135 lines
4.8 KiB
HCL
Executable File
135 lines
4.8 KiB
HCL
Executable File
module "label" {
|
|
source = "git::https://github.com/cloudposse/terraform-null-label.git?ref=tags/0.24.1"
|
|
namespace = var.namespace
|
|
stage = var.stage
|
|
name = var.name
|
|
delimiter = var.delimiter
|
|
attributes = compact(concat(var.attributes, ["cluster"]))
|
|
tags = var.tags
|
|
enabled = var.enabled
|
|
}
|
|
|
|
data "aws_iam_policy_document" "assume_role" {
|
|
count = var.enabled ? 1 : 0
|
|
|
|
statement {
|
|
effect = "Allow"
|
|
actions = ["sts:AssumeRole"]
|
|
|
|
principals {
|
|
type = "Service"
|
|
identifiers = ["eks.amazonaws.com"]
|
|
}
|
|
}
|
|
}
|
|
|
|
resource "aws_iam_role" "default" {
|
|
count = var.enabled ? 1 : 0
|
|
name = module.label.id
|
|
assume_role_policy = join("", data.aws_iam_policy_document.assume_role.*.json)
|
|
tags = module.label.tags
|
|
}
|
|
|
|
resource "aws_iam_role_policy_attachment" "amazon_eks_cluster_policy" {
|
|
count = var.enabled ? 1 : 0
|
|
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
|
|
role = join("", aws_iam_role.default.*.name)
|
|
}
|
|
|
|
resource "aws_iam_role_policy_attachment" "amazon_eks_service_policy" {
|
|
count = var.enabled ? 1 : 0
|
|
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
|
|
role = join("", aws_iam_role.default.*.name)
|
|
}
|
|
|
|
resource "aws_security_group" "default" {
|
|
count = var.enabled ? 1 : 0
|
|
name = module.label.id
|
|
description = "Security Group for EKS cluster"
|
|
vpc_id = var.vpc_id
|
|
tags = module.label.tags
|
|
}
|
|
|
|
resource "aws_security_group_rule" "egress" {
|
|
count = var.enabled ? 1 : 0
|
|
description = "Allow all egress traffic"
|
|
from_port = 0
|
|
to_port = 0
|
|
protocol = "-1"
|
|
cidr_blocks = ["0.0.0.0/0"]
|
|
security_group_id = join("", aws_security_group.default.*.id)
|
|
type = "egress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "ingress_workers" {
|
|
count = var.enabled ? length(var.workers_security_group_ids) : 0
|
|
description = "Allow the cluster to receive communication from the worker nodes"
|
|
from_port = 0
|
|
to_port = 65535
|
|
protocol = "-1"
|
|
source_security_group_id = var.workers_security_group_ids[count.index]
|
|
security_group_id = join("", aws_security_group.default.*.id)
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "ingress_security_groups" {
|
|
count = var.enabled ? length(var.allowed_security_groups) : 0
|
|
description = "Allow inbound traffic from existing Security Groups"
|
|
from_port = 0
|
|
to_port = 65535
|
|
protocol = "-1"
|
|
source_security_group_id = var.allowed_security_groups[count.index]
|
|
security_group_id = join("", aws_security_group.default.*.id)
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "ingress_cidr_blocks" {
|
|
count = var.enabled && length(var.allowed_cidr_blocks) > 0 ? 1 : 0
|
|
description = "Allow inbound traffic from CIDR blocks"
|
|
from_port = 0
|
|
to_port = 65535
|
|
protocol = "-1"
|
|
cidr_blocks = var.allowed_cidr_blocks
|
|
security_group_id = join("", aws_security_group.default.*.id)
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_eks_cluster" "default" {
|
|
count = var.enabled ? 1 : 0
|
|
name = module.label.id
|
|
role_arn = join("", aws_iam_role.default.*.arn)
|
|
version = var.kubernetes_version
|
|
enabled_cluster_log_types = var.enabled_cluster_log_types
|
|
|
|
vpc_config {
|
|
security_group_ids = [join("", aws_security_group.default.*.id)]
|
|
subnet_ids = var.subnet_ids
|
|
endpoint_private_access = var.endpoint_private_access
|
|
endpoint_public_access = var.endpoint_public_access
|
|
}
|
|
|
|
depends_on = [
|
|
aws_iam_role_policy_attachment.amazon_eks_cluster_policy,
|
|
aws_iam_role_policy_attachment.amazon_eks_service_policy
|
|
]
|
|
}
|
|
|
|
# Enabling IAM Roles for Service Accounts in Kubernetes cluster
|
|
#
|
|
# From official docs:
|
|
# The IAM roles for service accounts feature is available on new Amazon EKS Kubernetes version 1.14 clusters,
|
|
# and clusters that were updated to versions 1.14 or 1.13 on or after September 3rd, 2019.
|
|
#
|
|
# https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html
|
|
# https://medium.com/@marcincuber/amazon-eks-with-oidc-provider-iam-roles-for-kubernetes-services-accounts-59015d15cb0c
|
|
#
|
|
resource "aws_iam_openid_connect_provider" "default" {
|
|
count = (var.enabled && var.oidc_provider_enabled) ? 1 : 0
|
|
url = join("", aws_eks_cluster.default.*.identity.0.oidc.0.issuer)
|
|
|
|
client_id_list = ["sts.amazonaws.com"]
|
|
# it's thumbprint won't change for many years :)
|
|
# https://github.com/terraform-providers/terraform-provider-aws/issues/10104
|
|
thumbprint_list = ["9e99a48a9960b14926bb7f3b02e22da2b0ab7280"]
|
|
}
|