Skip to content

Commit 485efeb

Browse files
bryantbiggsbryantbiggs
committed
feat: Add support for managing aws-auth configmap using new kubernetes_config_map_v1_data resource
1 parent 3ff1720 commit 485efeb

File tree

16 files changed

+229
-208
lines changed

16 files changed

+229
-208
lines changed

‎README.md

+11-1
Original file line numberDiff line numberDiff line change
@@ -180,13 +180,15 @@ We are grateful to the community for contributing bugfixes and improvements! Ple
180180
|------|---------|
181181
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
182182
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.72 |
183+
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.10 |
183184
| <a name="requirement_tls"></a> [tls](#requirement\_tls) | >= 3.0 |
184185

185186
## Providers
186187

187188
| Name | Version |
188189
|------|---------|
189190
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.72 |
191+
| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | >= 2.10 |
190192
| <a name="provider_tls"></a> [tls](#provider\_tls) | >= 3.0 |
191193

192194
## Modules
@@ -216,6 +218,7 @@ We are grateful to the community for contributing bugfixes and improvements! Ple
216218
| [aws_security_group.node](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
217219
| [aws_security_group_rule.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
218220
| [aws_security_group_rule.node](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
221+
| [kubernetes_config_map_v1_data.aws_auth](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/config_map_v1_data) | resource |
219222
| [aws_iam_policy_document.assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
220223
| [aws_iam_policy_document.cni_ipv6_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
221224
| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
@@ -226,6 +229,12 @@ We are grateful to the community for contributing bugfixes and improvements! Ple
226229
| Name | Description | Type | Default | Required |
227230
|------|-------------|------|---------|:--------:|
228231
| <a name="input_attach_cluster_encryption_policy"></a> [attach\_cluster\_encryption\_policy](#input\_attach\_cluster\_encryption\_policy) | Indicates whether or not to attach an additional policy for the cluster IAM role to utilize the encryption key provided | `bool` | `true` | no |
232+
| <a name="input_aws_auth_accounts"></a> [aws\_auth\_accounts](#input\_aws\_auth\_accounts) | List of account maps to add to the aws-auth configmap | `list(any)` | `[]` | no |
233+
| <a name="input_aws_auth_fargate_profile_pod_execution_role_arns"></a> [aws\_auth\_fargate\_profile\_pod\_execution\_role\_arns](#input\_aws\_auth\_fargate\_profile\_pod\_execution\_role\_arns) | List of Fargate profile pod execution role ARNs to add to the aws-auth configmap | `list(string)` | `[]` | no |
234+
| <a name="input_aws_auth_node_iam_role_arns_non_windows"></a> [aws\_auth\_node\_iam\_role\_arns\_non\_windows](#input\_aws\_auth\_node\_iam\_role\_arns\_non\_windows) | List of non-Windows based node IAM role ARNs to add to the aws-auth configmap | `list(string)` | `[]` | no |
235+
| <a name="input_aws_auth_node_iam_role_arns_windows"></a> [aws\_auth\_node\_iam\_role\_arns\_windows](#input\_aws\_auth\_node\_iam\_role\_arns\_windows) | List of Windows based node IAM role ARNs to add to the aws-auth configmap | `list(string)` | `[]` | no |
236+
| <a name="input_aws_auth_roles"></a> [aws\_auth\_roles](#input\_aws\_auth\_roles) | List of role maps to add to the aws-auth configmap | `list(any)` | `[]` | no |
237+
| <a name="input_aws_auth_users"></a> [aws\_auth\_users](#input\_aws\_auth\_users) | List of user maps to add to the aws-auth configmap | `list(any)` | `[]` | no |
229238
| <a name="input_cloudwatch_log_group_kms_key_id"></a> [cloudwatch\_log\_group\_kms\_key\_id](#input\_cloudwatch\_log\_group\_kms\_key\_id) | If a KMS Key ARN is set, this key will be used to encrypt the corresponding log group. Please be sure that the KMS Key has an appropriate key policy (https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html) | `string` | `null` | no |
230239
| <a name="input_cloudwatch_log_group_retention_in_days"></a> [cloudwatch\_log\_group\_retention\_in\_days](#input\_cloudwatch\_log\_group\_retention\_in\_days) | Number of days to retain log events. Default retention - 90 days | `number` | `90` | no |
231240
| <a name="input_cluster_additional_security_group_ids"></a> [cluster\_additional\_security\_group\_ids](#input\_cluster\_additional\_security\_group\_ids) | List of additional, externally created security group IDs to attach to the cluster control plane | `list(string)` | `[]` | no |
@@ -274,6 +283,7 @@ We are grateful to the community for contributing bugfixes and improvements! Ple
274283
| <a name="input_iam_role_permissions_boundary"></a> [iam\_role\_permissions\_boundary](#input\_iam\_role\_permissions\_boundary) | ARN of the policy that is used to set the permissions boundary for the IAM role | `string` | `null` | no |
275284
| <a name="input_iam_role_tags"></a> [iam\_role\_tags](#input\_iam\_role\_tags) | A map of additional tags to add to the IAM role created | `map(string)` | `{}` | no |
276285
| <a name="input_iam_role_use_name_prefix"></a> [iam\_role\_use\_name\_prefix](#input\_iam\_role\_use\_name\_prefix) | Determines whether the IAM role name (`iam_role_name`) is used as a prefix | `string` | `true` | no |
286+
| <a name="input_manage_aws_auth_configmap"></a> [manage\_aws\_auth\_configmap](#input\_manage\_aws\_auth\_configmap) | Determines whether to manage the aws-auth configmap | `bool` | `false` | no |
277287
| <a name="input_node_security_group_additional_rules"></a> [node\_security\_group\_additional\_rules](#input\_node\_security\_group\_additional\_rules) | List of additional security group rules to add to the node security group created. Set `source_cluster_security_group = true` inside rules to set the `cluster_security_group` as source | `any` | `{}` | no |
278288
| <a name="input_node_security_group_description"></a> [node\_security\_group\_description](#input\_node\_security\_group\_description) | Description of the node security group created | `string` | `"EKS node shared security group"` | no |
279289
| <a name="input_node_security_group_id"></a> [node\_security\_group\_id](#input\_node\_security\_group\_id) | ID of an existing security group to attach to the node groups created | `string` | `""` | no |
@@ -293,7 +303,7 @@ We are grateful to the community for contributing bugfixes and improvements! Ple
293303

294304
| Name | Description |
295305
|------|-------------|
296-
| <a name="output_aws_auth_configmap_yaml"></a> [aws\_auth\_configmap\_yaml](#output\_aws\_auth\_configmap\_yaml) | Formatted yaml output for base aws-auth configmap containing roles used in cluster node groups/fargate profiles |
306+
| <a name="output_aws_auth_configmap_yaml"></a> [aws\_auth\_configmap\_yaml](#output\_aws\_auth\_configmap\_yaml) | [DEPRECATED - use `var.manage_aws_auth_configmap`] Formatted yaml output for base aws-auth configmap containing roles used in cluster node groups/fargate profiles |
297307
| <a name="output_cloudwatch_log_group_arn"></a> [cloudwatch\_log\_group\_arn](#output\_cloudwatch\_log\_group\_arn) | Arn of cloudwatch log group created |
298308
| <a name="output_cloudwatch_log_group_name"></a> [cloudwatch\_log\_group\_name](#output\_cloudwatch\_log\_group\_name) | Name of cloudwatch log group created |
299309
| <a name="output_cluster_addons"></a> [cluster\_addons](#output\_cluster\_addons) | Map of attribute maps for all EKS cluster addons enabled |

‎examples/complete/README.md

+1-4
Original file line numberDiff line numberDiff line change
@@ -35,14 +35,13 @@ Note that this example may create resources which cost money. Run `terraform des
3535
|------|---------|
3636
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
3737
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.72 |
38-
| <a name="requirement_null"></a> [null](#requirement\_null) | >= 3.0 |
38+
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.10 |
3939

4040
## Providers
4141

4242
| Name | Version |
4343
|------|---------|
4444
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.72 |
45-
| <a name="provider_null"></a> [null](#provider\_null) | >= 3.0 |
4645

4746
## Modules
4847

@@ -64,8 +63,6 @@ Note that this example may create resources which cost money. Run `terraform des
6463
|------|------|
6564
| [aws_kms_key.eks](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
6665
| [aws_security_group.additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
67-
| [null_resource.patch](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
68-
| [aws_eks_cluster_auth.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
6966

7067
## Inputs
7168

‎examples/complete/main.tf

+49-74
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,18 @@ provider "aws" {
88
}
99
}
1010

11+
provider "kubernetes" {
12+
host = module.eks.cluster_endpoint
13+
cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data)
14+
15+
exec {
16+
api_version = "client.authentication.k8s.io/v1alpha1"
17+
command = "aws"
18+
# This requires the awscli to be installed locally where Terraform is executed
19+
args = ["eks", "get-token", "--cluster-name", module.eks.cluster_id]
20+
}
21+
}
22+
1123
locals {
1224
name = "ex-${replace(basename(path.cwd), "_", "-")}"
1325
region = "eu-west-1"
@@ -180,6 +192,43 @@ module "eks" {
180192
}
181193
}
182194

195+
# aws-auth configmap
196+
manage_aws_auth_configmap = true
197+
198+
aws_auth_node_iam_role_arns_non_windows = [
199+
module.eks_managed_node_group.iam_role_arn,
200+
module.self_managed_node_group.iam_role_arn,
201+
]
202+
aws_auth_fargate_profile_pod_execution_role_arns = [
203+
module.fargate_profile.fargate_profile_pod_execution_role_arn
204+
]
205+
206+
aws_auth_roles = [
207+
{
208+
rolearn = "arn:aws:iam::66666666666:role/role1"
209+
username = "role1"
210+
groups = ["system:masters"]
211+
},
212+
]
213+
214+
aws_auth_users = [
215+
{
216+
userarn = "arn:aws:iam::66666666666:user/user1"
217+
username = "user1"
218+
groups = ["system:masters"]
219+
},
220+
{
221+
userarn = "arn:aws:iam::66666666666:user/user2"
222+
username = "user2"
223+
groups = ["system:masters"]
224+
},
225+
]
226+
227+
aws_auth_accounts = [
228+
"777777777777",
229+
"888888888888",
230+
]
231+
183232
tags = local.tags
184233
}
185234

@@ -269,80 +318,6 @@ module "disabled_self_managed_node_group" {
269318
create = false
270319
}
271320

272-
################################################################################
273-
# aws-auth configmap
274-
# Only EKS managed node groups automatically add roles to aws-auth configmap
275-
# so we need to ensure fargate profiles and self-managed node roles are added
276-
################################################################################
277-
278-
data "aws_eks_cluster_auth" "this" {
279-
name = module.eks.cluster_id
280-
}
281-
282-
locals {
283-
kubeconfig = yamlencode({
284-
apiVersion = "v1"
285-
kind = "Config"
286-
current-context = "terraform"
287-
clusters = [{
288-
name = module.eks.cluster_id
289-
cluster = {
290-
certificate-authority-data = module.eks.cluster_certificate_authority_data
291-
server = module.eks.cluster_endpoint
292-
}
293-
}]
294-
contexts = [{
295-
name = "terraform"
296-
context = {
297-
cluster = module.eks.cluster_id
298-
user = "terraform"
299-
}
300-
}]
301-
users = [{
302-
name = "terraform"
303-
user = {
304-
token = data.aws_eks_cluster_auth.this.token
305-
}
306-
}]
307-
})
308-
309-
# we have to combine the configmap created by the eks module with the externally created node group/profile sub-modules
310-
aws_auth_configmap_yaml = <<-EOT
311-
${chomp(module.eks.aws_auth_configmap_yaml)}
312-
- rolearn: ${module.eks_managed_node_group.iam_role_arn}
313-
username: system:node:{{EC2PrivateDNSName}}
314-
groups:
315-
- system:bootstrappers
316-
- system:nodes
317-
- rolearn: ${module.self_managed_node_group.iam_role_arn}
318-
username: system:node:{{EC2PrivateDNSName}}
319-
groups:
320-
- system:bootstrappers
321-
- system:nodes
322-
- rolearn: ${module.fargate_profile.fargate_profile_pod_execution_role_arn}
323-
username: system:node:{{SessionName}}
324-
groups:
325-
- system:bootstrappers
326-
- system:nodes
327-
- system:node-proxier
328-
EOT
329-
}
330-
331-
resource "null_resource" "patch" {
332-
triggers = {
333-
kubeconfig = base64encode(local.kubeconfig)
334-
cmd_patch = "kubectl patch configmap/aws-auth --patch \"${local.aws_auth_configmap_yaml}\" -n kube-system --kubeconfig <(echo $KUBECONFIG | base64 --decode)"
335-
}
336-
337-
provisioner "local-exec" {
338-
interpreter = ["/bin/bash", "-c"]
339-
environment = {
340-
KUBECONFIG = self.triggers.kubeconfig
341-
}
342-
command = self.triggers.cmd_patch
343-
}
344-
}
345-
346321
################################################################################
347322
# Supporting resources
348323
################################################################################

‎examples/complete/versions.tf

+3-3
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,9 @@ terraform {
66
source = "hashicorp/aws"
77
version = ">= 3.72"
88
}
9-
null = {
10-
source = "hashicorp/null"
11-
version = ">= 3.0"
9+
kubernetes = {
10+
source = "hashicorp/kubernetes"
11+
version = ">= 2.10"
1212
}
1313
}
1414
}

‎examples/eks_managed_node_group/README.md

+1-4
Original file line numberDiff line numberDiff line change
@@ -58,15 +58,14 @@ Note that this example may create resources which cost money. Run `terraform des
5858
|------|---------|
5959
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
6060
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.72 |
61-
| <a name="requirement_null"></a> [null](#requirement\_null) | >= 3.0 |
61+
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.10 |
6262
| <a name="requirement_tls"></a> [tls](#requirement\_tls) | >= 2.2 |
6363

6464
## Providers
6565

6666
| Name | Version |
6767
|------|---------|
6868
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.72 |
69-
| <a name="provider_null"></a> [null](#provider\_null) | >= 3.0 |
7069
| <a name="provider_tls"></a> [tls](#provider\_tls) | >= 2.2 |
7170

7271
## Modules
@@ -89,13 +88,11 @@ Note that this example may create resources which cost money. Run `terraform des
8988
| [aws_launch_template.external](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template) | resource |
9089
| [aws_security_group.additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
9190
| [aws_security_group.remote_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
92-
| [null_resource.patch](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource |
9391
| [tls_private_key.this](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/resources/private_key) | resource |
9492
| [aws_ami.eks_default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source |
9593
| [aws_ami.eks_default_arm](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source |
9694
| [aws_ami.eks_default_bottlerocket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source |
9795
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
98-
| [aws_eks_cluster_auth.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
9996
| [aws_iam_policy_document.ebs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
10097

10198
## Inputs

‎examples/eks_managed_node_group/main.tf

+14-53
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,18 @@ provider "aws" {
22
region = local.region
33
}
44

5+
provider "kubernetes" {
6+
host = module.eks.cluster_endpoint
7+
cluster_ca_certificate = base64decode(module.eks.cluster_certificate_authority_data)
8+
9+
exec {
10+
api_version = "client.authentication.k8s.io/v1alpha1"
11+
command = "aws"
12+
# This requires the awscli to be installed locally where Terraform is executed
13+
args = ["eks", "get-token", "--cluster-name", module.eks.cluster_id]
14+
}
15+
}
16+
517
locals {
618
name = "ex-${replace(basename(path.cwd), "_", "-")}"
719
cluster_version = "1.22"
@@ -58,6 +70,8 @@ module "eks" {
5870
vpc_id = module.vpc.vpc_id
5971
subnet_ids = module.vpc.private_subnets
6072

73+
manage_aws_auth_configmap = true
74+
6175
# Extend cluster security group rules
6276
cluster_security_group_additional_rules = {
6377
egress_nodes_ephemeral_ports_tcp = {
@@ -340,59 +354,6 @@ resource "aws_iam_role_policy_attachment" "additional" {
340354
role = each.value.iam_role_name
341355
}
342356

343-
################################################################################
344-
# aws-auth configmap
345-
# Only EKS managed node groups automatically add roles to aws-auth configmap
346-
# so we need to ensure fargate profiles and self-managed node roles are added
347-
################################################################################
348-
349-
data "aws_eks_cluster_auth" "this" {
350-
name = module.eks.cluster_id
351-
}
352-
353-
locals {
354-
kubeconfig = yamlencode({
355-
apiVersion = "v1"
356-
kind = "Config"
357-
current-context = "terraform"
358-
clusters = [{
359-
name = module.eks.cluster_id
360-
cluster = {
361-
certificate-authority-data = module.eks.cluster_certificate_authority_data
362-
server = module.eks.cluster_endpoint
363-
}
364-
}]
365-
contexts = [{
366-
name = "terraform"
367-
context = {
368-
cluster = module.eks.cluster_id
369-
user = "terraform"
370-
}
371-
}]
372-
users = [{
373-
name = "terraform"
374-
user = {
375-
token = data.aws_eks_cluster_auth.this.token
376-
}
377-
}]
378-
})
379-
}
380-
381-
resource "null_resource" "patch" {
382-
triggers = {
383-
kubeconfig = base64encode(local.kubeconfig)
384-
cmd_patch = "kubectl patch configmap/aws-auth --patch \"${module.eks.aws_auth_configmap_yaml}\" -n kube-system --kubeconfig <(echo $KUBECONFIG | base64 --decode)"
385-
}
386-
387-
provisioner "local-exec" {
388-
interpreter = ["/bin/bash", "-c"]
389-
environment = {
390-
KUBECONFIG = self.triggers.kubeconfig
391-
}
392-
command = self.triggers.cmd_patch
393-
}
394-
}
395-
396357
################################################################################
397358
# Supporting Resources
398359
################################################################################

‎examples/eks_managed_node_group/versions.tf

+4-4
Original file line numberDiff line numberDiff line change
@@ -6,13 +6,13 @@ terraform {
66
source = "hashicorp/aws"
77
version = ">= 3.72"
88
}
9-
null = {
10-
source = "hashicorp/null"
11-
version = ">= 3.0"
12-
}
139
tls = {
1410
source = "hashicorp/tls"
1511
version = ">= 2.2"
1612
}
13+
kubernetes = {
14+
source = "hashicorp/kubernetes"
15+
version = ">= 2.10"
16+
}
1717
}
1818
}

‎examples/fargate_profile/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ Note that this example may create resources which cost money. Run `terraform des
2121
|------|---------|
2222
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
2323
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.72 |
24+
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.10 |
2425

2526
## Providers
2627

‎examples/fargate_profile/versions.tf

+4
Original file line numberDiff line numberDiff line change
@@ -6,5 +6,9 @@ terraform {
66
source = "hashicorp/aws"
77
version = ">= 3.72"
88
}
9+
kubernetes = {
10+
source = "hashicorp/kubernetes"
11+
version = ">= 2.10"
12+
}
913
}
1014
}

0 commit comments

Comments
 (0)