xpk/terraform-aws-eks
1
0
Fork 0
mirror of https://github.com/terraform-aws-modules/terraform-aws-eks.git synced 2025-09-09 19:32:58 +08:00
Code Activity

Add destroy time flag (#580)

Browse Source 
* Add destroy-time flag

* Update changelog

Fix cluster count

* Fix cluster count

* Fix docs

* Fix outputs

* Fix unsupported attribute on cluster_certificate_authority_data output

Co-Authored-By: Daniel Piddock <33028589+dpiddockcmp@users.noreply.github.com>

* Remove unnecessary flatten from cluster_endpoint output

Co-Authored-By: Daniel Piddock <33028589+dpiddockcmp@users.noreply.github.com>

* Improve description of var.enabled

* Fix errors manifesting when used on an existing-cluster

* Update README.md

* Renamed destroy-time flag

* Revert removal of changelog addition entry

* Update flag name in readme

* Update flag variable name

* Update cluster referencing for consistency

* Update flag name to `create_eks`

* Fixed incorrect count-based reference to aws_eks_cluster.this (there's only one)

* Replaced all incorrect aws_eks_cluster.this[count.index] references (there will be just one, so using '[0]').

* Changelog update, explicitly mentioning flag

* Fixed interpolation deprecation warning

* Fixed outputs to support conditional cluster

* Applied create_eks to aws_auth.tf

* Removed unused variable. Updated Changelog. Formatting.

* Fixed references to aws_eks_cluster.this[0] that would raise errors when setting create_eks to false whilst having launch templates or launch configurations configured.

* Readme and example updates.

* Revert "Readme and example updates."

This reverts commit 18a0746355.

* Updated readme section of conditionally creation with provider example.

* Added conditions to node_groups.

* Fixed reversed map_roles check

* Update aws_auth.tf

Revert this due to https://github.com/terraform-aws-modules/terraform-aws-eks/pull/611
This commit is contained in:
Tomislav Tomašić
2019-12-09 09:06:10 +00:00
committed by Max Williams
parent 7c2c4a6aa5
commit 124ea7c151
11 changed files with 138 additions and 100 deletions
Download Patch File Download Diff File Expand all files Collapse all files
workers.tf
+34 -33
View File
@@ -1,12 +1,12 @@
# Worker Groups using Launch Configurations
resource "aws_autoscaling_group" "workers" {
count = local.worker_group_count
count = var.create_eks ? local.worker_group_count : 0
name_prefix = join(
"-",
compact(
[
aws_eks_cluster.this.name,
aws_eks_cluster.this[0].name,
lookup(var.worker_groups[count.index], "name", count.index),
lookup(var.worker_groups[count.index], "asg_recreate_on_change", local.workers_group_defaults["asg_recreate_on_change"]) ? random_pet.workers[count.index].id : ""
]
@@ -91,16 +91,16 @@ resource "aws_autoscaling_group" "workers" {
[
{
"key" = "Name"
"value" = "${aws_eks_cluster.this.name}-${lookup(var.worker_groups[count.index], "name", count.index)}-eks_asg"
"value" = "${aws_eks_cluster.this[0].name}-${lookup(var.worker_groups[count.index], "name", count.index)}-eks_asg"
"propagate_at_launch" = true
},
{
"key" = "kubernetes.io/cluster/${aws_eks_cluster.this.name}"
"key" = "kubernetes.io/cluster/${aws_eks_cluster.this[0].name}"
"value" = "owned"
"propagate_at_launch" = true
},
{
"key" = "k8s.io/cluster/${aws_eks_cluster.this.name}"
"key" = "k8s.io/cluster/${aws_eks_cluster.this[0].name}"
"value" = "owned"
"propagate_at_launch" = true
},
@@ -114,8 +114,8 @@ resource "aws_autoscaling_group" "workers" {
"propagate_at_launch" = false
},
{
"key" = "k8s.io/cluster-autoscaler/${aws_eks_cluster.this.name}"
"value" = aws_eks_cluster.this.name
"key" = "k8s.io/cluster-autoscaler/${aws_eks_cluster.this[0].name}"
"value" = aws_eks_cluster.this[0].name
"propagate_at_launch" = false
},
{
@@ -143,8 +143,8 @@ resource "aws_autoscaling_group" "workers" {
}
resource "aws_launch_configuration" "workers" {
count = local.worker_group_count
name_prefix = "${aws_eks_cluster.this.name}-${lookup(var.worker_groups[count.index], "name", count.index)}"
count = var.create_eks ? local.worker_group_count : 0
name_prefix = "${aws_eks_cluster.this[0].name}-${lookup(var.worker_groups[count.index], "name", count.index)}"
associate_public_ip_address = lookup(
var.worker_groups[count.index],
"public_ip",
@@ -232,7 +232,7 @@ resource "aws_launch_configuration" "workers" {
}
resource "random_pet" "workers" {
count = local.worker_group_count
count = var.create_eks ? local.worker_group_count : 0
separator = "-"
length = 2
@@ -243,21 +243,21 @@ resource "random_pet" "workers" {
}
resource "aws_security_group" "workers" {
count = var.worker_create_security_group ? 1 : 0
name_prefix = aws_eks_cluster.this.name
count = var.worker_create_security_group && var.create_eks ? 1 : 0
name_prefix = aws_eks_cluster.this[0].name
description = "Security group for all nodes in the cluster."
vpc_id = var.vpc_id
tags = merge(
var.tags,
{
"Name" = "${aws_eks_cluster.this.name}-eks_worker_sg"
"kubernetes.io/cluster/${aws_eks_cluster.this.name}" = "owned"
"Name" = "${aws_eks_cluster.this[0].name}-eks_worker_sg"
"kubernetes.io/cluster/${aws_eks_cluster.this[0].name}" = "owned"
},
)
}
resource "aws_security_group_rule" "workers_egress_internet" {
count = var.worker_create_security_group ? 1 : 0
count = var.worker_create_security_group && var.create_eks ? 1 : 0
description = "Allow nodes all egress to the Internet."
protocol = "-1"
security_group_id = local.worker_security_group_id
@@ -268,7 +268,7 @@ resource "aws_security_group_rule" "workers_egress_internet" {
}
resource "aws_security_group_rule" "workers_ingress_self" {
count = var.worker_create_security_group ? 1 : 0
count = var.worker_create_security_group && var.create_eks ? 1 : 0
description = "Allow node to communicate with each other."
protocol = "-1"
security_group_id = local.worker_security_group_id
@@ -279,7 +279,7 @@ resource "aws_security_group_rule" "workers_ingress_self" {
}
resource "aws_security_group_rule" "workers_ingress_cluster" {
count = var.worker_create_security_group ? 1 : 0
count = var.worker_create_security_group && var.create_eks ? 1 : 0
description = "Allow workers pods to receive communication from the cluster control plane."
protocol = "tcp"
security_group_id = local.worker_security_group_id
@@ -290,7 +290,7 @@ resource "aws_security_group_rule" "workers_ingress_cluster" {
}
resource "aws_security_group_rule" "workers_ingress_cluster_kubelet" {
count = var.worker_create_security_group ? var.worker_sg_ingress_from_port > 10250 ? 1 : 0 : 0
count = var.worker_create_security_group && var.create_eks ? var.worker_sg_ingress_from_port > 10250 ? 1 : 0 : 0
description = "Allow workers Kubelets to receive communication from the cluster control plane."
protocol = "tcp"
security_group_id = local.worker_security_group_id
@@ -301,7 +301,7 @@ resource "aws_security_group_rule" "workers_ingress_cluster_kubelet" {
}
resource "aws_security_group_rule" "workers_ingress_cluster_https" {
count = var.worker_create_security_group ? 1 : 0
count = var.worker_create_security_group && var.create_eks ? 1 : 0
description = "Allow pods running extension API servers on port 443 to receive communication from cluster control plane."
protocol = "tcp"
security_group_id = local.worker_security_group_id
@@ -312,8 +312,8 @@ resource "aws_security_group_rule" "workers_ingress_cluster_https" {
}
resource "aws_iam_role" "workers" {
count = var.manage_worker_iam_resources ? 1 : 0
name_prefix = var.workers_role_name != "" ? null : aws_eks_cluster.this.name
count = var.manage_worker_iam_resources && var.create_eks ? 1 : 0
name_prefix = var.workers_role_name != "" ? null : aws_eks_cluster.this[0].name
name = var.workers_role_name != "" ? var.workers_role_name : null
assume_role_policy = data.aws_iam_policy_document.workers_assume_role_policy.json
permissions_boundary = var.permissions_boundary
@@ -323,8 +323,8 @@ resource "aws_iam_role" "workers" {
}
resource "aws_iam_instance_profile" "workers" {
count = var.manage_worker_iam_resources ? local.worker_group_count : 0
name_prefix = aws_eks_cluster.this.name
count = var.manage_worker_iam_resources && var.create_eks ? local.worker_group_count : 0
name_prefix = aws_eks_cluster.this[0].name
role = lookup(
var.worker_groups[count.index],
"iam_role_id",
@@ -335,44 +335,45 @@ resource "aws_iam_instance_profile" "workers" {
}
resource "aws_iam_role_policy_attachment" "workers_AmazonEKSWorkerNodePolicy" {
count = var.manage_worker_iam_resources ? 1 : 0
count = var.manage_worker_iam_resources && var.create_eks ? 1 : 0
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
role = aws_iam_role.workers[0].name
}
resource "aws_iam_role_policy_attachment" "workers_AmazonEKS_CNI_Policy" {
count = var.manage_worker_iam_resources && var.attach_worker_cni_policy ? 1 : 0
count = var.manage_worker_iam_resources && var.attach_worker_cni_policy && var.create_eks ? 1 : 0
policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
role = aws_iam_role.workers[0].name
}
resource "aws_iam_role_policy_attachment" "workers_AmazonEC2ContainerRegistryReadOnly" {
count = var.manage_worker_iam_resources ? 1 : 0
count = var.manage_worker_iam_resources && var.create_eks ? 1 : 0
policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
role = aws_iam_role.workers[0].name
}
resource "aws_iam_role_policy_attachment" "workers_additional_policies" {
count = var.manage_worker_iam_resources ? length(var.workers_additional_policies) : 0
count = var.manage_worker_iam_resources && var.create_eks ? length(var.workers_additional_policies) : 0
role = aws_iam_role.workers[0].name
policy_arn = var.workers_additional_policies[count.index]
}
resource "aws_iam_role_policy_attachment" "workers_autoscaling" {
count = var.manage_worker_iam_resources && var.manage_worker_autoscaling_policy && var.attach_worker_autoscaling_policy ? 1 : 0
count = var.manage_worker_iam_resources && var.manage_worker_autoscaling_policy && var.attach_worker_autoscaling_policy && var.create_eks ? 1 : 0
policy_arn = aws_iam_policy.worker_autoscaling[0].arn
role = aws_iam_role.workers[0].name
}
resource "aws_iam_policy" "worker_autoscaling" {
count = var.manage_worker_iam_resources && var.manage_worker_autoscaling_policy ? 1 : 0
name_prefix = "eks-worker-autoscaling-${aws_eks_cluster.this.name}"
description = "EKS worker node autoscaling policy for cluster ${aws_eks_cluster.this.name}"
policy = data.aws_iam_policy_document.worker_autoscaling.json
count = var.manage_worker_iam_resources && var.manage_worker_autoscaling_policy && var.create_eks ? 1 : 0
name_prefix = "eks-worker-autoscaling-${aws_eks_cluster.this[0].name}"
description = "EKS worker node autoscaling policy for cluster ${aws_eks_cluster.this[0].name}"
policy = data.aws_iam_policy_document.worker_autoscaling[0].json
path = var.iam_path
}
data "aws_iam_policy_document" "worker_autoscaling" {
count = var.manage_worker_iam_resources && var.manage_worker_autoscaling_policy && var.create_eks ? 1 : 0
statement {
sid = "eksWorkerAutoscalingAll"
effect = "Allow"
@@ -402,7 +403,7 @@ data "aws_iam_policy_document" "worker_autoscaling" {
condition {
test = "StringEquals"
variable = "autoscaling:ResourceTag/kubernetes.io/cluster/${aws_eks_cluster.this.name}"
variable = "autoscaling:ResourceTag/kubernetes.io/cluster/${aws_eks_cluster.this[0].name}"
values = ["owned"]
}