333d1c60612e3c51ad28a5105f", + "zh:220b17f7053d11548f35136669687d30ef1f1036e15393275325fd2b9654c715", + "zh:2256cfd74988ce05eada76b42efffc6fe2bf4d60b61f57e4db4fcf65ced4c666", + "zh:52da19f531e0cb9828f73bca620e30264e63a494bd7f9ce826aabcf010d3a241", + "zh:56069ce08d720280ba39aaf2fdd40c4357ffb54262c80e4d39c4e540a38e76af", + "zh:82c81398e68324029167f813fbb7c54fa3d233e99fa05001d85cbce8bdd08bb3", + "zh:82d6eaa87f5ab318959064e6c89adc2baabaf70b13f2f7de866f62416de05352", + "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", + "zh:ade8490cfdd8de8b9a82986588595b67e0ad1048d9e2d3a6f5164320179c2cd0", + "zh:b094ef56ae9bfffd586f46d4f7fb0097798738df758a8f3c51578ee163495c7e", + "zh:bd5e68e1e454bae0f8d73cff8448e814a35855a561c33b745e1b8b525fb06c9f", + "zh:c111c6a854bf121facca1642d528bfa80fb4214554ac6c33e4a59c86bc605b71", + "zh:e04df69a557adbcdf8efc77eb45be748f0acbe800ccede1e0895393c87722a0f", + ] +} + +provider "registry.terraform.io/hashicorp/helm" { + version = "2.12.1" + constraints = ">= 2.6.0" + hashes = [ + "h1:7wfYOAeSEchHB8idNl+2jf+OkFi9zFSOLWkEZFuTCik=", + "h1:aBfcqM4cbywa7TAxfT1YoFS+Cst9waerlm4XErFmJlk=", + "h1:sgYI7lwGqJqPopY3NGmhb1eQ0YbH8PIXaAZAmnJrAvw=", + "h1:xwHVa6ab/XVfDrZ3h35OzLJ6g0Zte4VAvSnyKw3f9AI=", + "zh:1d623fb1662703f2feb7860e3c795d849c77640eecbc5a776784d08807b15004", + "zh:253a5bc62ba2c4314875139e3fbd2feaad5ef6b0fb420302a474ab49e8e51a38", + "zh:282358f4ad4f20d0ccaab670b8645228bfad1c03ac0d0df5889f0aea8aeac01a", + "zh:4fd06af3091a382b3f0d8f0a60880f59640d2b6d9d6a31f9a873c6f1bde1ec50", + "zh:6816976b1830f5629ae279569175e88b497abbbac30ee809948a1f923c67a80d", + "zh:7d82c4150cdbf48cfeec867be94c7b9bd7682474d4df0ebb7e24e148f964844f", + "zh:83f062049eea2513118a4c6054fb06c8600bac96196f25aed2cc21898ec86e93", + "zh:a79eec0cf4c08fca79e44033ec6e470f25ff23c3e2c7f9bc707ed7771c1072c0", + "zh:b2b2d904b2821a6e579910320605bc478bbef063579a23fbfdd6fcb5871b81f8", + "zh:e91177ca06a15487fc570cb81ecef6359aa399459ea2aa7c4f7367ba86f6fcad", + "zh:e976bcb82996fc4968f8382bbcb6673efb1f586bf92074058a232028d97825b1", + "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c", + ] +} + +provider "registry.terraform.io/hashicorp/kubernetes" { + version = "2.27.0" + constraints = ">= 2.20.0" + hashes = [ + "h1:/3kLyOR2jTaWS1MKso4xAztrocGBMxi8yVadWiqSWOg=", + "h1:GzU0FzYAT/+IgAhnSBcFH3bT+4I5N6oSga6iZgNJAus=", + "h1:TrlG/sofnDv8kAbzKOD5pIPeUiI5VQY61NuWH+cItDw=", + "h1:WuU4rl7szPJr9Nfu5OoQGF84k8yQf+gmS9zU2eZuxcc=", + "zh:3bdba30ae67c55dc7e9a317ac0da3b208ea7926fe9c2f0ae6587ee88dcc58d1f", + "zh:3f35138a831c00b188d2ffee27111dd0cf59afad2dd5653ed9e67d59646de12c", + "zh:64066d18f6ae9a316c2bc840ef3e641d7ab94e1ea3a41d12523e77345ad442ef", + "zh:653063d44b44881af3a480f7f8eaa94fa300e0229df2072d30f606bddcc9f025", + "zh:87f306e37efb61d13efa6da53a1e45e97e5996ebc0568b1caf8c3c5e54c05809", + "zh:8c428b9708f9634391e52300218771eab3fe942bb1295d8c0ad50ca4b33db3d9", + "zh:a44e87119a0337ded15479851786a13f412b413d9a463ba550d1210249206b0f", + "zh:aa2c4d110b0de6ef997c0d45f3f23f8a98f5530753095d6eff439a6d91a8ea31", + "zh:eb15ed8781ac6a0dec2f7d03cf090e23cfa05e3225806c6231ff2c574662fd63", + "zh:eb81c563f93bd3303f9620d11cd49f21f3f89ac3475c6d3e821b239feb9c217d", + "zh:f1a344a7f16131123577e4ec994d04a34ea458ec16c1ccac53fe7946bd817b18", + "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c", + ] +} diff --git a/.tflint.hcl b/.tflint.hcl index 543ca2b..81011f8 100644 --- a/.tflint.hcl +++ b/.tflint.hcl @@ -1,12 +1,12 @@ plugin "terraform" { enabled = true - version = "0.4.0" + version = "0.6.0" source = "github.com/terraform-linters/tflint-ruleset-terraform" preset = "recommended" } plugin "aws" { enabled = true - version = "0.26.0" + version = "0.30.0" source = "github.com/terraform-linters/tflint-ruleset-aws" } diff --git a/.tool-versions b/.tool-versions new file mode 100644 index 0000000..4b3cb3d --- /dev/null +++ b/.tool-versions @@ -0,0 +1,10 @@ +terraform 1.5.7 +terraform-docs 0.19.0 +tflint 0.50.3 +checkov 3.2.352 +awscli 2.25.10 +pre-commit 4.2.0 +python 3.13.2 + +# added by mhs +kubectl 1.30.9 diff --git a/README.md b/README.md index c198ede..1fe464b 100644 --- a/README.md +++ b/README.md @@ -1,164 +1,173 @@ -# AWS EKS load balancer controller Terraform module - -[](https://lablabs.io/) + +# AWS EKS Load Balancer Controller Terraform module +A Terraform module to deploy the AWS Load Balancer Controller on Amazon EKS cluster. -We help companies build, run, deploy and scale software and infrastructure by embracing the right technologies and principles. Check out our website at +[![Terraform validate](https://github.com/lablabs/terraform-aws-eks-load-balancer-controller/actions/workflows/validate.yaml) +[![pre-commit](https://github.com/lablabs/terraform-aws-eks-load-balancer-controller/actions/workflows/pre-commit.yml) --- -[![Terraform validate](https://github.com/lablabs/terraform-aws-eks-load-balancer-controller/actions/workflows/validate.yaml/badge.svg)](https://github.com/lablabs/terraform-aws-eks-load-balancer-controller/actions/workflows/validate.yaml) -[![pre-commit](https://github.com/lablabs/terraform-aws-eks-load-balancer-controller/actions/workflows/pre-commit.yml/badge.svg)](https://github.com/lablabs/terraform-aws-eks-load-balancer-controller/actions/workflows/pre-commit.yml) - -## Description +## Related Projects -A terraform module to deploy the AWS load balancer controller on Amazon EKS cluster. +Check out other [Terraform Kubernetes addons](https://github.com/orgs/lablabs/repositories?q=terraform-aws-eks&type=public&language=&sort=). -## Related Projects +[](https://lablabs.io/) -Check out other [terraform kubernetes addons](https://github.com/orgs/lablabs/repositories?q=terraform-aws-eks&type=public&language=&sort=). +We help companies build, run, deploy and scale software and infrastructure by embracing the right technologies and principles. Check out our website at . ## Deployment methods ### Helm -Deploy helm chart by helm (default method, set `enabled = true`) - -### Argo kubernetes -Deploy helm chart as argo application by kubernetes manifest (set `enabled = true` and `argo_enabled = true`) - -### Argo helm -When deploying with ArgoCD application, Kubernetes terraform provider requires access to Kubernetes cluster API during plan time. This introduces potential issue when you want to deploy the cluster with this addon at the same time, during the same Terraform run. +Deploy Helm chart via Helm resource (default method, set `enabled = true`) -To overcome this issue, the module deploys the ArgoCD application object using the Helm provider, which does not require API access during plan. If you want to deploy the application using this workaround, you can set the `argo_helm_enabled` variable to `true`. +### Argo Kubernetes +Deploy Helm chart as ArgoCD Application via Kubernetes manifest resource (set `enabled = true` and `argo_enabled = true`) -Create helm release resource and deploy it as argo application (set `enabled = true`, `argo_enabled = true` and `argo_helm_enabled = true`) +> **Warning** +> +> When deploying with ArgoCD application, Kubernetes terraform provider requires access to Kubernetes cluster API during plan time. This introduces potential issue when you want to deploy the cluster with this addon at the same time, during the same Terraform run. +> +> To overcome this issue, the module deploys the ArgoCD application object using the Helm provider, which does not require API access during plan. If you want to deploy the application using this workaround, you can set the `argo_helm_enabled` variable to `true`. -## AWS IAM resources - -To enable the creation of the EKS Pod Identity role and policy, set `eks_pod_identity_role_create = false` and `eks_pod_identity_policy_enabled = false`, respectively. -To disable the creation of IRSA role and IRSA policy, set `irsa_role_create = false` and `irsa_policy_enabled = false`, respectively. +### Argo Helm +Deploy Helm chart as ArgoCD Application via Helm resource (set `enabled = true`, `argo_enabled = true` and `argo_helm_enabled = true`) ## Examples -See [Basic example](examples/basic/README.md) for further information. - - +See [basic example](examples/basic) for further information. ## Requirements | Name | Version | |------|---------| -| [terraform](#requirement\_terraform) | >= 1.0 | -| [aws](#requirement\_aws) | >= 4.19.0 | +| [terraform](#requirement\_terraform) | >= 1.5.0 | +| [aws](#requirement\_aws) | ~> 5 | | [helm](#requirement\_helm) | >= 2.6.0 | -| [kubernetes](#requirement\_kubernetes) | >= 2.11.0 | +| [kubernetes](#requirement\_kubernetes) | >= 2.20.0 | | [utils](#requirement\_utils) | >= 0.17.0 | ## Modules -No modules. - +| Name | Source | Version | +|------|--------|---------| +| [addon](#module\_addon) | git::https://github.com/lablabs/terraform-aws-eks-universal-addon.git//modules/addon | v0.0.14 | +| [addon-irsa](#module\_addon-irsa) | git::https://github.com/lablabs/terraform-aws-eks-universal-addon.git//modules/addon-irsa | v0.0.14 | ## Resources | Name | Type | |------|------| -| [aws_eks_pod_identity_association.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_pod_identity_association) | resource | -| [aws_iam_policy.eks_pod_identity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | -| [aws_iam_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | -| [aws_iam_role.eks_pod_identity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | -| [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | -| [aws_iam_role_policy_attachment.eks_pod_identity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | -| [aws_iam_role_policy_attachment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | -| [helm_release.argo_application](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | -| [helm_release.this](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource | -| [kubernetes_manifest.this](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/manifest) | resource | -| [aws_iam_policy_document.eks_pod_identity_assume](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | +| [aws_eks_pod_identity_association.pod_identity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_pod_identity_association) | resource | +| [aws_iam_policy.pod_identity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | +| [aws_iam_role.pod_identity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | +| [aws_iam_role_policy_attachment.pod_identity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | +| [aws_iam_role_policy_attachment.pod_identity_additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | +| [aws_iam_policy_document.pod_identity](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_iam_policy_document.this_assume](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [utils_deep_merge_yaml.argo_helm_values](https://registry.terraform.io/providers/cloudposse/utils/latest/docs/data-sources/deep_merge_yaml) | data source | | [utils_deep_merge_yaml.values](https://registry.terraform.io/providers/cloudposse/utils/latest/docs/data-sources/deep_merge_yaml) | data source | - +> [!IMPORTANT] +> Variables defined in [variables-addon[-irsa|oidc].tf](variables-addon.tf) defaults to `null` to have them overridable by the addon configuration defined though the [`local.addon[_irsa|oidc].*`](main.tf) local variable with the default values defined in [addon[-irsa|oidc].tf](addon.tf). ## Inputs -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [cluster\_identity\_oidc\_issuer](#input\_cluster\_identity\_oidc\_issuer) | The OIDC Identity issuer for the cluster | `string` | n/a | yes | -| [cluster\_identity\_oidc\_issuer\_arn](#input\_cluster\_identity\_oidc\_issuer\_arn) | The OIDC Identity issuer ARN for the cluster that can be used to associate IAM roles with a service account | `string` | n/a | yes | -| [cluster\_name](#input\_cluster\_name) | The name of the cluster | `string` | n/a | yes | -| [argo\_apiversion](#input\_argo\_apiversion) | ArgoCD Appliction apiVersion | `string` | `"argoproj.io/v1alpha1"` | no | -| [argo\_destination\_server](#input\_argo\_destination\_server) | Destination server for ArgoCD Application | `string` | `"https://kubernetes.default.svc"` | no | -| [argo\_enabled](#input\_argo\_enabled) | If set to true, the module will be deployed as ArgoCD application, otherwise it will be deployed as a Helm release | `bool` | `false` | no | -| [argo\_helm\_enabled](#input\_argo\_helm\_enabled) | If set to true, the ArgoCD Application manifest will be deployed using Kubernetes provider as a Helm release. Otherwise it'll be deployed as a Kubernetes manifest. See Readme for more info | `bool` | `false` | no | -| [argo\_helm\_values](#input\_argo\_helm\_values) | Value overrides to use when deploying argo application object with helm | `string` | `""` | no | -| [argo\_info](#input\_argo\_info) | ArgoCD info manifest parameter | 
list(object({
    name  = string
    value = string
  }))
| 
[
  {
    "name": "terraform",
    "value": "true"
  }
]
| no | -| [argo\_kubernetes\_manifest\_computed\_fields](#input\_argo\_kubernetes\_manifest\_computed\_fields) | List of paths of fields to be handled as "computed". The user-configured value for the field will be overridden by any different value returned by the API after apply. | `list(string)` | 
[
  "metadata.labels",
  "metadata.annotations"
]
| no | -| [argo\_kubernetes\_manifest\_field\_manager\_force\_conflicts](#input\_argo\_kubernetes\_manifest\_field\_manager\_force\_conflicts) | Forcibly override any field manager conflicts when applying the kubernetes manifest resource | `bool` | `false` | no | -| [argo\_kubernetes\_manifest\_field\_manager\_name](#input\_argo\_kubernetes\_manifest\_field\_manager\_name) | The name of the field manager to use when applying the kubernetes manifest resource. Defaults to Terraform | `string` | `"Terraform"` | no | -| [argo\_kubernetes\_manifest\_wait\_fields](#input\_argo\_kubernetes\_manifest\_wait\_fields) | A map of fields and a corresponding regular expression with a pattern to wait for. The provider will wait until the field matches the regular expression. Use * for any value. | `map(string)` | `{}` | no | -| [argo\_metadata](#input\_argo\_metadata) | ArgoCD Application metadata configuration. Override or create additional metadata parameters | `any` | 
{
  "finalizers": [
    "resources-finalizer.argocd.argoproj.io"
  ]
}
| no | -| [argo\_namespace](#input\_argo\_namespace) | Namespace to deploy ArgoCD application CRD to | `string` | `"argo"` | no | -| [argo\_project](#input\_argo\_project) | ArgoCD Application project | `string` | `"default"` | no | -| [argo\_spec](#input\_argo\_spec) | ArgoCD Application spec configuration. Override or create additional spec parameters | `any` | `{}` | no | -| [argo\_sync\_policy](#input\_argo\_sync\_policy) | ArgoCD syncPolicy manifest parameter | `any` | `{}` | no | -| [aws\_partition](#input\_aws\_partition) | AWS partition in which the resources are located. Available values are `aws`, `aws-cn`, `aws-us-gov` | `string` | `"aws"` | no | -| [eks\_pod\_identity\_policy\_enabled](#input\_eks\_pod\_identity\_policy\_enabled) | Whether to create opinionated policy for LB controller, see https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/v2.4.0/docs/install/iam_policy.json | `bool` | `true` | no | -| [eks\_pod\_identity\_role\_create](#input\_eks\_pod\_identity\_role\_create) | Determines whether to enable support for the EKS pod identity | `bool` | `false` | no | -| [eks\_pod\_identity\_role\_name\_prefix](#input\_eks\_pod\_identity\_role\_name\_prefix) | The EKS pod identity role name prefix for LB controller | `string` | `"lb-controller-pod-identity"` | no | -| [eks\_pod\_identity\_tags](#input\_eks\_pod\_identity\_tags) | The EKS Pod identity resources tags | `map(string)` | `{}` | no | -| [enabled](#input\_enabled) | Variable indicating whether deployment is enabled | `bool` | `true` | no | -| [helm\_atomic](#input\_helm\_atomic) | If set, installation process purges chart on fail. The wait flag will be set automatically if atomic is used | `bool` | `false` | no | -| [helm\_chart\_name](#input\_helm\_chart\_name) | Helm chart name to be installed | `string` | `"aws-load-balancer-controller"` | no | -| [helm\_chart\_version](#input\_helm\_chart\_version) | Version of the Helm chart | `string` | `"1.12.0"` | no | -| [helm\_cleanup\_on\_fail](#input\_helm\_cleanup\_on\_fail) | Allow deletion of new resources created in this helm upgrade when upgrade fails | `bool` | `false` | no | -| [helm\_create\_namespace](#input\_helm\_create\_namespace) | Create the namespace if it does not yet exist | `bool` | `true` | no | -| [helm\_dependency\_update](#input\_helm\_dependency\_update) | Runs helm dependency update before installing the chart | `bool` | `false` | no | -| [helm\_description](#input\_helm\_description) | Set helm release description attribute (visible in the history) | `string` | `""` | no | -| [helm\_devel](#input\_helm\_devel) | Use helm chart development versions, too. Equivalent to version '>0.0.0-0'. If version is set, this is ignored | `bool` | `false` | no | -| [helm\_disable\_openapi\_validation](#input\_helm\_disable\_openapi\_validation) | If set, the installation process will not validate rendered helm templates against the Kubernetes OpenAPI Schema | `bool` | `false` | no | -| [helm\_disable\_webhooks](#input\_helm\_disable\_webhooks) | Prevent helm chart hooks from running | `bool` | `false` | no | -| [helm\_enabled](#input\_helm\_enabled) | Determines if the helm chart should be installed | `bool` | `true` | no | -| [helm\_force\_update](#input\_helm\_force\_update) | Force helm resource update through delete/recreate if needed | `bool` | `false` | no | -| [helm\_keyring](#input\_helm\_keyring) | Location of public keys used for verification. Used only if helm\_package\_verify is true | `string` | `"~/.gnupg/pubring.gpg"` | no | -| [helm\_lint](#input\_helm\_lint) | Run the helm chart linter during the plan | `bool` | `false` | no | -| [helm\_package\_verify](#input\_helm\_package\_verify) | Verify the package before installing it. Helm uses a provenance file to verify the integrity of the chart; this must be hosted alongside the chart | `bool` | `false` | no | -| [helm\_postrender](#input\_helm\_postrender) | Value block with a path to a binary file to run after helm renders the manifest which can alter the manifest contents | `map(any)` | `{}` | no | -| [helm\_recreate\_pods](#input\_helm\_recreate\_pods) | Perform pods restart during helm upgrade/rollback | `bool` | `false` | no | -| [helm\_release\_max\_history](#input\_helm\_release\_max\_history) | Maximum number of release versions stored per release | `number` | `0` | no | -| [helm\_release\_name](#input\_helm\_release\_name) | Helm release name | `string` | `"aws-load-balancer-controller"` | no | -| [helm\_render\_subchart\_notes](#input\_helm\_render\_subchart\_notes) | If set, render helm subchart notes along with the parent | `bool` | `true` | no | -| [helm\_replace](#input\_helm\_replace) | Re-use the given name of helm release, only if that name is a deleted release which remains in the history. This is unsafe in production | `bool` | `false` | no | -| [helm\_repo\_ca\_file](#input\_helm\_repo\_ca\_file) | Helm repositories cert file | `string` | `""` | no | -| [helm\_repo\_cert\_file](#input\_helm\_repo\_cert\_file) | Helm repositories cert file | `string` | `""` | no | -| [helm\_repo\_key\_file](#input\_helm\_repo\_key\_file) | Helm repositories cert key file | `string` | `""` | no | -| [helm\_repo\_password](#input\_helm\_repo\_password) | Password for HTTP basic authentication against the helm repository | `string` | `""` | no | -| [helm\_repo\_url](#input\_helm\_repo\_url) | Helm repository | `string` | `"https://aws.github.io/eks-charts"` | no | -| [helm\_repo\_username](#input\_helm\_repo\_username) | Username for HTTP basic authentication against the helm repository | `string` | `""` | no | -| [helm\_reset\_values](#input\_helm\_reset\_values) | When upgrading, reset the values to the ones built into the helm chart | `bool` | `false` | no | -| [helm\_reuse\_values](#input\_helm\_reuse\_values) | When upgrading, reuse the last helm release's values and merge in any overrides. If 'helm\_reset\_values' is specified, this is ignored | `bool` | `false` | no | -| [helm\_set\_sensitive](#input\_helm\_set\_sensitive) | Value block with custom sensitive values to be merged with the values yaml that won't be exposed in the plan's diff | `map(any)` | `{}` | no | -| [helm\_skip\_crds](#input\_helm\_skip\_crds) | If set, no CRDs will be installed before helm release | `bool` | `false` | no | -| [helm\_timeout](#input\_helm\_timeout) | Time in seconds to wait for any individual kubernetes operation (like Jobs for hooks) | `number` | `300` | no | -| [helm\_wait](#input\_helm\_wait) | Will wait until all helm release resources are in a ready state before marking the release as successful. It will wait for as long as timeout | `bool` | `false` | no | -| [helm\_wait\_for\_jobs](#input\_helm\_wait\_for\_jobs) | If wait is enabled, will wait until all helm Jobs have been completed before marking the release as successful. It will wait for as long as timeout | `bool` | `false` | no | -| [irsa\_policy\_enabled](#input\_irsa\_policy\_enabled) | Whether to create opinionated policy for LB controller, see https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/v2.4.0/docs/install/iam_policy.json | `bool` | `true` | no | -| [irsa\_role\_create](#input\_irsa\_role\_create) | Whether to create IRSA role and annotate service account | `bool` | `true` | no | -| [irsa\_role\_name\_prefix](#input\_irsa\_role\_name\_prefix) | The IRSA role name prefix for LB controller | `string` | `"lb-controller-irsa"` | no | -| [irsa\_tags](#input\_irsa\_tags) | IRSA resources tags | `map(string)` | `{}` | no | -| [namespace](#input\_namespace) | The K8s namespace in which the aws-load-balancer-controller service account has been created | `string` | `"aws-lb-controller"` | no | -| [service\_account\_create](#input\_service\_account\_create) | Whether to create Service Account | `bool` | `true` | no | -| [service\_account\_name](#input\_service\_account\_name) | The k8s aws-loab-balancer-controller service account name | `string` | `"aws-load-balancer-controller"` | no | -| [settings](#input\_settings) | Additional settings which will be passed to the Helm chart values, see https://github.com/aws/eks-charts/tree/master/stable/aws-load-balancer-controller | `map(any)` | `{}` | no | -| [values](#input\_values) | Additional yaml encoded values which will be passed to the Helm chart, see https://github.com/aws/eks-charts/tree/master/stable/aws-load-balancer-controller | `string` | `""` | no | - +| Name | Description | Type | +|------|-------------|------| +| [cluster\_name](#input\_cluster\_name) | The name of the cluster | `string` | +| [argo\_apiversion](#input\_argo\_apiversion) | ArgoCD Application apiVersion. Defaults to `argoproj.io/v1alpha1`. | `string` | +| [argo\_destination\_server](#input\_argo\_destination\_server) | Destination server for ArgoCD Application. Defaults to `https://kubernetes.default.svc`. | `string` | +| [argo\_enabled](#input\_argo\_enabled) | If set to `true`, the module will be deployed as ArgoCD Application, otherwise it will be deployed as a Helm release. Defaults to `false`. | `bool` | +| [argo\_helm\_enabled](#input\_argo\_helm\_enabled) | If set to `true`, the ArgoCD Application manifest will be deployed using Kubernetes provider as a Helm release. Otherwise it'll be deployed as a Kubernetes manifest. See README for more info. Defaults to `false`. | `bool` | +| [argo\_helm\_values](#input\_argo\_helm\_values) | Value overrides to use when deploying ArgoCD Application object with Helm. Defaults to `""`. | `string` | +| [argo\_helm\_wait\_backoff\_limit](#input\_argo\_helm\_wait\_backoff\_limit) | Backoff limit for ArgoCD Application Helm release wait job. Defaults to `6`. | `number` | +| [argo\_helm\_wait\_kubectl\_version](#input\_argo\_helm\_wait\_kubectl\_version) | Version of kubectl to use for ArgoCD Application wait job. Defaults to `1.32.3`. | `string` | +| [argo\_helm\_wait\_node\_selector](#input\_argo\_helm\_wait\_node\_selector) | Node selector for ArgoCD Application Helm release wait job. Defaults to `{}`. | `map(string)` | +| [argo\_helm\_wait\_timeout](#input\_argo\_helm\_wait\_timeout) | Timeout for ArgoCD Application Helm release wait job. Defaults to `10m`. | `string` | +| [argo\_helm\_wait\_tolerations](#input\_argo\_helm\_wait\_tolerations) | Tolerations for ArgoCD Application Helm release wait job. Defaults to `[]`. | `list(any)` | +| [argo\_info](#input\_argo\_info) | ArgoCD Application manifest info parameter. Defaults to `[{"name": "terraform", "value": "true"}]`. | `list(any)` | +| [argo\_kubernetes\_manifest\_computed\_fields](#input\_argo\_kubernetes\_manifest\_computed\_fields) | List of paths of fields to be handled as "computed". The user-configured value for the field will be overridden by any different value returned by the API after apply. Defaults to `["metadata.labels", "metadata.annotations", "metadata.finalizers"]`. | `list(string)` | +| [argo\_kubernetes\_manifest\_field\_manager\_force\_conflicts](#input\_argo\_kubernetes\_manifest\_field\_manager\_force\_conflicts) | Forcibly override any field manager conflicts when applying the kubernetes manifest resource. Defaults to `false`. | `bool` | +| [argo\_kubernetes\_manifest\_field\_manager\_name](#input\_argo\_kubernetes\_manifest\_field\_manager\_name) | The name of the field manager to use when applying the Kubernetes manifest resource. Defaults to `Terraform`. | `string` | +| [argo\_kubernetes\_manifest\_wait\_fields](#input\_argo\_kubernetes\_manifest\_wait\_fields) | A map of fields and a corresponding regular expression with a pattern to wait for. The provider will wait until the field matches the regular expression. Use * for any value. Defaults to `{}`. | `map(string)` | +| [argo\_metadata](#input\_argo\_metadata) | ArgoCD Application metadata configuration. Override or create additional metadata parameters. Defaults to `{"finalizers": ["resources-finalizer.argocd.argoproj.io"]}`. | `any` | +| [argo\_name](#input\_argo\_name) | Name of the ArgoCD Application. Required if `argo_source_type` is set to `kustomize` or `directory`. If `argo_source_type` is set to `helm`, ArgoCD Application name will equal `helm_release_name`. Defaults to `null`. | `string` | +| [argo\_namespace](#input\_argo\_namespace) | Namespace to deploy ArgoCD Application to. Defaults to `argo`. | `string` | +| [argo\_operation](#input\_argo\_operation) | ArgoCD Application manifest operation parameter. Defaults to `{}`. | `any` | +| [argo\_project](#input\_argo\_project) | ArgoCD Application project. Defaults to `default`. | `string` | +| [argo\_source\_path](#input\_argo\_source\_path) | ArgoCD Application source path. Required if `argo_source_type` is set to `kustomize` or `directory`. Defaults to `null`. | `string` | +| [argo\_source\_repo\_url](#input\_argo\_source\_repo\_url) | ArgoCD Application source repo URL. Required if `argo_source_type` is set to `kustomize` or `directory`. Defaults to `null`. | `string` | +| [argo\_source\_target\_revision](#input\_argo\_source\_target\_revision) | ArgoCD Application source target revision. Required if `argo_source_type` is set to `kustomize` or `directory`. Defaults to `null`. | `string` | +| [argo\_source\_type](#input\_argo\_source\_type) | Source type for ArgoCD Application. Can be either `helm`, `kustomize`, or `directory`. Defaults to `helm`. | `string` | +| [argo\_spec](#input\_argo\_spec) | ArgoCD Application spec configuration. Override or create additional spec parameters. Defaults to `{}`. | `any` | +| [argo\_sync\_policy](#input\_argo\_sync\_policy) | ArgoCD Application manifest syncPolicy parameter. Defaults to `{}`. | `any` | +| [aws\_partition](#input\_aws\_partition) | AWS partition in which the resources are located. Available values are `aws`, `aws-cn`, `aws-us-gov` | `string` | +| [cluster\_identity\_oidc\_issuer](#input\_cluster\_identity\_oidc\_issuer) | The OIDC Identity issuer for the cluster (required). | `string` | +| [cluster\_identity\_oidc\_issuer\_arn](#input\_cluster\_identity\_oidc\_issuer\_arn) | The OIDC Identity issuer ARN for the cluster that can be used to associate IAM roles with a Service Account (required). | `string` | +| [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources. | `bool` | +| [helm\_atomic](#input\_helm\_atomic) | If set, installation process purges chart on fail. The wait flag will be set automatically if atomic is used. Defaults to `false`. | `bool` | +| [helm\_chart\_name](#input\_helm\_chart\_name) | Helm chart name to be installed. Required if `argo_source_type` is set to `helm`. Defaults to `null`. | `string` | +| [helm\_chart\_version](#input\_helm\_chart\_version) | Version of the Helm chart. Required if `argo_source_type` is set to `helm`. Defaults to `null`. | `string` | +| [helm\_cleanup\_on\_fail](#input\_helm\_cleanup\_on\_fail) | Allow deletion of new resources created in this Helm upgrade when upgrade fails. Defaults to `false`. | `bool` | +| [helm\_create\_namespace](#input\_helm\_create\_namespace) | Create the Namespace if it does not yet exist. Defaults to `true`. | `bool` | +| [helm\_dependency\_update](#input\_helm\_dependency\_update) | Runs Helm dependency update before installing the chart. Defaults to `false`. | `bool` | +| [helm\_description](#input\_helm\_description) | Set Helm release description attribute (visible in the history). Defaults to `""`. | `string` | +| [helm\_devel](#input\_helm\_devel) | Use Helm chart development versions, too. Equivalent to version '>0.0.0-0'. If version is set, this is ignored. Defaults to `false`. | `bool` | +| [helm\_disable\_openapi\_validation](#input\_helm\_disable\_openapi\_validation) | If set, the installation process will not validate rendered Helm templates against the Kubernetes OpenAPI Schema. Defaults to `false`. | `bool` | +| [helm\_disable\_webhooks](#input\_helm\_disable\_webhooks) | Prevent Helm chart hooks from running. Defaults to `false`. | `bool` | +| [helm\_enabled](#input\_helm\_enabled) | Set to false to prevent installation of the module via Helm release. Defaults to `true`. | `bool` | +| [helm\_force\_update](#input\_helm\_force\_update) | Force Helm resource update through delete/recreate if needed. Defaults to `false`. | `bool` | +| [helm\_keyring](#input\_helm\_keyring) | Location of public keys used for verification. Used only if `helm_package_verify` is `true`. Defaults to `~/.gnupg/pubring.gpg`. | `string` | +| [helm\_lint](#input\_helm\_lint) | Run the Helm chart linter during the plan. Defaults to `false`. | `bool` | +| [helm\_package\_verify](#input\_helm\_package\_verify) | Verify the package before installing it. Helm uses a provenance file to verify the integrity of the chart; this must be hosted alongside the chart. Defaults to `false`. | `bool` | +| [helm\_postrender](#input\_helm\_postrender) | Value block with a path to a binary file to run after Helm renders the manifest which can alter the manifest contents. Defaults to `{}`. | `map(any)` | +| [helm\_recreate\_pods](#input\_helm\_recreate\_pods) | Perform pods restart during Helm upgrade/rollback. Defaults to `false`. | `bool` | +| [helm\_release\_max\_history](#input\_helm\_release\_max\_history) | Maximum number of release versions stored per release. Defaults to `0`. | `number` | +| [helm\_release\_name](#input\_helm\_release\_name) | Helm release name. Required if `argo_source_type` is set to `helm`. Defaults to `null`. | `string` | +| [helm\_render\_subchart\_notes](#input\_helm\_render\_subchart\_notes) | If set, render Helm subchart notes along with the parent. Defaults to `true`. | `bool` | +| [helm\_replace](#input\_helm\_replace) | Re-use the given name of Helm release, only if that name is a deleted release which remains in the history. This is unsafe in production. Defaults to `false`. | `bool` | +| [helm\_repo\_ca\_file](#input\_helm\_repo\_ca\_file) | Helm repositories CA cert file. Defaults to `""`. | `string` | +| [helm\_repo\_cert\_file](#input\_helm\_repo\_cert\_file) | Helm repositories cert file. Defaults to `""`. | `string` | +| [helm\_repo\_key\_file](#input\_helm\_repo\_key\_file) | Helm repositories cert key file. Defaults to `""`. | `string` | +| [helm\_repo\_password](#input\_helm\_repo\_password) | Password for HTTP basic authentication against the Helm repository. Defaults to `""`. | `string` | +| [helm\_repo\_url](#input\_helm\_repo\_url) | Helm repository. Required if `argo_source_type` is set to `helm`. Defaults to `null`. | `string` | +| [helm\_repo\_username](#input\_helm\_repo\_username) | Username for HTTP basic authentication against the Helm repository. Defaults to `""`. | `string` | +| [helm\_reset\_values](#input\_helm\_reset\_values) | When upgrading, reset the values to the ones built into the Helm chart. Defaults to `false`. | `bool` | +| [helm\_reuse\_values](#input\_helm\_reuse\_values) | When upgrading, reuse the last Helm release's values and merge in any overrides. If `helm_reset_values` is specified, this is ignored. Defaults to `false`. | `bool` | +| [helm\_set\_sensitive](#input\_helm\_set\_sensitive) | Value block with custom sensitive values to be merged with the values yaml that won't be exposed in the plan's diff. Defaults to `{}`. | `map(any)` | +| [helm\_skip\_crds](#input\_helm\_skip\_crds) | If set, no CRDs will be installed before Helm release. Defaults to `false`. | `bool` | +| [helm\_timeout](#input\_helm\_timeout) | Time in seconds to wait for any individual Kubernetes operation (like Jobs for hooks). Defaults to `300`. | `number` | +| [helm\_wait](#input\_helm\_wait) | Will wait until all Helm release resources are in a ready state before marking the release as successful. It will wait for as long as timeout. Defaults to `false`. | `bool` | +| [helm\_wait\_for\_jobs](#input\_helm\_wait\_for\_jobs) | If wait is enabled, will wait until all Helm Jobs have been completed before marking the release as successful. It will wait for as long as timeout. Defaults to `false`. | `bool` | +| [irsa\_additional\_policies](#input\_irsa\_additional\_policies) | Map of the additional policies to be attached to IRSA role. Where key is arbitrary id and value is policy ARN. Defaults to `{}`. | `map(string)` | +| [irsa\_assume\_role\_arns](#input\_irsa\_assume\_role\_arns) | List of ARNs assumable by the IRSA role. Applied only if `irsa_assume_role_enabled` is `true`. Defaults to `[]`. | `list(string)` | +| [irsa\_assume\_role\_enabled](#input\_irsa\_assume\_role\_enabled) | Whether IRSA is allowed to assume role defined by `irsa_assume_role_arn`. Mutually exclusive with `irsa_policy_enabled`. Defaults to `false`. | `bool` | +| [irsa\_assume\_role\_policy\_condition\_test](#input\_irsa\_assume\_role\_policy\_condition\_test) | Specifies the condition test to use for the assume role trust policy. Defaults to `StringEquals`. | `string` | +| [irsa\_assume\_role\_policy\_condition\_values](#input\_irsa\_assume\_role\_policy\_condition\_values) | Specifies the values for the assume role trust policy condition. Each entry in this list must follow the required format `system:serviceaccount:$service_account_namespace:$service_account_name`. If this variable is left as the default, `local.irsa_assume_role_policy_condition_values_default` is used instead, which is a list containing a single value. Note that if this list is defined, the `service_account_name` and `service_account_namespace` variables are ignored. Defaults to `[]`. | `list(string)` | +| [irsa\_permissions\_boundary](#input\_irsa\_permissions\_boundary) | ARN of the policy that is used to set the permissions boundary for the IRSA role. Defaults to `null`. | `string` | +| [irsa\_policy](#input\_irsa\_policy) | AWS IAM policy JSON document to be attached to the IRSA role. Applied only if `irsa_policy_enabled` is `true`. Defaults to `""`. | `string` | +| [irsa\_policy\_enabled](#input\_irsa\_policy\_enabled) | Whether to create IAM policy specified by `irsa_policy`. Mutually exclusive with `irsa_assume_role_enabled`. Defaults to `false`. | `bool` | +| [irsa\_role\_create](#input\_irsa\_role\_create) | Whether to create IRSA role and annotate Service Account. Defaults to `true`. | `bool` | +| [irsa\_role\_name](#input\_irsa\_role\_name) | IRSA role name. The value is prefixed by `irsa_role_name_prefix`. Either `irsa_role_name` or `irsa_role_name_prefix` must be set. Defaults to `""`. | `string` | +| [irsa\_role\_name\_prefix](#input\_irsa\_role\_name\_prefix) | IRSA role name prefix. Either `irsa_role_name_prefix` or `irsa_role_name` must be set. Defaults to `""`. | `string` | +| [irsa\_tags](#input\_irsa\_tags) | IRSA resources tags. Defaults to `{}`. | `map(string)` | +| [namespace](#input\_namespace) | The Kubernetes Namespace in which the Helm chart will be installed (required). | `string` | +| [pod\_identity\_additional\_policies](#input\_pod\_identity\_additional\_policies) | Map of the additional policies to be attached to pod identity role. Where key is arbitrary id and value is policy ARN. | `map(string)` | +| [pod\_identity\_permissions\_boundary](#input\_pod\_identity\_permissions\_boundary) | ARN of the policy that is used to set the permissions boundary for the pod identity role. | `string` | +| [pod\_identity\_policy](#input\_pod\_identity\_policy) | AWS IAM policy JSON document to be attached to the pod identity role. Applied only if `pod_identity_policy_enabled` is `true`. Default policy is defined in iam.tf. | `string` | +| [pod\_identity\_policy\_enabled](#input\_pod\_identity\_policy\_enabled) | Whether to create IAM policy specified by `pod_identity_policy`. | `bool` | +| [pod\_identity\_role\_create](#input\_pod\_identity\_role\_create) | Whether to create pod identity role. | `bool` | +| [pod\_identity\_role\_name](#input\_pod\_identity\_role\_name) | Pod identity role name. The value is prefixed by `pod_identity_role_name_prefix`. Either `pod_identity_role_name` or `pod_identity_role_name_prefix` must be set. Defaults to `""`. | `string` | +| [pod\_identity\_role\_name\_prefix](#input\_pod\_identity\_role\_name\_prefix) | Pod identity role name prefix. Either `pod_identity_role_name_prefix` or `pod_identity_role_name` must be set. | `string` | +| [pod\_identity\_tags](#input\_pod\_identity\_tags) | The Pod identity resources tags. | `map(string)` | +| [rbac\_create](#input\_rbac\_create) | Whether to create and use RBAC resources. Defaults to `true`. | `bool` | +| [service\_account\_create](#input\_service\_account\_create) | Whether to create Service Account. Defaults to `true`. | `bool` | +| [service\_account\_name](#input\_service\_account\_name) | The Kubernetes Service Account name. Defaults to the addon name. Defaults to `""`. | `string` | +| [service\_account\_namespace](#input\_service\_account\_namespace) | The Kubernetes Service Account namespace. Defaults to the addon namespace. Defaults to `""`. | `string` | +| [settings](#input\_settings) | Additional Helm sets which will be passed to the Helm chart values or Kustomize or directory configuration which will be passed to ArgoCD Application source. Defaults to `{}`. | `map(any)` | +| [values](#input\_values) | Additional YAML encoded values which will be passed to the Helm chart. Defaults to `""`. | `string` | ## Outputs | Name | Description | |------|-------------| -| [helm\_release\_application\_metadata](#output\_helm\_release\_application\_metadata) | Argo application helm release attributes | -| [helm\_release\_metadata](#output\_helm\_release\_metadata) | Helm release attributes | -| [iam\_role\_attributes](#output\_iam\_role\_attributes) | IAM role atributes | -| [kubernetes\_application\_attributes](#output\_kubernetes\_application\_attributes) | Argo kubernetes manifest attributes | - - +| [addon](#output\_addon) | The addon module outputs | +| [addon\_irsa](#output\_addon\_irsa) | The addon IRSA module outputs | ## Contributing and reporting issues Feel free to create an issue in this repository if you have questions, suggestions or feature requests. @@ -167,14 +176,13 @@ Feel free to create an issue in this repository if you have questions, suggestio We want to provide high quality code and modules. For this reason we are using several [pre-commit hooks](.pre-commit-config.yaml) and -[GitHub Actions workflow](.github/workflows/main.yml). A pull-request to the -master branch will trigger these validations and lints automatically. Please +[GitHub Actions workflows](.github/workflows/). A pull-request to the +main branch will trigger these validations and lints automatically. Please check your code before you will create pull-requests. See [pre-commit documentation](https://pre-commit.com/) and [GitHub Actions documentation](https://docs.github.com/en/actions) for further details. - ## License [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) @@ -197,3 +205,4 @@ See [LICENSE](LICENSE) for full details. KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. + diff --git a/addon-irsa.tf b/addon-irsa.tf new file mode 100644 index 0000000..518f832 --- /dev/null +++ b/addon-irsa.tf @@ -0,0 +1,37 @@ +# IMPORTANT: This file is synced with the "terraform-aws-eks-universal-addon" module. Any changes to this file might be overwritten upon the next release of that module. +module "addon-irsa" { + for_each = local.addon_irsa + + source = "git::https://github.com/lablabs/terraform-aws-eks-universal-addon.git//modules/addon-irsa?ref=v0.0.14" + + enabled = var.enabled + + cluster_identity_oidc_issuer = var.cluster_identity_oidc_issuer != null ? var.cluster_identity_oidc_issuer : try(each.value.cluster_identity_oidc_issuer, "") + cluster_identity_oidc_issuer_arn = var.cluster_identity_oidc_issuer_arn != null ? var.cluster_identity_oidc_issuer_arn : try(each.value.cluster_identity_oidc_issuer_arn, "") + + rbac_create = var.rbac_create != null ? var.rbac_create : try(each.value.rbac_create, true) + service_account_create = var.service_account_create != null ? var.service_account_create : try(each.value.service_account_create, true) + service_account_name = var.service_account_name != null ? var.service_account_name : try(each.value.service_account_name, each.key) + service_account_namespace = var.service_account_namespace != null ? var.service_account_namespace : try(each.value.service_account_namespace, local.addon_namespace) + + irsa_role_create = var.irsa_role_create != null ? var.irsa_role_create : try(each.value.irsa_role_create, true) + irsa_role_name_prefix = var.irsa_role_name_prefix != null ? var.irsa_role_name_prefix : try(each.value.irsa_role_name_prefix, "${each.key}-irsa") + irsa_role_name = var.irsa_role_name != null ? var.irsa_role_name : try(each.value.irsa_role_name, local.addon_name) + + irsa_policy_enabled = var.irsa_policy_enabled != null ? var.irsa_policy_enabled : try(each.value.irsa_policy_enabled, false) + irsa_policy = var.irsa_policy != null ? var.irsa_policy : try(each.value.irsa_policy, "") + irsa_assume_role_enabled = var.irsa_assume_role_enabled != null ? var.irsa_assume_role_enabled : try(each.value.irsa_assume_role_enabled, false) + irsa_assume_role_arns = var.irsa_assume_role_arns != null ? var.irsa_assume_role_arns : try(each.value.irsa_assume_role_arns, []) + irsa_permissions_boundary = var.irsa_permissions_boundary != null ? var.irsa_permissions_boundary : try(each.value.irsa_permissions_boundary, null) + irsa_additional_policies = var.irsa_additional_policies != null ? var.irsa_additional_policies : lookup(each.value, "irsa_additional_policies", tomap({})) + + irsa_assume_role_policy_condition_test = var.irsa_assume_role_policy_condition_test != null ? var.irsa_assume_role_policy_condition_test : try(each.value.irsa_assume_role_policy_condition_test, "StringEquals") + irsa_assume_role_policy_condition_values = var.irsa_assume_role_policy_condition_values != null ? var.irsa_assume_role_policy_condition_values : try(each.value.irsa_assume_role_policy_condition_values, []) + + irsa_tags = var.irsa_tags != null ? var.irsa_tags : try(each.value.irsa_tags, tomap({})) +} + +output "addon_irsa" { + description = "The addon IRSA module outputs" + value = module.addon-irsa +} diff --git a/addon.tf b/addon.tf new file mode 100644 index 0000000..5b2309d --- /dev/null +++ b/addon.tf @@ -0,0 +1,100 @@ +# IMPORTANT: This file is synced with the "terraform-aws-eks-universal-addon" module. Any changes to this file might be overwritten upon the next release of that module. +locals { + addon_argo_source_type = var.argo_source_type != null ? var.argo_source_type : try(local.addon.argo_source_type, "helm") + addon_argo_source_helm_enabled = local.addon_argo_source_type == "helm" + + addon_argo_name = var.argo_name != null ? var.argo_name : try(local.addon.argo_name, local.addon.name) + addon_helm_release_name = var.helm_release_name != null ? var.helm_release_name : try(local.addon.helm_release_name, local.addon.name) + + addon_name = local.addon_argo_source_helm_enabled ? local.addon_helm_release_name : local.addon_argo_name + addon_namespace = var.namespace != null ? var.namespace : try(local.addon.namespace, local.addon.name) +} + +module "addon" { + source = "git::https://github.com/lablabs/terraform-aws-eks-universal-addon.git//modules/addon?ref=v0.0.14" + + enabled = var.enabled + + # variable priority var.* (provided by the module user) > local.addon.* (universal addon default override) > default (universal addon default) + namespace = local.addon_namespace + + helm_enabled = var.helm_enabled != null ? var.helm_enabled : try(local.addon.helm_enabled, true) + helm_release_name = local.addon_name + helm_chart_name = var.helm_chart_name != null ? var.helm_chart_name : try(local.addon.helm_chart_name, local.addon.name) + helm_chart_version = var.helm_chart_version != null ? var.helm_chart_version : try(local.addon.helm_chart_version, null) + helm_atomic = var.helm_atomic != null ? var.helm_atomic : try(local.addon.helm_atomic, false) + helm_cleanup_on_fail = var.helm_cleanup_on_fail != null ? var.helm_cleanup_on_fail : try(local.addon.helm_cleanup_on_fail, false) + helm_create_namespace = var.helm_create_namespace != null ? var.helm_create_namespace : try(local.addon.helm_create_namespace, true) + helm_dependency_update = var.helm_dependency_update != null ? var.helm_dependency_update : try(local.addon.helm_dependency_update, false) + helm_description = var.helm_description != null ? var.helm_description : try(local.addon.helm_description, "") + helm_devel = var.helm_devel != null ? var.helm_devel : try(local.addon.helm_devel, false) + helm_disable_openapi_validation = var.helm_disable_openapi_validation != null ? var.helm_disable_openapi_validation : try(local.addon.helm_disable_openapi_validation, false) + helm_disable_webhooks = var.helm_disable_webhooks != null ? var.helm_disable_webhooks : try(local.addon.helm_disable_webhooks, false) + helm_force_update = var.helm_force_update != null ? var.helm_force_update : try(local.addon.helm_force_update, false) + helm_keyring = var.helm_keyring != null ? var.helm_keyring : try(local.addon.helm_keyring, "~/.gnupg/pubring.gpg") + helm_lint = var.helm_lint != null ? var.helm_lint : try(local.addon.helm_lint, false) + helm_package_verify = var.helm_package_verify != null ? var.helm_package_verify : try(local.addon.helm_package_verify, false) + helm_postrender = var.helm_postrender != null ? var.helm_postrender : try(local.addon.helm_postrender, {}) + helm_recreate_pods = var.helm_recreate_pods != null ? var.helm_recreate_pods : try(local.addon.helm_recreate_pods, false) + helm_release_max_history = var.helm_release_max_history != null ? var.helm_release_max_history : try(local.addon.helm_release_max_history, 0) + helm_render_subchart_notes = var.helm_render_subchart_notes != null ? var.helm_render_subchart_notes : try(local.addon.helm_render_subchart_notes, true) + helm_replace = var.helm_replace != null ? var.helm_replace : try(local.addon.helm_replace, false) + helm_repo_ca_file = var.helm_repo_ca_file != null ? var.helm_repo_ca_file : try(local.addon.helm_repo_ca_file, "") + helm_repo_cert_file = var.helm_repo_cert_file != null ? var.helm_repo_cert_file : try(local.addon.helm_repo_cert_file, "") + helm_repo_key_file = var.helm_repo_key_file != null ? var.helm_repo_key_file : try(local.addon.helm_repo_key_file, "") + helm_repo_password = var.helm_repo_password != null ? var.helm_repo_password : try(local.addon.helm_repo_password, "") + helm_repo_url = var.helm_repo_url != null ? var.helm_repo_url : try(local.addon.helm_repo_url, null) + helm_repo_username = var.helm_repo_username != null ? var.helm_repo_username : try(local.addon.helm_repo_username, "") + helm_reset_values = var.helm_reset_values != null ? var.helm_reset_values : try(local.addon.helm_reset_values, false) + helm_reuse_values = var.helm_reuse_values != null ? var.helm_reuse_values : try(local.addon.helm_reuse_values, false) + helm_set_sensitive = var.helm_set_sensitive != null ? var.helm_set_sensitive : try(local.addon.helm_set_sensitive, {}) + helm_skip_crds = var.helm_skip_crds != null ? var.helm_skip_crds : try(local.addon.helm_skip_crds, false) + helm_timeout = var.helm_timeout != null ? var.helm_timeout : try(local.addon.helm_timeout, 300) + helm_wait = var.helm_wait != null ? var.helm_wait : try(local.addon.helm_wait, false) + helm_wait_for_jobs = var.helm_wait_for_jobs != null ? var.helm_wait_for_jobs : try(local.addon.helm_wait_for_jobs, false) + + argo_source_type = local.addon_argo_source_type + argo_source_repo_url = var.argo_source_repo_url != null ? var.argo_source_repo_url : try(local.addon.argo_source_repo_url, null) + argo_source_target_revision = var.argo_source_target_revision != null ? var.argo_source_target_revision : try(local.addon.argo_source_target_revision, null) + argo_source_path = var.argo_source_path != null ? var.argo_source_path : try(local.addon.argo_source_path, null) + + argo_apiversion = var.argo_apiversion != null ? var.argo_apiversion : try(local.addon.argo_apiversion, "argoproj.io/v1alpha1") + argo_destination_server = var.argo_destination_server != null ? var.argo_destination_server : try(local.addon.argo_destination_server, "https://kubernetes.default.svc") + argo_enabled = var.argo_enabled != null ? var.argo_enabled : try(local.addon.argo_enabled, false) + argo_helm_enabled = var.argo_helm_enabled != null ? var.argo_helm_enabled : try(local.addon.argo_helm_enabled, false) + argo_helm_values = var.argo_helm_values != null ? var.argo_helm_values : try(local.addon.argo_helm_values, "") + argo_helm_wait_backoff_limit = var.argo_helm_wait_backoff_limit != null ? var.argo_helm_wait_backoff_limit : try(local.addon.argo_helm_wait_backoff_limit, 6) + argo_helm_wait_node_selector = var.argo_helm_wait_node_selector != null ? var.argo_helm_wait_node_selector : try(local.addon.argo_helm_wait_node_selector, var.argo_helm_wait_node_selector) + argo_helm_wait_timeout = var.argo_helm_wait_timeout != null ? var.argo_helm_wait_timeout : try(local.addon.argo_helm_wait_timeout, "10m") + argo_helm_wait_tolerations = var.argo_helm_wait_tolerations != null ? var.argo_helm_wait_tolerations : try(local.addon.argo_helm_wait_tolerations, tolist([])) + argo_helm_wait_kubectl_version = var.argo_helm_wait_kubectl_version != null ? var.argo_helm_wait_kubectl_version : try(local.addon.argo_helm_wait_kubectl_version, "1.32.3") + argo_info = var.argo_info != null ? var.argo_info : try(local.addon.argo_info, [{ name = "terraform", value = "true" }]) + argo_kubernetes_manifest_computed_fields = var.argo_kubernetes_manifest_computed_fields != null ? var.argo_kubernetes_manifest_computed_fields : try(local.addon.argo_kubernetes_manifest_computed_fields, ["metadata.labels", "metadata.annotations", "metadata.finalizers"]) + argo_kubernetes_manifest_field_manager_force_conflicts = var.argo_kubernetes_manifest_field_manager_force_conflicts != null ? var.argo_kubernetes_manifest_field_manager_force_conflicts : try(local.addon.argo_kubernetes_manifest_field_manager_force_conflicts, false) + argo_kubernetes_manifest_field_manager_name = var.argo_kubernetes_manifest_field_manager_name != null ? var.argo_kubernetes_manifest_field_manager_name : try(local.addon.argo_kubernetes_manifest_field_manager_name, "Terraform") + argo_kubernetes_manifest_wait_fields = var.argo_kubernetes_manifest_wait_fields != null ? var.argo_kubernetes_manifest_wait_fields : try(local.addon.argo_kubernetes_manifest_wait_fields, tomap({})) + argo_metadata = var.argo_metadata != null ? var.argo_metadata : try(local.addon.argo_metadata, { finalizers = ["resources-finalizer.argocd.argoproj.io"] }) + argo_name = local.addon_name + argo_namespace = var.argo_namespace != null ? var.argo_namespace : try(local.addon.argo_namespace, "argo") + argo_project = var.argo_project != null ? var.argo_project : try(local.addon.argo_project, "default") + argo_spec = var.argo_spec != null ? var.argo_spec : try(local.addon.argo_spec, tomap({})) + argo_sync_policy = var.argo_sync_policy != null ? var.argo_sync_policy : try(local.addon.argo_sync_policy, tomap({})) + argo_operation = var.argo_operation != null ? var.argo_operation : try(local.addon.argo_operation, tomap({})) + + settings = var.settings != null ? var.settings : try(local.addon.settings, tomap({})) + values = one(data.utils_deep_merge_yaml.values[*].output) +} + +data "utils_deep_merge_yaml" "values" { + count = var.enabled ? 1 : 0 + + input = compact([ + local.addon_values, + var.values + ]) +} + +output "addon" { + description = "The addon module outputs" + value = module.addon +} diff --git a/argo.tf b/argo.tf deleted file mode 100644 index 1ba614a..0000000 --- a/argo.tf +++ /dev/null @@ -1,85 +0,0 @@ -locals { - argo_application_metadata = { - "labels" : try(var.argo_metadata.labels, {}), - "annotations" : try(var.argo_metadata.annotations, {}), - "finalizers" : try(var.argo_metadata.finalizers, []) - } - argo_application_values = { - "project" : var.argo_project - "source" : { - "repoURL" : var.helm_repo_url - "chart" : var.helm_chart_name - "targetRevision" : var.helm_chart_version - "helm" : { - "releaseName" : var.helm_release_name - "parameters" : [for k, v in var.settings : tomap({ "forceString" : true, "name" : k, "value" : v })] - "values" : var.enabled ? data.utils_deep_merge_yaml.values[0].output : "" - } - } - "destination" : { - "server" : var.argo_destination_server - "namespace" : var.namespace - } - "syncPolicy" : var.argo_sync_policy - "info" : var.argo_info - } -} - -data "utils_deep_merge_yaml" "argo_helm_values" { - count = var.enabled && var.argo_enabled && var.argo_helm_enabled ? 1 : 0 - input = compact([ - yamlencode({ - "apiVersion" : var.argo_apiversion - }), - yamlencode({ - "spec" : local.argo_application_values - }), - yamlencode({ - "spec" : var.argo_spec - }), - yamlencode( - local.argo_application_metadata - ) - ]) -} - -resource "helm_release" "argo_application" { - count = var.enabled && var.argo_enabled && var.argo_helm_enabled ? 1 : 0 - - chart = "${path.module}/helm/argocd-application" - name = var.helm_release_name - namespace = var.argo_namespace - - values = [ - data.utils_deep_merge_yaml.argo_helm_values[0].output, - var.argo_helm_values - ] -} - -resource "kubernetes_manifest" "this" { - count = var.enabled && var.argo_enabled && !var.argo_helm_enabled ? 1 : 0 - manifest = { - "apiVersion" = var.argo_apiversion - "kind" = "Application" - "metadata" = merge( - local.argo_application_metadata, - { "name" = var.helm_release_name }, - { "namespace" = var.argo_namespace }, - ) - "spec" = merge( - local.argo_application_values, - var.argo_spec - ) - } - - computed_fields = var.argo_kubernetes_manifest_computed_fields - - field_manager { - name = var.argo_kubernetes_manifest_field_manager_name - force_conflicts = var.argo_kubernetes_manifest_field_manager_force_conflicts - } - - wait { - fields = var.argo_kubernetes_manifest_wait_fields - } -} diff --git a/docs/.addon.md b/docs/.addon.md new file mode 100644 index 0000000..156c110 --- /dev/null +++ b/docs/.addon.md @@ -0,0 +1,31 @@ + +--- + +## Related Projects + +Check out other [Terraform Kubernetes addons](https://github.com/orgs/lablabs/repositories?q=terraform-aws-eks&type=public&language=&sort=). + +[](https://lablabs.io/) + +We help companies build, run, deploy and scale software and infrastructure by embracing the right technologies and principles. Check out our website at . + +## Deployment methods + +### Helm +Deploy Helm chart via Helm resource (default method, set `enabled = true`) + +### Argo Kubernetes +Deploy Helm chart as ArgoCD Application via Kubernetes manifest resource (set `enabled = true` and `argo_enabled = true`) + +> **Warning** +> +> When deploying with ArgoCD application, Kubernetes terraform provider requires access to Kubernetes cluster API during plan time. This introduces potential issue when you want to deploy the cluster with this addon at the same time, during the same Terraform run. +> +> To overcome this issue, the module deploys the ArgoCD application object using the Helm provider, which does not require API access during plan. If you want to deploy the application using this workaround, you can set the `argo_helm_enabled` variable to `true`. + +### Argo Helm +Deploy Helm chart as ArgoCD Application via Helm resource (set `enabled = true`, `argo_enabled = true` and `argo_helm_enabled = true`) + +## Examples + +See [basic example](examples/basic) for further information. diff --git a/docs/.footer.md b/docs/.footer.md new file mode 100644 index 0000000..971db04 --- /dev/null +++ b/docs/.footer.md @@ -0,0 +1,37 @@ +## Contributing and reporting issues + +Feel free to create an issue in this repository if you have questions, suggestions or feature requests. + +### Validation, linters and pull-requests + +We want to provide high quality code and modules. For this reason we are using +several [pre-commit hooks](.pre-commit-config.yaml) and +[GitHub Actions workflows](.github/workflows/). A pull-request to the +main branch will trigger these validations and lints automatically. Please +check your code before you will create pull-requests. See +[pre-commit documentation](https://pre-commit.com/) and +[GitHub Actions documentation](https://docs.github.com/en/actions) for further +details. + +## License + +[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0) + +See [LICENSE](LICENSE) for full details. + + Licensed to the Apache Software Foundation (ASF) under one + or more contributor license agreements. See the NOTICE file + distributed with this work for additional information + regarding copyright ownership. The ASF licenses this file + to you under the Apache License, Version 2.0 (the + "License"); you may not use this file except in compliance + with the License. You may obtain a copy of the License at + + https://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, + software distributed under the License is distributed on an + "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + KIND, either express or implied. See the License for the + specific language governing permissions and limitations + under the License. diff --git a/docs/.inputs.md b/docs/.inputs.md new file mode 100644 index 0000000..8e1763d --- /dev/null +++ b/docs/.inputs.md @@ -0,0 +1,2 @@ +> [!IMPORTANT] +> Variables defined in [variables-addon[-irsa|oidc].tf](variables-addon.tf) defaults to `null` to have them overridable by the addon configuration defined though the [`local.addon[_irsa|oidc].*`](main.tf) local variable with the default values defined in [addon[-irsa|oidc].tf](addon.tf). diff --git a/eks_pod_identity.tf b/eks_pod_identity.tf deleted file mode 100644 index e74a810..0000000 --- a/eks_pod_identity.tf +++ /dev/null @@ -1,56 +0,0 @@ -locals { - eks_pod_identity_role_create = var.enabled && var.service_account_create && var.eks_pod_identity_role_create -} - -resource "aws_iam_policy" "eks_pod_identity" { - count = local.eks_pod_identity_role_create && var.eks_pod_identity_policy_enabled ? 1 : 0 - name = "${var.eks_pod_identity_role_name_prefix}-${var.helm_release_name}" - path = "/" - description = "Policy for aws-load-balancer-controller service" - - policy = data.aws_iam_policy_document.this[0].json - tags = var.eks_pod_identity_tags -} - -data "aws_iam_policy_document" "eks_pod_identity_assume" { - count = local.eks_pod_identity_role_create ? 1 : 0 - - statement { - actions = [ - "sts:AssumeRole", - "sts:TagSession", - ] - - principals { - type = "Service" - identifiers = ["pods.eks.amazonaws.com"] - } - - effect = "Allow" - } -} - -resource "aws_iam_role" "eks_pod_identity" { - count = local.eks_pod_identity_role_create ? 1 : 0 - - name = "${var.eks_pod_identity_role_name_prefix}-${var.helm_release_name}" - assume_role_policy = data.aws_iam_policy_document.eks_pod_identity_assume[0].json - - tags = var.eks_pod_identity_tags -} - -resource "aws_iam_role_policy_attachment" "eks_pod_identity" { - count = local.eks_pod_identity_role_create ? 1 : 0 - - role = aws_iam_role.eks_pod_identity[0].name - policy_arn = aws_iam_policy.eks_pod_identity[0].arn -} - -resource "aws_eks_pod_identity_association" "this" { - count = local.eks_pod_identity_role_create ? 1 : 0 - - cluster_name = var.cluster_name - namespace = var.namespace - service_account = var.service_account_name - role_arn = aws_iam_role.eks_pod_identity[0].arn -} diff --git a/examples/basic/.terraform.lock.hcl b/examples/basic/.terraform.lock.hcl new file mode 100644 index 0000000..44bba7c --- /dev/null +++ b/examples/basic/.terraform.lock.hcl @@ -0,0 +1,161 @@ +# This file is maintained automatically by "terraform init". +# Manual edits may be lost in future updates. + +provider "registry.terraform.io/cloudposse/utils" { + version = "1.18.0" + constraints = ">= 0.17.0" + hashes = [ + "h1:/vyNN6DuHSLpmrc/4d1OZVyDbkj5PckP/pGW8z3lAhE=", + "h1:UdRh991C59aDB5nrpBN1PZzyZucsmbgvoDHq4uHKiE0=", + "h1:eHwxhgfHZeW3sKYICNwu9XEaKoAh6YPuj/LSVidyo7w=", + "zh:1a6a1f1c354a2e1f92369fd331e1578ee8942600406c83629278b1d88e857421", + "zh:35847cc6575844c05e2cbbe199e9d1190c01ed1b91dfe05b897bb6c83825debe", + "zh:3b4f263c7c4b9ab08f59577c133f7112b380487dacc1d75b2802488a53dcb23d", + "zh:42d375186f222f42274eb2343c66301ea33cc3d6220cf36ccd19caceec8c749e", + "zh:59c4444032b29bb22df5236bf768d76d280b9fb52642579c99752e5ce1c7664c", + "zh:646d85575752b76d48fd33a7528f2af02c85270ea24981008d3fb2e9eb446e3b", + "zh:888586850d55e6270d7f8f86f48488c8eb75a595f57d2b0c33ffe786b67cc7a4", + "zh:8acf6aea1cc78256187fd27d3f2935e561e4ae487123347cffcf2bd567f31693", + "zh:8f42211e88b08ed54cb7a608770533fd11e20387830c111def54efd6a24c4b90", + "zh:a0d5670d6d17267b0ef8342fde2cbaa034fa9bb79921ab0ee378df4661ef2076", + "zh:c8a940014de1d1a23bb23dbaeb909d2644f0e1379858b398b8ad173f892a9022", + "zh:d4555331bfe6a6601ece25740a2cbac240ddb72f5ebdbf26778e40e8608afc44", + "zh:f0781a219a72b93282f82bcc75a0ef5e2c2e7e4da48e0d339acc0f28d07446a6", + "zh:f9b1455886ab9716b3d243367bc26e9ac836e281894024aa1d1b7f16f886ca0b", + ] +} + +provider "registry.terraform.io/hashicorp/aws" { + version = "5.41.0" + constraints = ">= 3.0.0, >= 4.48.0, ~> 5.0, >= 5.30.0, >= 5.34.0" + hashes = [ + "h1:DiX7N35G2NUQRyRGy90+gyePnhP4w77f8LrJUronotE=", + "h1:SgIWBDBA1uNB/Y7CaLFeNX/Ju2xboSSQmRv35Vbi46M=", + "h1:uNln7837/ZTVgQBk+hhfgB9Y87icES6X0lMSOfK5c7g=", + "zh:0553331a6287c146353b6daf6f71987d8c000f407b5e29d6e004ea88faec2e67", + "zh:1a11118984bb2950e8ee7ef17b0f91fc9eb4a42c8e7a9cafd7eb4aca771d06e4", + "zh:236fedd266d152a8233a7fe27ffdd99ca27d9e66a9618a988a4c3da1ac24a33f", + "zh:34bc482ea04cf30d4d216afa55eecf66854e1acf93892cb28a6b5af91d43c9b7", + "zh:39d7eb15832fe339bf46e3bab9852280762a1817bf1afc459eecd430e20e3ad5", + "zh:39fb07429c51556b05170ec2b6bd55e2487adfe1606761eaf1f2a43c4bb20e47", + "zh:71d7cd3013e2f3fa0f65194af29ee6f5fa905e0df2b72b723761dc953f4512ea", + "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", + "zh:9b271ae12394e7e2ce6da568b42226a146e90fd705e02a670fcb93618c4aa19f", + "zh:a884dd978859d001709681f9513ba0fbb0753d1d459a7f3434ecc5f1b8699c49", + "zh:b8c3c7dc10ae4f6143168042dcf8dee63527b103cc37abc238ea06150af38b6e", + "zh:ba94ffe0893ad60c0b70c402e163b4df2cf417e93474a9cc1a37535bba18f22d", + "zh:d5ba851d971ff8d796afd9a100acf55eaac0c197c6ab779787797ce66f419f0e", + "zh:e8c090d0c4f730c4a610dc4f0c22b177a0376d6f78679fc3f1d557b469e656f4", + "zh:ed7623acde26834672969dcb5befdb62900d9f216d32e7478a095d2b040a0ea7", + ] +} + +provider "registry.terraform.io/hashicorp/helm" { + version = "2.12.1" + constraints = ">= 2.6.0" + hashes = [ + "h1:7wfYOAeSEchHB8idNl+2jf+OkFi9zFSOLWkEZFuTCik=", + "h1:aBfcqM4cbywa7TAxfT1YoFS+Cst9waerlm4XErFmJlk=", + "h1:sgYI7lwGqJqPopY3NGmhb1eQ0YbH8PIXaAZAmnJrAvw=", + "zh:1d623fb1662703f2feb7860e3c795d849c77640eecbc5a776784d08807b15004", + "zh:253a5bc62ba2c4314875139e3fbd2feaad5ef6b0fb420302a474ab49e8e51a38", + "zh:282358f4ad4f20d0ccaab670b8645228bfad1c03ac0d0df5889f0aea8aeac01a", + "zh:4fd06af3091a382b3f0d8f0a60880f59640d2b6d9d6a31f9a873c6f1bde1ec50", + "zh:6816976b1830f5629ae279569175e88b497abbbac30ee809948a1f923c67a80d", + "zh:7d82c4150cdbf48cfeec867be94c7b9bd7682474d4df0ebb7e24e148f964844f", + "zh:83f062049eea2513118a4c6054fb06c8600bac96196f25aed2cc21898ec86e93", + "zh:a79eec0cf4c08fca79e44033ec6e470f25ff23c3e2c7f9bc707ed7771c1072c0", + "zh:b2b2d904b2821a6e579910320605bc478bbef063579a23fbfdd6fcb5871b81f8", + "zh:e91177ca06a15487fc570cb81ecef6359aa399459ea2aa7c4f7367ba86f6fcad", + "zh:e976bcb82996fc4968f8382bbcb6673efb1f586bf92074058a232028d97825b1", + "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c", + ] +} + +provider "registry.terraform.io/hashicorp/kubernetes" { + version = "2.27.0" + constraints = ">= 2.20.0" + hashes = [ + "h1:/3kLyOR2jTaWS1MKso4xAztrocGBMxi8yVadWiqSWOg=", + "h1:GzU0FzYAT/+IgAhnSBcFH3bT+4I5N6oSga6iZgNJAus=", + "h1:TrlG/sofnDv8kAbzKOD5pIPeUiI5VQY61NuWH+cItDw=", + "zh:3bdba30ae67c55dc7e9a317ac0da3b208ea7926fe9c2f0ae6587ee88dcc58d1f", + "zh:3f35138a831c00b188d2ffee27111dd0cf59afad2dd5653ed9e67d59646de12c", + "zh:64066d18f6ae9a316c2bc840ef3e641d7ab94e1ea3a41d12523e77345ad442ef", + "zh:653063d44b44881af3a480f7f8eaa94fa300e0229df2072d30f606bddcc9f025", + "zh:87f306e37efb61d13efa6da53a1e45e97e5996ebc0568b1caf8c3c5e54c05809", + "zh:8c428b9708f9634391e52300218771eab3fe942bb1295d8c0ad50ca4b33db3d9", + "zh:a44e87119a0337ded15479851786a13f412b413d9a463ba550d1210249206b0f", + "zh:aa2c4d110b0de6ef997c0d45f3f23f8a98f5530753095d6eff439a6d91a8ea31", + "zh:eb15ed8781ac6a0dec2f7d03cf090e23cfa05e3225806c6231ff2c574662fd63", + "zh:eb81c563f93bd3303f9620d11cd49f21f3f89ac3475c6d3e821b239feb9c217d", + "zh:f1a344a7f16131123577e4ec994d04a34ea458ec16c1ccac53fe7946bd817b18", + "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c", + ] +} + +provider "registry.terraform.io/hashicorp/null" { + version = "3.2.2" + constraints = ">= 3.0.0" + hashes = [ + "h1:IMVAUHKoydFrlPrl9OzasDnw/8ntZFerCC9iXw1rXQY=", + "h1:vWAsYRd7MjYr3adj8BVKRohVfHpWQdvkIwUQ2Jf5FVM=", + "h1:zT1ZbegaAYHwQa+QwIFugArWikRJI9dqohj8xb0GY88=", + "zh:3248aae6a2198f3ec8394218d05bd5e42be59f43a3a7c0b71c66ec0df08b69e7", + "zh:32b1aaa1c3013d33c245493f4a65465eab9436b454d250102729321a44c8ab9a", + "zh:38eff7e470acb48f66380a73a5c7cdd76cc9b9c9ba9a7249c7991488abe22fe3", + "zh:4c2f1faee67af104f5f9e711c4574ff4d298afaa8a420680b0cb55d7bbc65606", + "zh:544b33b757c0b954dbb87db83a5ad921edd61f02f1dc86c6186a5ea86465b546", + "zh:696cf785090e1e8cf1587499516b0494f47413b43cb99877ad97f5d0de3dc539", + "zh:6e301f34757b5d265ae44467d95306d61bef5e41930be1365f5a8dcf80f59452", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:913a929070c819e59e94bb37a2a253c228f83921136ff4a7aa1a178c7cce5422", + "zh:aa9015926cd152425dbf86d1abdbc74bfe0e1ba3d26b3db35051d7b9ca9f72ae", + "zh:bb04798b016e1e1d49bcc76d62c53b56c88c63d6f2dfe38821afef17c416a0e1", + "zh:c23084e1b23577de22603cff752e59128d83cfecc2e6819edadd8cf7a10af11e", + ] +} + +provider "registry.terraform.io/hashicorp/random" { + version = "3.6.0" + constraints = ">= 2.0.0, >= 3.0.0" + hashes = [ + "h1:I8MBeauYA8J8yheLJ8oSMWqB0kovn16dF/wKZ1QTdkk=", + "h1:R5Ucn26riKIEijcsiOMBR3uOAjuOMfI1x7XvH4P6B1w=", + "h1:p6WG1IPHnqx1fnJVKNjv733FBaArIugqy58HRZnpPCk=", + "zh:03360ed3ecd31e8c5dac9c95fe0858be50f3e9a0d0c654b5e504109c2159287d", + "zh:1c67ac51254ba2a2bb53a25e8ae7e4d076103483f55f39b426ec55e47d1fe211", + "zh:24a17bba7f6d679538ff51b3a2f378cedadede97af8a1db7dad4fd8d6d50f829", + "zh:30ffb297ffd1633175d6545d37c2217e2cef9545a6e03946e514c59c0859b77d", + "zh:454ce4b3dbc73e6775f2f6605d45cee6e16c3872a2e66a2c97993d6e5cbd7055", + "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", + "zh:91df0a9fab329aff2ff4cf26797592eb7a3a90b4a0c04d64ce186654e0cc6e17", + "zh:aa57384b85622a9f7bfb5d4512ca88e61f22a9cea9f30febaa4c98c68ff0dc21", + "zh:c4a3e329ba786ffb6f2b694e1fd41d413a7010f3a53c20b432325a94fa71e839", + "zh:e2699bc9116447f96c53d55f2a00570f982e6f9935038c3810603572693712d0", + "zh:e747c0fd5d7684e5bfad8aa0ca441903f15ae7a98a737ff6aca24ba223207e2c", + "zh:f1ca75f417ce490368f047b63ec09fd003711ae48487fba90b4aba2ccf71920e", + ] +} + +provider "registry.terraform.io/hashicorp/tls" { + version = "4.0.5" + constraints = ">= 3.1.0, != 4.0.0" + hashes = [ + "h1:e4LBdJoZJNOQXPWgOAG0UuPBVhCStu98PieNlqJTmeU=", + "h1:yLqz+skP3+EbU3yyvw8JqzflQTKDQGsC9QyZAg+S4dg=", + "h1:zeG5RmggBZW/8JWIVrdaeSJa0OG62uFX5HY1eE8SjzY=", + "zh:01cfb11cb74654c003f6d4e32bbef8f5969ee2856394a96d127da4949c65153e", + "zh:0472ea1574026aa1e8ca82bb6df2c40cd0478e9336b7a8a64e652119a2fa4f32", + "zh:1a8ddba2b1550c5d02003ea5d6cdda2eef6870ece86c5619f33edd699c9dc14b", + "zh:1e3bb505c000adb12cdf60af5b08f0ed68bc3955b0d4d4a126db5ca4d429eb4a", + "zh:6636401b2463c25e03e68a6b786acf91a311c78444b1dc4f97c539f9f78de22a", + "zh:76858f9d8b460e7b2a338c477671d07286b0d287fd2d2e3214030ae8f61dd56e", + "zh:a13b69fb43cb8746793b3069c4d897bb18f454290b496f19d03c3387d1c9a2dc", + "zh:a90ca81bb9bb509063b736842250ecff0f886a91baae8de65c8430168001dad9", + "zh:c4de401395936e41234f1956ebadbd2ed9f414e6908f27d578614aaa529870d4", + "zh:c657e121af8fde19964482997f0de2d5173217274f6997e16389e7707ed8ece8", + "zh:d68b07a67fbd604c38ec9733069fbf23441436fecf554de6c75c032f82e1ef19", + "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c", + ] +} diff --git a/examples/basic/README.md b/examples/basic/README.md deleted file mode 100644 index 6ea1673..0000000 --- a/examples/basic/README.md +++ /dev/null @@ -1,44 +0,0 @@ -# Basic example - -The code in this example shows how to use the module with basic configuration and minimal set of other resources. - - -## Requirements - -| Name | Version | -|------|---------| -| [terraform](#requirement\_terraform) | >= 1.0 | -| [aws](#requirement\_aws) | >= 5.0 | -| [helm](#requirement\_helm) | >= 2.6.0 | -| [kubernetes](#requirement\_kubernetes) | >= 2.11.0 | - -## Modules - -| Name | Source | Version | -|------|--------|---------| -| [eks\_cluster](#module\_eks\_cluster) | cloudposse/eks-cluster/aws | 0.45.0 | -| [eks\_node\_group](#module\_eks\_node\_group) | cloudposse/eks-node-group/aws | 0.28.0 | -| [lb\_controller\_argo\_helm](#module\_lb\_controller\_argo\_helm) | ../../ | n/a | -| [lb\_controller\_argo\_kubernetes](#module\_lb\_controller\_argo\_kubernetes) | ../../ | n/a | -| [lb\_controller\_helm](#module\_lb\_controller\_helm) | ../../ | n/a | -| [lbc\_disabled](#module\_lbc\_disabled) | ../../ | n/a | -| [lbc\_with\_eks\_pod\_identity\_role](#module\_lbc\_with\_eks\_pod\_identity\_role) | ../../ | n/a | -| [lbc\_without\_irsa\_policy](#module\_lbc\_without\_irsa\_policy) | ../../ | n/a | -| [lbc\_without\_irsa\_role](#module\_lbc\_without\_irsa\_role) | ../../ | n/a | -| [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | 5.5.1 | - -## Resources - -| Name | Type | -|------|------| -| [aws_eks_cluster.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source | -| [aws_eks_cluster_auth.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source | - -## Inputs - -No inputs. - -## Outputs - -No outputs. - diff --git a/examples/basic/base.tf b/examples/basic/base.tf new file mode 100644 index 0000000..3067b2a --- /dev/null +++ b/examples/basic/base.tf @@ -0,0 +1,33 @@ +module "vpc" { + source = "terraform-aws-modules/vpc/aws" + version = "5.6.0" + + name = "vpc" + cidr = "10.0.0.0/16" + azs = ["eu-central-1a", "eu-central-1b"] + private_subnets = ["10.0.1.0/24", "10.0.2.0/24"] + public_subnets = ["10.0.101.0/24", "10.0.102.0/24"] + enable_nat_gateway = true +} + +module "eks_cluster" { + source = "cloudposse/eks-cluster/aws" + version = "4.0.0" + + name = "eks" + region = data.aws_region.this.name + subnet_ids = module.vpc.public_subnets +} + +module "eks_node_group" { + source = "cloudposse/eks-node-group/aws" + version = "2.12.0" + + cluster_name = module.eks_cluster.eks_cluster_id + instance_types = ["t3.medium"] + subnet_ids = module.vpc.public_subnets + min_size = 1 + desired_size = 1 + max_size = 2 + depends_on = [module.eks_cluster.kubernetes_config_map_id] +} diff --git a/examples/basic/main.tf b/examples/basic/main.tf index 29aa233..1ee0786 100644 --- a/examples/basic/main.tf +++ b/examples/basic/main.tf @@ -1,38 +1,4 @@ -module "vpc" { - source = "terraform-aws-modules/vpc/aws" - version = "5.5.1" - - name = "lb_controller-vpc" - cidr = "10.0.0.0/16" - azs = ["eu-central-1a", "eu-central-1b"] - public_subnets = ["10.0.101.0/24", "10.0.102.0/24"] - enable_nat_gateway = true -} - -module "eks_cluster" { - source = "cloudposse/eks-cluster/aws" - version = "0.45.0" - - region = "eu-central-1" - subnet_ids = module.vpc.public_subnets - vpc_id = module.vpc.vpc_id - name = "lb_controller" -} - -module "eks_node_group" { - source = "cloudposse/eks-node-group/aws" - version = "0.28.0" - - cluster_name = "lb_controller" - instance_types = ["t3.medium"] - subnet_ids = module.vpc.public_subnets - min_size = 1 - desired_size = 1 - max_size = 2 - depends_on = [module.eks_cluster.kubernetes_config_map_id] -} - -module "lbc_disabled" { +module "addon_installation_disabled" { source = "../../" enabled = false @@ -40,64 +6,47 @@ module "lbc_disabled" { cluster_name = module.eks_cluster.eks_cluster_id cluster_identity_oidc_issuer = module.eks_cluster.eks_cluster_identity_oidc_issuer cluster_identity_oidc_issuer_arn = module.eks_cluster.eks_cluster_identity_oidc_issuer_arn - -} - -module "lbc_without_irsa_role" { - source = "../../" - - irsa_role_create = false - cluster_name = module.eks_cluster.eks_cluster_id - cluster_identity_oidc_issuer = module.eks_cluster.eks_cluster_identity_oidc_issuer - cluster_identity_oidc_issuer_arn = module.eks_cluster.eks_cluster_identity_oidc_issuer_arn - } -module "lbc_without_irsa_policy" { +module "addon_installation_helm" { source = "../../" - irsa_policy_enabled = false - cluster_name = module.eks_cluster.eks_cluster_id - cluster_identity_oidc_issuer = module.eks_cluster.eks_cluster_identity_oidc_issuer - cluster_identity_oidc_issuer_arn = module.eks_cluster.eks_cluster_identity_oidc_issuer_arn -} - -module "lbc_with_eks_pod_identity_role" { - source = "../../" + enabled = true + argo_enabled = false + argo_helm_enabled = false - eks_pod_identity_role_create = true - irsa_role_create = false cluster_name = module.eks_cluster.eks_cluster_id cluster_identity_oidc_issuer = module.eks_cluster.eks_cluster_identity_oidc_issuer cluster_identity_oidc_issuer_arn = module.eks_cluster.eks_cluster_identity_oidc_issuer_arn + values = yamlencode({ + # insert sample values here + }) } -module "lb_controller_helm" { +module "addon_installation_helm_pod_identity" { source = "../../" enabled = true argo_enabled = false argo_helm_enabled = false - cluster_name = module.eks_cluster.eks_cluster_id - cluster_identity_oidc_issuer = module.eks_cluster.eks_cluster_identity_oidc_issuer - cluster_identity_oidc_issuer_arn = module.eks_cluster.eks_cluster_identity_oidc_issuer_arn + cluster_name = module.eks_cluster.eks_cluster_id - helm_release_name = "aws-lbc-helm" - namespace = "aws-lb-controller-helm" + # Disable IRSA + irsa_role_create = false + + # Enable pod identity + pod_identity_role_create = true values = yamlencode({ - "podLabels" : { - "app" : "aws-lbc-helm" - } + # insert sample values here }) - - helm_timeout = 240 - helm_wait = true } -module "lb_controller_argo_kubernetes" { + +# Please, see README.md and Argo Kubernetes deployment method for implications of using Kubernetes installation method +module "addon_installation_argo_kubernetes" { source = "../../" enabled = true @@ -108,16 +57,17 @@ module "lb_controller_argo_kubernetes" { cluster_identity_oidc_issuer = module.eks_cluster.eks_cluster_identity_oidc_issuer cluster_identity_oidc_issuer_arn = module.eks_cluster.eks_cluster_identity_oidc_issuer_arn - helm_release_name = "aws-lbc-argo-kubernetes" - namespace = "aws-lb-controller-argo-kubernetes" + values = yamlencode({ + # insert sample values here + }) argo_sync_policy = { - "automated" : {} - "syncOptions" = ["CreateNamespace=true"] + automated = {} + syncOptions = ["CreateNamespace=true"] } } -module "lb_controller_argo_helm" { +module "addon_installation_argo_helm" { source = "../../" enabled = true @@ -128,12 +78,8 @@ module "lb_controller_argo_helm" { cluster_identity_oidc_issuer = module.eks_cluster.eks_cluster_identity_oidc_issuer cluster_identity_oidc_issuer_arn = module.eks_cluster.eks_cluster_identity_oidc_issuer_arn - helm_release_name = "aws-lbc-argo-helm" - namespace = "aws-lb-controller-argo-helm" - - argo_namespace = "argo" argo_sync_policy = { - "automated" : {} - "syncOptions" = ["CreateNamespace=true"] + automated = {} + syncOptions = ["CreateNamespace=true"] } } diff --git a/examples/basic/providers.tf b/examples/basic/providers.tf index 8b68fdf..2458d7e 100644 --- a/examples/basic/providers.tf +++ b/examples/basic/providers.tf @@ -1,6 +1,4 @@ -provider "aws" { - region = "eu-central-1" -} +data "aws_region" "this" {} data "aws_eks_cluster" "this" { name = module.eks_cluster.eks_cluster_id @@ -10,6 +8,16 @@ data "aws_eks_cluster_auth" "this" { name = module.eks_cluster.eks_cluster_id } +provider "aws" { + region = "eu-central-1" +} + +provider "kubernetes" { + host = data.aws_eks_cluster.this.endpoint + token = data.aws_eks_cluster_auth.this.token + cluster_ca_certificate = base64decode(data.aws_eks_cluster.this.certificate_authority[0].data) +} + provider "helm" { kubernetes { host = data.aws_eks_cluster.this.endpoint diff --git a/examples/basic/versions.tf b/examples/basic/versions.tf index 70d2ae4..ccd47b8 100644 --- a/examples/basic/versions.tf +++ b/examples/basic/versions.tf @@ -1,14 +1,14 @@ terraform { - required_version = ">= 1.0" + required_version = ">= 1.5.0" required_providers { aws = { source = "hashicorp/aws" - version = ">= 5.0" + version = "~> 5" } kubernetes = { source = "hashicorp/kubernetes" - version = ">= 2.11.0" + version = ">= 2.20.0" } helm = { source = "hashicorp/helm" diff --git a/helm.tf b/helm.tf deleted file mode 100644 index def0110..0000000 --- a/helm.tf +++ /dev/null @@ -1,64 +0,0 @@ -resource "helm_release" "this" { - count = var.enabled && var.helm_enabled && !var.argo_enabled ? 1 : 0 - chart = var.helm_chart_name - create_namespace = var.helm_create_namespace - namespace = var.namespace - name = var.helm_release_name - version = var.helm_chart_version - repository = var.helm_repo_url - - repository_key_file = var.helm_repo_key_file - repository_cert_file = var.helm_repo_cert_file - repository_ca_file = var.helm_repo_ca_file - repository_username = var.helm_repo_username - repository_password = var.helm_repo_password - devel = var.helm_devel - verify = var.helm_package_verify - keyring = var.helm_keyring - timeout = var.helm_timeout - disable_webhooks = var.helm_disable_webhooks - reset_values = var.helm_reset_values - reuse_values = var.helm_reuse_values - force_update = var.helm_force_update - recreate_pods = var.helm_recreate_pods - cleanup_on_fail = var.helm_cleanup_on_fail - max_history = var.helm_release_max_history - atomic = var.helm_atomic - wait = var.helm_wait - wait_for_jobs = var.helm_wait_for_jobs - skip_crds = var.helm_skip_crds - render_subchart_notes = var.helm_render_subchart_notes - disable_openapi_validation = var.helm_disable_openapi_validation - dependency_update = var.helm_dependency_update - replace = var.helm_replace - description = var.helm_description - lint = var.helm_lint - - values = [ - data.utils_deep_merge_yaml.values[0].output - ] - - dynamic "set" { - for_each = var.settings - content { - name = set.key - value = set.value - } - } - - dynamic "set_sensitive" { - for_each = var.helm_set_sensitive - content { - name = set_sensitive.key - value = set_sensitive.value - } - } - - dynamic "postrender" { - for_each = var.helm_postrender - content { - binary_path = postrender.value - } - } - -} diff --git a/helm/argocd-application/.helmignore b/helm/argocd-application/.helmignore deleted file mode 100644 index 0e8a0eb..0000000 --- a/helm/argocd-application/.helmignore +++ /dev/null @@ -1,23 +0,0 @@ -# Patterns to ignore when building packages. -# This supports shell glob matching, relative path matching, and -# negation (prefixed with !). Only one pattern per line. -.DS_Store -# Common VCS dirs -.git/ -.gitignore -.bzr/ -.bzrignore -.hg/ -.hgignore -.svn/ -# Common backup files -*.swp -*.bak -*.tmp -*.orig -*~ -# Various IDEs -.project -.idea/ -*.tmproj -.vscode/ diff --git a/helm/argocd-application/Chart.yaml b/helm/argocd-application/Chart.yaml deleted file mode 100644 index b450f61..0000000 --- a/helm/argocd-application/Chart.yaml +++ /dev/null @@ -1,18 +0,0 @@ -apiVersion: v2 -name: argocd-application -description: Helm wrapper for deploying ArgoCD application object - -# A chart can be either an 'application' or a 'library' chart. -# -# Application charts are a collection of templates that can be packaged into versioned archives -# to be deployed. -# -# Library charts provide useful utilities or functions for the chart developer. They're included as -# a dependency of application charts to inject those utilities and functions into the rendering -# pipeline. Library charts do not define any templates and therefore cannot be deployed. -type: application - -# This is the chart version. This version number should be incremented each time you make changes -# to the chart and its templates, including the app version. -# Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 0.1.0 diff --git a/helm/argocd-application/templates/_helpers.tpl b/helm/argocd-application/templates/_helpers.tpl deleted file mode 100644 index 6dac3de..0000000 --- a/helm/argocd-application/templates/_helpers.tpl +++ /dev/null @@ -1,51 +0,0 @@ -{{/* -Expand the name of the chart. -*/}} -{{- define "argocd_application.name" -}} -{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Create a default fully qualified app name. -We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). -If release name contains chart name it will be used as a full name. -*/}} -{{- define "argocd_application.fullname" -}} -{{- if .Values.fullnameOverride }} -{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- $name := default .Chart.Name .Values.nameOverride }} -{{- if contains $name .Release.Name }} -{{- .Release.Name | trunc 63 | trimSuffix "-" }} -{{- else }} -{{- printf "%s" .Release.Name | trunc 63 | trimSuffix "-" }} -{{- end }} -{{- end }} -{{- end }} - -{{/* -Create chart name and version as used by the chart label. -*/}} -{{- define "argocd_application.chart" -}} -{{- printf "%s" .Chart.Name | replace "+" "_" | trunc 63 | trimSuffix "-" }} -{{- end }} - -{{/* -Common labels -*/}} -{{- define "argocd_application.labels" -}} -helm.sh/chart: {{ include "argocd_application.chart" . }} -{{ include "argocd_application.selectorLabels" . }} -{{- if .Chart.AppVersion }} -app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} -{{- end }} -app.kubernetes.io/managed-by: {{ .Release.Service }} -{{- end }} - -{{/* -Selector labels -*/}} -{{- define "argocd_application.selectorLabels" -}} -app.kubernetes.io/name: {{ include "argocd_application.name" . }} -app.kubernetes.io/instance: {{ .Release.Name }} -{{- end }} diff --git a/helm/argocd-application/templates/application.yaml b/helm/argocd-application/templates/application.yaml deleted file mode 100644 index 3117c37..0000000 --- a/helm/argocd-application/templates/application.yaml +++ /dev/null @@ -1,19 +0,0 @@ -apiVersion: {{ .Values.apiVersion }} -kind: Application -metadata: - name: {{ include "argocd_application.fullname" . }} - labels: - {{- include "argocd_application.labels" . | nindent 4 }} - {{- if .Values.labels }} - {{ toYaml .Values.labels | nindent 4 }} - {{- end }} - annotations: - {{- if .Values.annotations }} - {{ toYaml .Values.annotations | indent 4 }} - {{- end }} - finalizers: - {{- if .Values.finalizers }} - {{ toYaml .Values.finalizers | indent 4 }} - {{- end }} -spec: - {{ toYaml .Values.spec | nindent 2 }} diff --git a/helm/argocd-application/values.yaml b/helm/argocd-application/values.yaml deleted file mode 100644 index 552d6da..0000000 --- a/helm/argocd-application/values.yaml +++ /dev/null @@ -1,2 +0,0 @@ -nameOverride: "" -fullnameOverride: "" diff --git a/iam.tf b/iam.tf index 78c4974..c4c9b3f 100644 --- a/iam.tf +++ b/iam.tf @@ -1,20 +1,17 @@ -locals { - irsa_role_create = var.enabled && var.service_account_create && var.irsa_role_create -} - data "aws_iam_policy_document" "this" { - count = (local.irsa_role_create && var.irsa_policy_enabled) || (local.eks_pod_identity_role_create && var.eks_pod_identity_policy_enabled) ? 1 : 0 + count = (var.enabled && (var.irsa_policy == null || var.pod_identity_policy == null)) ? 1 : 0 - # https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/v2.12.0/docs/install/iam_policy.json + # https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/v2.11.0/docs/install/iam_policy.json #checkov:skip=CKV_AWS_109:The official documentation was used to define these policies #checkov:skip=CKV_AWS_111:The official documentation was used to define these policies #checkov:skip=CKV_AWS_356 statement { effect = "Allow" actions = [ - "iam:CreateServiceLinkedRole" + "iam:CreateServiceLinkedRole", ] resources = ["*"] + condition { test = "StringEquals" variable = "iam:AWSServiceName" @@ -52,7 +49,7 @@ data "aws_iam_policy_document" "this" { "elasticloadbalancing:DescribeTags", "elasticloadbalancing:DescribeTrustStores", "elasticloadbalancing:DescribeListenerAttributes", - "elasticloadbalancing:DescribeCapacityReservation" + "elasticloadbalancing:DescribeCapacityReservation", ] resources = ["*"] } @@ -76,7 +73,7 @@ data "aws_iam_policy_document" "this" { "shield:GetSubscriptionState", "shield:DescribeProtection", "shield:CreateProtection", - "shield:DeleteProtection" + "shield:DeleteProtection", ] resources = ["*"] } @@ -85,7 +82,7 @@ data "aws_iam_policy_document" "this" { effect = "Allow" actions = [ "ec2:AuthorizeSecurityGroupIngress", - "ec2:RevokeSecurityGroupIngress" + "ec2:RevokeSecurityGroupIngress", ] resources = ["*"] } @@ -93,7 +90,7 @@ data "aws_iam_policy_document" "this" { statement { effect = "Allow" actions = [ - "ec2:CreateSecurityGroup" + "ec2:CreateSecurityGroup", ] resources = ["*"] } @@ -101,14 +98,16 @@ data "aws_iam_policy_document" "this" { statement { effect = "Allow" actions = [ - "ec2:CreateTags" + "ec2:CreateTags", ] resources = ["arn:${var.aws_partition}:ec2:*:*:security-group/*"] + condition { test = "StringEquals" variable = "ec2:CreateAction" values = ["CreateSecurityGroup"] } + condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" @@ -120,14 +119,16 @@ data "aws_iam_policy_document" "this" { effect = "Allow" actions = [ "ec2:CreateTags", - "ec2:DeleteTags" + "ec2:DeleteTags", ] resources = ["arn:${var.aws_partition}:ec2:*:*:security-group/*"] + condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["true"] } + condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" @@ -140,9 +141,10 @@ data "aws_iam_policy_document" "this" { actions = [ "ec2:AuthorizeSecurityGroupIngress", "ec2:RevokeSecurityGroupIngress", - "ec2:DeleteSecurityGroup" + "ec2:DeleteSecurityGroup", ] resources = ["*"] + condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" @@ -154,9 +156,10 @@ data "aws_iam_policy_document" "this" { effect = "Allow" actions = [ "elasticloadbalancing:CreateLoadBalancer", - "elasticloadbalancing:CreateTargetGroup" + "elasticloadbalancing:CreateTargetGroup", ] resources = ["*"] + condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" @@ -170,7 +173,7 @@ data "aws_iam_policy_document" "this" { "elasticloadbalancing:CreateListener", "elasticloadbalancing:DeleteListener", "elasticloadbalancing:CreateRule", - "elasticloadbalancing:DeleteRule" + "elasticloadbalancing:DeleteRule", ] resources = ["*"] } @@ -179,18 +182,20 @@ data "aws_iam_policy_document" "this" { effect = "Allow" actions = [ "elasticloadbalancing:AddTags", - "elasticloadbalancing:RemoveTags" + "elasticloadbalancing:RemoveTags", ] resources = [ "arn:${var.aws_partition}:elasticloadbalancing:*:*:targetgroup/*/*", "arn:${var.aws_partition}:elasticloadbalancing:*:*:loadbalancer/net/*/*", "arn:${var.aws_partition}:elasticloadbalancing:*:*:loadbalancer/app/*/*" ] + condition { test = "Null" variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["true"] } + condition { test = "Null" variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" @@ -202,7 +207,7 @@ data "aws_iam_policy_document" "this" { effect = "Allow" actions = [ "elasticloadbalancing:AddTags", - "elasticloadbalancing:RemoveTags" + "elasticloadbalancing:RemoveTags", ] resources = [ "arn:${var.aws_partition}:elasticloadbalancing:*:*:listener/net/*/*/*", @@ -215,48 +220,50 @@ data "aws_iam_policy_document" "this" { statement { effect = "Allow" actions = [ - "elasticloadbalancing:AddTags" + "elasticloadbalancing:ModifyLoadBalancerAttributes", + "elasticloadbalancing:SetIpAddressType", + "elasticloadbalancing:SetSecurityGroups", + "elasticloadbalancing:SetSubnets", + "elasticloadbalancing:DeleteLoadBalancer", + "elasticloadbalancing:ModifyTargetGroup", + "elasticloadbalancing:ModifyTargetGroupAttributes", + "elasticloadbalancing:DeleteTargetGroup", + "elasticloadbalancing:ModifyListenerAttributes", + "elasticloadbalancing:ModifyCapacityReservation", + "elasticloadbalancing:ModifyIpPools", + ] + resources = ["*"] + + condition { + test = "Null" + variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" + values = ["false"] + } + } + + statement { + effect = "Allow" + actions = [ + "elasticloadbalancing:AddTags", ] resources = [ "arn:${var.aws_partition}:elasticloadbalancing:*:*:targetgroup/*/*", "arn:${var.aws_partition}:elasticloadbalancing:*:*:loadbalancer/net/*/*", "arn:${var.aws_partition}:elasticloadbalancing:*:*:loadbalancer/app/*/*" ] + condition { test = "StringEquals" variable = "elasticloadbalancing:CreateAction" values = [ "CreateTargetGroup", - "CreateLoadBalancer" + "CreateLoadBalancer", ] } - condition { - test = "Null" - variable = "aws:RequestTag/elbv2.k8s.aws/cluster" - values = ["false"] - - } - } - statement { - effect = "Allow" - actions = [ - "elasticloadbalancing:ModifyLoadBalancerAttributes", - "elasticloadbalancing:SetIpAddressType", - "elasticloadbalancing:SetSecurityGroups", - "elasticloadbalancing:SetSubnets", - "elasticloadbalancing:DeleteLoadBalancer", - "elasticloadbalancing:ModifyTargetGroup", - "elasticloadbalancing:ModifyTargetGroupAttributes", - "elasticloadbalancing:DeleteTargetGroup", - "elasticloadbalancing:ModifyListenerAttributes", - "elasticloadbalancing:ModifyCapacityReservation", - "elasticloadbalancing:ModifyIpPools" - ] - resources = ["*"] condition { test = "Null" - variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" + variable = "aws:RequestTag/elbv2.k8s.aws/cluster" values = ["false"] } } @@ -265,7 +272,7 @@ data "aws_iam_policy_document" "this" { effect = "Allow" actions = [ "elasticloadbalancing:RegisterTargets", - "elasticloadbalancing:DeregisterTargets" + "elasticloadbalancing:DeregisterTargets", ] resources = ["arn:${var.aws_partition}:elasticloadbalancing:*:*:targetgroup/*/*"] } @@ -278,58 +285,8 @@ data "aws_iam_policy_document" "this" { "elasticloadbalancing:AddListenerCertificates", "elasticloadbalancing:RemoveListenerCertificates", "elasticloadbalancing:ModifyRule", - "elasticloadbalancing:SetRulePriorities" + "elasticloadbalancing:SetRulePriorities", ] resources = ["*"] } } - -resource "aws_iam_policy" "this" { - count = local.irsa_role_create && var.irsa_policy_enabled ? 1 : 0 - name = "${var.irsa_role_name_prefix}-${var.helm_release_name}" - path = "/" - description = "Policy for aws-load-balancer-controller service" - - policy = data.aws_iam_policy_document.this[0].json - tags = var.irsa_tags -} - -data "aws_iam_policy_document" "this_assume" { - count = local.irsa_role_create ? 1 : 0 - - statement { - actions = ["sts:AssumeRoleWithWebIdentity"] - - principals { - type = "Federated" - identifiers = [var.cluster_identity_oidc_issuer_arn] - } - - condition { - test = "StringEquals" - variable = "${replace(var.cluster_identity_oidc_issuer, "https://", "")}:sub" - - values = [ - "system:serviceaccount:${var.namespace}:${var.service_account_name}", - ] - } - - effect = "Allow" - } -} - -resource "aws_iam_role" "this" { - count = local.irsa_role_create ? 1 : 0 - - name = "${var.irsa_role_name_prefix}-${var.helm_release_name}" - assume_role_policy = data.aws_iam_policy_document.this_assume[0].json - - tags = var.irsa_tags -} - -resource "aws_iam_role_policy_attachment" "this" { - count = local.irsa_role_create ? 1 : 0 - - role = aws_iam_role.this[0].name - policy_arn = aws_iam_policy.this[0].arn -} diff --git a/main.tf b/main.tf new file mode 100644 index 0000000..f277472 --- /dev/null +++ b/main.tf @@ -0,0 +1,37 @@ +/** + * # AWS EKS Load Balancer Controller Terraform module + * + * A Terraform module to deploy the AWS Load Balancer Controller on Amazon EKS cluster. + * + * [![Terraform validate](https://github.com/lablabs/terraform-aws-eks-load-balancer-controller/actions/workflows/validate.yaml) + * [![pre-commit](https://github.com/lablabs/terraform-aws-eks-load-balancer-controller/actions/workflows/pre-commit.yml) + */ +locals { + addon = { + name = "aws-load-balancer-controller" + + helm_chart_name = "aws-load-balancer-controller" + helm_chart_version = "1.12.0" + helm_repo_url = "https://aws.github.io/eks-charts" + } + + addon_irsa = { + (local.addon.name) = { + irsa_policy_enabled = var.irsa_policy_enabled != null ? var.irsa_policy_enabled : true + irsa_policy = (var.enabled && var.irsa_policy != null) ? var.irsa_policy : data.aws_iam_policy_document.this[0].json + } + } + + addon_values = yamlencode({ + serviceAccount = { + create = var.service_account_create != null ? var.service_account_create : true + name = var.service_account_name != null ? var.service_account_name : local.addon.name + annotations = module.addon-irsa[local.addon.name].irsa_role_enabled ? { + "eks.amazonaws.com/role-arn" = module.addon-irsa[local.addon.name].iam_role_attributes.arn + } : tomap({}) + } + podMutatorWebhookConfig = { + failurePolicy = "Fail" + } + }) +} diff --git a/outputs.tf b/outputs.tf deleted file mode 100644 index 7a4f97c..0000000 --- a/outputs.tf +++ /dev/null @@ -1,19 +0,0 @@ -output "helm_release_metadata" { - description = "Helm release attributes" - value = try(helm_release.this[0].metadata, {}) -} - -output "helm_release_application_metadata" { - description = "Argo application helm release attributes" - value = try(helm_release.argo_application[0].metadata, {}) -} - -output "kubernetes_application_attributes" { - description = "Argo kubernetes manifest attributes" - value = try(kubernetes_manifest.this[0], {}) -} - -output "iam_role_attributes" { - description = "IAM role atributes" - value = try(aws_iam_role.this[0], {}) -} diff --git a/pod_identity.tf b/pod_identity.tf new file mode 100644 index 0000000..e656d82 --- /dev/null +++ b/pod_identity.tf @@ -0,0 +1,70 @@ +locals { + service_account_create = var.service_account_create != null ? var.service_account_create : true + service_account_name = var.service_account_name != null ? var.service_account_name : try(local.addon.name) + service_account_namespace = var.service_account_namespace != null ? var.service_account_namespace : local.addon_namespace + rbac_create = var.rbac_create != null ? var.rbac_create : true + pod_identity_role_create = var.enabled && local.rbac_create && local.service_account_create && var.pod_identity_role_create + pod_identity_role_name = var.pod_identity_role_name != null ? var.pod_identity_role_name : trim("${var.pod_identity_role_name_prefix}-${local.addon.name}", "-") + pod_identity_policy = var.pod_identity_policy != null ? var.pod_identity_policy : data.aws_iam_policy_document.this[0].json +} + +data "aws_iam_policy_document" "pod_identity" { + count = local.pod_identity_role_create ? 1 : 0 + + statement { + actions = [ + "sts:AssumeRole", + "sts:TagSession", + ] + + principals { + type = "Service" + identifiers = ["pods.eks.amazonaws.com"] + } + + effect = "Allow" + } +} + +resource "aws_iam_policy" "pod_identity" { + count = local.pod_identity_role_create && (var.pod_identity_policy_enabled) ? 1 : 0 + name = local.pod_identity_role_name # tflint-ignore: aws_iam_policy_invalid_name + description = "Policy for aws-load-balancer-controller service" + + policy = local.pod_identity_policy + tags = var.pod_identity_tags +} + +resource "aws_iam_role" "pod_identity" { + count = local.pod_identity_role_create ? 1 : 0 + + name = local.pod_identity_role_name # tflint-ignore: aws_iam_role_invalid_name + assume_role_policy = data.aws_iam_policy_document.pod_identity[0].json + permissions_boundary = var.pod_identity_permissions_boundary + + tags = var.pod_identity_tags +} + +resource "aws_iam_role_policy_attachment" "pod_identity" { + count = local.pod_identity_role_create && (var.pod_identity_policy_enabled) ? 1 : 0 + + role = aws_iam_role.pod_identity[0].name + policy_arn = aws_iam_policy.pod_identity[0].arn +} + +resource "aws_iam_role_policy_attachment" "pod_identity_additional" { + for_each = local.pod_identity_role_create ? var.pod_identity_additional_policies : {} + + role = aws_iam_role.pod_identity[0].name + policy_arn = each.value +} + +resource "aws_eks_pod_identity_association" "pod_identity" { + count = local.pod_identity_role_create ? 1 : 0 + + cluster_name = var.cluster_name + namespace = local.service_account_namespace + service_account = local.service_account_name + role_arn = aws_iam_role.pod_identity[0].arn + tags = var.pod_identity_tags +} diff --git a/requirements.txt b/requirements.txt index cde6311..e22b84c 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1 +1,2 @@ -checkov==2.4.25 +python-hcl2==5.1.1 +Jinja2==3.1.4 diff --git a/scripts/sync-variables.py b/scripts/sync-variables.py new file mode 100755 index 0000000..6786b71 --- /dev/null +++ b/scripts/sync-variables.py @@ -0,0 +1,95 @@ +#!/usr/bin/env python + +import os +import hcl2 +import re +import argparse +import logging +from jinja2 import Environment, FileSystemLoader + +def filter_terraform_type(value): + # Currently there is a limition in handling Terraform complex types + # https://github.com/amplify-education/python-hcl2/issues/179 + # https://github.com/amplify-education/python-hcl2/issues/172 + if isinstance(value, str): + return re.sub(r'\${(.*)}', r'\1', value) + return value + +def filter_terraform_default(value): + if isinstance(value, bool): + return str(value).lower() + + if isinstance(value, str): + if value == "": + return '\\"\\"' + + if value == None: + return 'null' + + return re.sub(r'\'', r'\\"', str(value)) + +def get_template(): + env = Environment(loader=FileSystemLoader(".")) + env.filters['terraform_type'] = filter_terraform_type + env.filters['terraform_default'] = filter_terraform_default + + return env.from_string("""# IMPORTANT: This file is synced with the "terraform-aws-eks-universal-addon" module. Any changes to this file might be overwritten upon the next release of that module. +{%- for variable in variables %} +{%- for name, spec in variable.items() %} +{%- if name != 'enabled' %} +variable "{{ name }}" { + type = {{ spec.type | terraform_type }} + default = null + description = "{{ spec.description }}{% if spec.default is defined %} Defaults to `{{ spec.default | terraform_default }}`.{% endif %}" +} +{%- endif %} +{%- endfor %} +{% endfor %} +""") + +def get_logger(args): + log_level = args.log.upper() + + numeric_level = getattr(logging, log_level, None) + if not isinstance(numeric_level, int): + raise ValueError('Invalid log level `%s`' % log_level) + + logging.basicConfig(format='%(levelname)s: %(message)s', level=numeric_level) + + return logging.getLogger(__name__) + +def main(args): + log = get_logger(args) + log.info("Syncing variables from Terraform modules...") + log.warning("Terraform variable complex types are NOT supported!") + + template = get_template() + + for module in os.listdir('.terraform/modules'): # Iterate over all initialized modules + if not module.startswith('addon') or module.find(".") != -1: # Skip non-addon modules, ie. nested modules + log.info("Skipping module `%s`", module) + continue + + log.info("Processing module `%s`", module) + + source = '.terraform/modules/'+module+'/modules/'+module+'/variables.tf' + target = 'variables-'+module+'.tf' + + with open(source, 'r') as f: + log.info("Reading variables from `%s`", source) + + variables = hcl2.load(f).get('variable') + log.info("Collected variables: %d", len(variables)) + log.debug(variables) + + with open(target, "w") as f: + log.info("Writing variables to `%s`", target) + f.write(template.render(variables=variables)) + +if __name__ == "__main__": + parser = argparse.ArgumentParser(description='Sync Terraform variables from the local addon modules to proxy variable files') + parser.add_argument('--log', default='INFO', help='Set the logging level (DEBUG, INFO, WARNING, ERROR, CRITICAL)') + + args = parser.parse_args() + + main(args) diff --git a/values.tf b/values.tf deleted file mode 100644 index 39d111d..0000000 --- a/values.tf +++ /dev/null @@ -1,23 +0,0 @@ -locals { - values = yamlencode({ - "clusterName" : var.cluster_name - "serviceAccount" : { - "create" : var.service_account_create - "name" : var.service_account_name - "annotations" : { - "eks.amazonaws.com/role-arn" : local.irsa_role_create ? aws_iam_role.this[0].arn : "" - } - } - "podMutatorWebhookConfig" : { - "failurePolicy" : "Fail" - } - }) -} - -data "utils_deep_merge_yaml" "values" { - count = var.enabled ? 1 : 0 - input = compact([ - local.values, - var.values - ]) -} diff --git a/variables-addon-irsa.tf b/variables-addon-irsa.tf new file mode 100644 index 0000000..60e505a --- /dev/null +++ b/variables-addon-irsa.tf @@ -0,0 +1,109 @@ +# IMPORTANT: This file is synced with the "terraform-aws-eks-universal-addon" module. Any changes to this file might be overwritten upon the next release of that module. + +variable "cluster_identity_oidc_issuer" { + type = string + default = null + description = "The OIDC Identity issuer for the cluster (required)." +} + +variable "cluster_identity_oidc_issuer_arn" { + type = string + default = null + description = "The OIDC Identity issuer ARN for the cluster that can be used to associate IAM roles with a Service Account (required)." +} + +variable "rbac_create" { + type = bool + default = null + description = "Whether to create and use RBAC resources. Defaults to `true`." +} + +variable "service_account_create" { + type = bool + default = null + description = "Whether to create Service Account. Defaults to `true`." +} + +variable "service_account_name" { + type = string + default = null + description = "The Kubernetes Service Account name. Defaults to the addon name. Defaults to `\"\"`." +} + +variable "service_account_namespace" { + type = string + default = null + description = "The Kubernetes Service Account namespace. Defaults to the addon namespace. Defaults to `\"\"`." +} + +variable "irsa_role_create" { + type = bool + default = null + description = "Whether to create IRSA role and annotate Service Account. Defaults to `true`." +} + +variable "irsa_role_name_prefix" { + type = string + default = null + description = "IRSA role name prefix. Either `irsa_role_name_prefix` or `irsa_role_name` must be set. Defaults to `\"\"`." +} + +variable "irsa_role_name" { + type = string + default = null + description = "IRSA role name. The value is prefixed by `irsa_role_name_prefix`. Either `irsa_role_name` or `irsa_role_name_prefix` must be set. Defaults to `\"\"`." +} + +variable "irsa_policy_enabled" { + type = bool + default = null + description = "Whether to create IAM policy specified by `irsa_policy`. Mutually exclusive with `irsa_assume_role_enabled`. Defaults to `false`." +} + +variable "irsa_policy" { + type = string + default = null + description = "AWS IAM policy JSON document to be attached to the IRSA role. Applied only if `irsa_policy_enabled` is `true`. Defaults to `\"\"`." +} + +variable "irsa_assume_role_enabled" { + type = bool + default = null + description = "Whether IRSA is allowed to assume role defined by `irsa_assume_role_arn`. Mutually exclusive with `irsa_policy_enabled`. Defaults to `false`." +} + +variable "irsa_assume_role_arns" { + type = list(string) + default = null + description = "List of ARNs assumable by the IRSA role. Applied only if `irsa_assume_role_enabled` is `true`. Defaults to `[]`." +} + +variable "irsa_permissions_boundary" { + type = string + default = null + description = "ARN of the policy that is used to set the permissions boundary for the IRSA role. Defaults to `null`." +} + +variable "irsa_additional_policies" { + type = map(string) + default = null + description = "Map of the additional policies to be attached to IRSA role. Where key is arbitrary id and value is policy ARN. Defaults to `{}`." +} + +variable "irsa_tags" { + type = map(string) + default = null + description = "IRSA resources tags. Defaults to `{}`." +} + +variable "irsa_assume_role_policy_condition_test" { + type = string + default = null + description = "Specifies the condition test to use for the assume role trust policy. Defaults to `StringEquals`." +} + +variable "irsa_assume_role_policy_condition_values" { + type = list(string) + default = null + description = "Specifies the values for the assume role trust policy condition. Each entry in this list must follow the required format `system:serviceaccount:$service_account_namespace:$service_account_name`. If this variable is left as the default, `local.irsa_assume_role_policy_condition_values_default` is used instead, which is a list containing a single value. Note that if this list is defined, the `service_account_name` and `service_account_namespace` variables are ignored. Defaults to `[]`." +} diff --git a/variables-addon.tf b/variables-addon.tf new file mode 100644 index 0000000..938a7a8 --- /dev/null +++ b/variables-addon.tf @@ -0,0 +1,379 @@ +# IMPORTANT: This file is synced with the "terraform-aws-eks-universal-addon" module. Any changes to this file might be overwritten upon the next release of that module. + +variable "helm_enabled" { + type = bool + default = null + description = "Set to false to prevent installation of the module via Helm release. Defaults to `true`." +} + +variable "helm_chart_name" { + type = string + default = null + description = "Helm chart name to be installed. Required if `argo_source_type` is set to `helm`. Defaults to `null`." +} + +variable "helm_chart_version" { + type = string + default = null + description = "Version of the Helm chart. Required if `argo_source_type` is set to `helm`. Defaults to `null`." +} + +variable "helm_release_name" { + type = string + default = null + description = "Helm release name. Required if `argo_source_type` is set to `helm`. Defaults to `null`." +} + +variable "helm_repo_url" { + type = string + default = null + description = "Helm repository. Required if `argo_source_type` is set to `helm`. Defaults to `null`." +} + +variable "helm_create_namespace" { + type = bool + default = null + description = "Create the Namespace if it does not yet exist. Defaults to `true`." +} + +variable "namespace" { + type = string + default = null + description = "The Kubernetes Namespace in which the Helm chart will be installed (required)." +} + +variable "settings" { + type = map(any) + default = null + description = "Additional Helm sets which will be passed to the Helm chart values or Kustomize or directory configuration which will be passed to ArgoCD Application source. Defaults to `{}`." +} + +variable "values" { + type = string + default = null + description = "Additional YAML encoded values which will be passed to the Helm chart. Defaults to `\"\"`." +} + +variable "argo_name" { + type = string + default = null + description = "Name of the ArgoCD Application. Required if `argo_source_type` is set to `kustomize` or `directory`. If `argo_source_type` is set to `helm`, ArgoCD Application name will equal `helm_release_name`. Defaults to `null`." +} + +variable "argo_namespace" { + type = string + default = null + description = "Namespace to deploy ArgoCD Application to. Defaults to `argo`." +} + +variable "argo_enabled" { + type = bool + default = null + description = "If set to `true`, the module will be deployed as ArgoCD Application, otherwise it will be deployed as a Helm release. Defaults to `false`." +} + +variable "argo_helm_enabled" { + type = bool + default = null + description = "If set to `true`, the ArgoCD Application manifest will be deployed using Kubernetes provider as a Helm release. Otherwise it'll be deployed as a Kubernetes manifest. See README for more info. Defaults to `false`." +} + +variable "argo_helm_wait_timeout" { + type = string + default = null + description = "Timeout for ArgoCD Application Helm release wait job. Defaults to `10m`." +} + +variable "argo_helm_wait_node_selector" { + type = map(string) + default = null + description = "Node selector for ArgoCD Application Helm release wait job. Defaults to `{}`." +} + +variable "argo_helm_wait_tolerations" { + type = list(any) + default = null + description = "Tolerations for ArgoCD Application Helm release wait job. Defaults to `[]`." +} + +variable "argo_helm_wait_backoff_limit" { + type = number + default = null + description = "Backoff limit for ArgoCD Application Helm release wait job. Defaults to `6`." +} + +variable "argo_helm_wait_kubectl_version" { + type = string + default = null + description = "Version of kubectl to use for ArgoCD Application wait job. Defaults to `1.32.3`." +} + +variable "argo_source_type" { + type = string + default = null + description = "Source type for ArgoCD Application. Can be either `helm`, `kustomize`, or `directory`. Defaults to `helm`." +} + +variable "argo_source_repo_url" { + type = string + default = null + description = "ArgoCD Application source repo URL. Required if `argo_source_type` is set to `kustomize` or `directory`. Defaults to `null`." +} + +variable "argo_source_target_revision" { + type = string + default = null + description = "ArgoCD Application source target revision. Required if `argo_source_type` is set to `kustomize` or `directory`. Defaults to `null`." +} + +variable "argo_source_path" { + type = string + default = null + description = "ArgoCD Application source path. Required if `argo_source_type` is set to `kustomize` or `directory`. Defaults to `null`." +} + +variable "argo_destination_server" { + type = string + default = null + description = "Destination server for ArgoCD Application. Defaults to `https://kubernetes.default.svc`." +} + +variable "argo_project" { + type = string + default = null + description = "ArgoCD Application project. Defaults to `default`." +} + +variable "argo_info" { + type = list(any) + default = null + description = "ArgoCD Application manifest info parameter. Defaults to `[{\"name\": \"terraform\", \"value\": \"true\"}]`." +} + +variable "argo_sync_policy" { + type = any + default = null + description = "ArgoCD Application manifest syncPolicy parameter. Defaults to `{}`." +} + +variable "argo_metadata" { + type = any + default = null + description = "ArgoCD Application metadata configuration. Override or create additional metadata parameters. Defaults to `{\"finalizers\": [\"resources-finalizer.argocd.argoproj.io\"]}`." +} + +variable "argo_apiversion" { + type = string + default = null + description = "ArgoCD Application apiVersion. Defaults to `argoproj.io/v1alpha1`." +} + +variable "argo_spec" { + type = any + default = null + description = "ArgoCD Application spec configuration. Override or create additional spec parameters. Defaults to `{}`." +} + +variable "argo_operation" { + type = any + default = null + description = "ArgoCD Application manifest operation parameter. Defaults to `{}`." +} + +variable "argo_helm_values" { + type = string + default = null + description = "Value overrides to use when deploying ArgoCD Application object with Helm. Defaults to `\"\"`." +} + +variable "argo_kubernetes_manifest_computed_fields" { + type = list(string) + default = null + description = "List of paths of fields to be handled as \"computed\". The user-configured value for the field will be overridden by any different value returned by the API after apply. Defaults to `[\"metadata.labels\", \"metadata.annotations\", \"metadata.finalizers\"]`." +} + +variable "argo_kubernetes_manifest_field_manager_name" { + type = string + default = null + description = "The name of the field manager to use when applying the Kubernetes manifest resource. Defaults to `Terraform`." +} + +variable "argo_kubernetes_manifest_field_manager_force_conflicts" { + type = bool + default = null + description = "Forcibly override any field manager conflicts when applying the kubernetes manifest resource. Defaults to `false`." +} + +variable "argo_kubernetes_manifest_wait_fields" { + type = map(string) + default = null + description = "A map of fields and a corresponding regular expression with a pattern to wait for. The provider will wait until the field matches the regular expression. Use * for any value. Defaults to `{}`." +} + +variable "helm_repo_key_file" { + type = string + default = null + description = "Helm repositories cert key file. Defaults to `\"\"`." +} + +variable "helm_repo_cert_file" { + type = string + default = null + description = "Helm repositories cert file. Defaults to `\"\"`." +} + +variable "helm_repo_ca_file" { + type = string + default = null + description = "Helm repositories CA cert file. Defaults to `\"\"`." +} + +variable "helm_repo_username" { + type = string + default = null + description = "Username for HTTP basic authentication against the Helm repository. Defaults to `\"\"`." +} + +variable "helm_repo_password" { + type = string + default = null + description = "Password for HTTP basic authentication against the Helm repository. Defaults to `\"\"`." +} + +variable "helm_devel" { + type = bool + default = null + description = "Use Helm chart development versions, too. Equivalent to version '>0.0.0-0'. If version is set, this is ignored. Defaults to `false`." +} + +variable "helm_package_verify" { + type = bool + default = null + description = "Verify the package before installing it. Helm uses a provenance file to verify the integrity of the chart; this must be hosted alongside the chart. Defaults to `false`." +} + +variable "helm_keyring" { + type = string + default = null + description = "Location of public keys used for verification. Used only if `helm_package_verify` is `true`. Defaults to `~/.gnupg/pubring.gpg`." +} + +variable "helm_timeout" { + type = number + default = null + description = "Time in seconds to wait for any individual Kubernetes operation (like Jobs for hooks). Defaults to `300`." +} + +variable "helm_disable_webhooks" { + type = bool + default = null + description = "Prevent Helm chart hooks from running. Defaults to `false`." +} + +variable "helm_reset_values" { + type = bool + default = null + description = "When upgrading, reset the values to the ones built into the Helm chart. Defaults to `false`." +} + +variable "helm_reuse_values" { + type = bool + default = null + description = "When upgrading, reuse the last Helm release's values and merge in any overrides. If `helm_reset_values` is specified, this is ignored. Defaults to `false`." +} + +variable "helm_force_update" { + type = bool + default = null + description = "Force Helm resource update through delete/recreate if needed. Defaults to `false`." +} + +variable "helm_recreate_pods" { + type = bool + default = null + description = "Perform pods restart during Helm upgrade/rollback. Defaults to `false`." +} + +variable "helm_cleanup_on_fail" { + type = bool + default = null + description = "Allow deletion of new resources created in this Helm upgrade when upgrade fails. Defaults to `false`." +} + +variable "helm_release_max_history" { + type = number + default = null + description = "Maximum number of release versions stored per release. Defaults to `0`." +} + +variable "helm_atomic" { + type = bool + default = null + description = "If set, installation process purges chart on fail. The wait flag will be set automatically if atomic is used. Defaults to `false`." +} + +variable "helm_wait" { + type = bool + default = null + description = "Will wait until all Helm release resources are in a ready state before marking the release as successful. It will wait for as long as timeout. Defaults to `false`." +} + +variable "helm_wait_for_jobs" { + type = bool + default = null + description = "If wait is enabled, will wait until all Helm Jobs have been completed before marking the release as successful. It will wait for as long as timeout. Defaults to `false`." +} + +variable "helm_skip_crds" { + type = bool + default = null + description = "If set, no CRDs will be installed before Helm release. Defaults to `false`." +} + +variable "helm_render_subchart_notes" { + type = bool + default = null + description = "If set, render Helm subchart notes along with the parent. Defaults to `true`." +} + +variable "helm_disable_openapi_validation" { + type = bool + default = null + description = "If set, the installation process will not validate rendered Helm templates against the Kubernetes OpenAPI Schema. Defaults to `false`." +} + +variable "helm_dependency_update" { + type = bool + default = null + description = "Runs Helm dependency update before installing the chart. Defaults to `false`." +} + +variable "helm_replace" { + type = bool + default = null + description = "Re-use the given name of Helm release, only if that name is a deleted release which remains in the history. This is unsafe in production. Defaults to `false`." +} + +variable "helm_description" { + type = string + default = null + description = "Set Helm release description attribute (visible in the history). Defaults to `\"\"`." +} + +variable "helm_lint" { + type = bool + default = null + description = "Run the Helm chart linter during the plan. Defaults to `false`." +} + +variable "helm_set_sensitive" { + type = map(any) + default = null + description = "Value block with custom sensitive values to be merged with the values yaml that won't be exposed in the plan's diff. Defaults to `{}`." +} + +variable "helm_postrender" { + type = map(any) + default = null + description = "Value block with a path to a binary file to run after Helm renders the manifest which can alter the manifest contents. Defaults to `{}`." +} diff --git a/variables.tf b/variables.tf index cc2d9c3..b90afdf 100644 --- a/variables.tf +++ b/variables.tf @@ -1,106 +1,8 @@ +# IMPORTANT: Add addon specific variables here variable "enabled" { type = bool default = true - description = "Variable indicating whether deployment is enabled" -} - -variable "cluster_identity_oidc_issuer" { - type = string - description = "The OIDC Identity issuer for the cluster" -} - -variable "cluster_identity_oidc_issuer_arn" { - type = string - description = "The OIDC Identity issuer ARN for the cluster that can be used to associate IAM roles with a service account" -} - -variable "helm_chart_name" { - type = string - default = "aws-load-balancer-controller" - description = "Helm chart name to be installed" -} - -variable "helm_chart_version" { - type = string - default = "1.12.0" - description = "Version of the Helm chart" -} - -variable "helm_release_name" { - type = string - default = "aws-load-balancer-controller" - description = "Helm release name" -} -variable "helm_repo_url" { - type = string - default = "https://aws.github.io/eks-charts" - description = "Helm repository" -} - -variable "namespace" { - type = string - default = "aws-lb-controller" - description = "The K8s namespace in which the aws-load-balancer-controller service account has been created" -} - -variable "service_account_create" { - type = bool - default = true - description = "Whether to create Service Account" -} - -variable "service_account_name" { - type = string - default = "aws-load-balancer-controller" - description = "The k8s aws-loab-balancer-controller service account name" -} - -variable "eks_pod_identity_role_create" { - type = bool - default = false - description = "Determines whether to enable support for the EKS pod identity" -} - -variable "eks_pod_identity_role_name_prefix" { - type = string - default = "lb-controller-pod-identity" - description = "The EKS pod identity role name prefix for LB controller" -} - -variable "eks_pod_identity_policy_enabled" { - type = bool - default = true - description = "Whether to create opinionated policy for LB controller, see https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/v2.4.0/docs/install/iam_policy.json" -} - -variable "eks_pod_identity_tags" { - type = map(string) - default = {} - description = "The EKS Pod identity resources tags" -} - -variable "irsa_role_create" { - type = bool - default = true - description = "Whether to create IRSA role and annotate service account" -} - -variable "irsa_role_name_prefix" { - type = string - default = "lb-controller-irsa" - description = "The IRSA role name prefix for LB controller" -} - -variable "irsa_policy_enabled" { - type = bool - default = true - description = "Whether to create opinionated policy for LB controller, see https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/v2.4.0/docs/install/iam_policy.json" -} - -variable "irsa_tags" { - type = map(string) - default = {} - description = "IRSA resources tags" + description = "Set to false to prevent the module from creating any resources." } variable "cluster_name" { @@ -108,303 +10,56 @@ variable "cluster_name" { description = "The name of the cluster" } -variable "settings" { - type = map(any) - default = {} - description = "Additional settings which will be passed to the Helm chart values, see https://github.com/aws/eks-charts/tree/master/stable/aws-load-balancer-controller" -} - -variable "values" { +variable "aws_partition" { type = string - default = "" - description = "Additional yaml encoded values which will be passed to the Helm chart, see https://github.com/aws/eks-charts/tree/master/stable/aws-load-balancer-controller" + default = "aws" + description = "AWS partition in which the resources are located. Available values are `aws`, `aws-cn`, `aws-us-gov`" } -variable "argo_enabled" { +variable "pod_identity_role_create" { type = bool default = false - description = "If set to true, the module will be deployed as ArgoCD application, otherwise it will be deployed as a Helm release" -} - -variable "argo_namespace" { - type = string - default = "argo" - description = "Namespace to deploy ArgoCD application CRD to" -} - -variable "argo_destination_server" { - type = string - default = "https://kubernetes.default.svc" - description = "Destination server for ArgoCD Application" -} - -variable "argo_project" { - type = string - default = "default" - description = "ArgoCD Application project" -} - -variable "argo_info" { - type = list(object({ - name = string - value = string - })) - default = [ - { - "name" = "terraform" - "value" = "true" - } - ] - description = "ArgoCD info manifest parameter" -} - -variable "argo_sync_policy" { - type = any - default = {} - description = "ArgoCD syncPolicy manifest parameter" -} - -variable "argo_metadata" { - type = any - default = { - "finalizers" : [ - "resources-finalizer.argocd.argoproj.io" - ] - } - description = "ArgoCD Application metadata configuration. Override or create additional metadata parameters" -} - -variable "argo_spec" { - type = any - default = {} - description = "ArgoCD Application spec configuration. Override or create additional spec parameters" + description = "Whether to create pod identity role." } -variable "argo_apiversion" { +variable "pod_identity_role_name_prefix" { type = string - default = "argoproj.io/v1alpha1" - description = "ArgoCD Appliction apiVersion" -} - -variable "argo_kubernetes_manifest_computed_fields" { - type = list(string) - default = ["metadata.labels", "metadata.annotations"] - description = "List of paths of fields to be handled as \"computed\". The user-configured value for the field will be overridden by any different value returned by the API after apply." + default = "lb-controller-pod-identity" + description = "Pod identity role name prefix. Either `pod_identity_role_name_prefix` or `pod_identity_role_name` must be set." } -variable "argo_kubernetes_manifest_field_manager_name" { +variable "pod_identity_role_name" { type = string - default = "Terraform" - description = "The name of the field manager to use when applying the kubernetes manifest resource. Defaults to Terraform" + default = null + description = "Pod identity role name. The value is prefixed by `pod_identity_role_name_prefix`. Either `pod_identity_role_name` or `pod_identity_role_name_prefix` must be set. Defaults to `\"\"`." } -variable "argo_kubernetes_manifest_field_manager_force_conflicts" { - type = bool - default = false - description = "Forcibly override any field manager conflicts when applying the kubernetes manifest resource" -} - -variable "argo_kubernetes_manifest_wait_fields" { - type = map(string) - default = {} - description = "A map of fields and a corresponding regular expression with a pattern to wait for. The provider will wait until the field matches the regular expression. Use * for any value." -} - -variable "argo_helm_enabled" { - type = bool - default = false - description = "If set to true, the ArgoCD Application manifest will be deployed using Kubernetes provider as a Helm release. Otherwise it'll be deployed as a Kubernetes manifest. See Readme for more info" -} - -variable "argo_helm_values" { +variable "pod_identity_policy" { type = string - default = "" - description = "Value overrides to use when deploying argo application object with helm" + default = null + description = "AWS IAM policy JSON document to be attached to the pod identity role. Applied only if `pod_identity_policy_enabled` is `true`. Default policy is defined in iam.tf." } -variable "helm_enabled" { +variable "pod_identity_policy_enabled" { type = bool default = true - description = "Determines if the helm chart should be installed" + description = "Whether to create IAM policy specified by `pod_identity_policy`." } -variable "helm_create_namespace" { - type = bool - default = true - description = "Create the namespace if it does not yet exist" -} - -variable "helm_repo_key_file" { - type = string - default = "" - description = "Helm repositories cert key file" -} - -variable "helm_repo_cert_file" { - type = string - default = "" - description = "Helm repositories cert file" -} - -variable "helm_repo_ca_file" { - type = string - default = "" - description = "Helm repositories cert file" -} - -variable "helm_repo_username" { - type = string - default = "" - description = "Username for HTTP basic authentication against the helm repository" -} - -variable "helm_repo_password" { +variable "pod_identity_permissions_boundary" { type = string - default = "" - description = "Password for HTTP basic authentication against the helm repository" -} - -variable "helm_devel" { - type = bool - default = false - description = "Use helm chart development versions, too. Equivalent to version '>0.0.0-0'. If version is set, this is ignored" -} - -variable "helm_package_verify" { - type = bool - default = false - description = "Verify the package before installing it. Helm uses a provenance file to verify the integrity of the chart; this must be hosted alongside the chart" -} - -variable "helm_keyring" { - type = string - default = "~/.gnupg/pubring.gpg" - description = "Location of public keys used for verification. Used only if helm_package_verify is true" -} - -variable "helm_timeout" { - type = number - default = 300 - description = "Time in seconds to wait for any individual kubernetes operation (like Jobs for hooks)" -} - -variable "helm_disable_webhooks" { - type = bool - default = false - description = "Prevent helm chart hooks from running" -} - -variable "helm_reset_values" { - type = bool - default = false - description = "When upgrading, reset the values to the ones built into the helm chart" -} - -variable "helm_reuse_values" { - type = bool - default = false - description = "When upgrading, reuse the last helm release's values and merge in any overrides. If 'helm_reset_values' is specified, this is ignored" -} - -variable "helm_force_update" { - type = bool - default = false - description = "Force helm resource update through delete/recreate if needed" -} - -variable "helm_recreate_pods" { - type = bool - default = false - description = "Perform pods restart during helm upgrade/rollback" -} - -variable "helm_cleanup_on_fail" { - type = bool - default = false - description = "Allow deletion of new resources created in this helm upgrade when upgrade fails" + default = null + description = "ARN of the policy that is used to set the permissions boundary for the pod identity role." } -variable "helm_release_max_history" { - type = number - default = 0 - description = "Maximum number of release versions stored per release" -} - -variable "helm_atomic" { - type = bool - default = false - description = "If set, installation process purges chart on fail. The wait flag will be set automatically if atomic is used" -} - -variable "helm_wait" { - type = bool - default = false - description = "Will wait until all helm release resources are in a ready state before marking the release as successful. It will wait for as long as timeout" -} - -variable "helm_wait_for_jobs" { - type = bool - default = false - description = "If wait is enabled, will wait until all helm Jobs have been completed before marking the release as successful. It will wait for as long as timeout" -} - - -variable "helm_skip_crds" { - type = bool - default = false - description = "If set, no CRDs will be installed before helm release" -} - -variable "helm_render_subchart_notes" { - type = bool - default = true - description = "If set, render helm subchart notes along with the parent" -} - -variable "helm_disable_openapi_validation" { - type = bool - default = false - description = "If set, the installation process will not validate rendered helm templates against the Kubernetes OpenAPI Schema" -} - -variable "helm_set_sensitive" { - type = map(any) +variable "pod_identity_additional_policies" { + type = map(string) default = {} - description = "Value block with custom sensitive values to be merged with the values yaml that won't be exposed in the plan's diff" -} - -variable "helm_dependency_update" { - type = bool - default = false - description = "Runs helm dependency update before installing the chart" + description = "Map of the additional policies to be attached to pod identity role. Where key is arbitrary id and value is policy ARN." } -variable "helm_replace" { - type = bool - default = false - description = "Re-use the given name of helm release, only if that name is a deleted release which remains in the history. This is unsafe in production" -} - -variable "helm_description" { - type = string - default = "" - description = "Set helm release description attribute (visible in the history)" -} - -variable "helm_postrender" { - type = map(any) +variable "pod_identity_tags" { + type = map(string) default = {} - description = "Value block with a path to a binary file to run after helm renders the manifest which can alter the manifest contents" -} - -variable "helm_lint" { - type = bool - default = false - description = "Run the helm chart linter during the plan" -} - -variable "aws_partition" { - type = string - default = "aws" - description = "AWS partition in which the resources are located. Available values are `aws`, `aws-cn`, `aws-us-gov`" + description = "The Pod identity resources tags." } diff --git a/versions.tf b/versions.tf index ea8c3a1..58a9f12 100644 --- a/versions.tf +++ b/versions.tf @@ -1,14 +1,15 @@ +# IMPORTANT: This file is synced with the "terraform-aws-eks-universal-addon" module. Any changes to this file might be overwritten upon the next release of that module. terraform { - required_version = ">= 1.0" + required_version = ">= 1.5.0" required_providers { aws = { source = "hashicorp/aws" - version = ">= 4.19.0" + version = "~> 5" } kubernetes = { source = "hashicorp/kubernetes" - version = ">= 2.11.0" + version = ">= 2.20.0" } helm = { source = "hashicorp/helm"