mirror of
https://github.com/terraform-aws-modules/terraform-aws-eks.git
synced 2025-09-09 19:32:58 +08:00
feat!: Upgrade min AWS provider and Terraform versions to 6.0 and 1.5.7 respectively (#3412)
* feat!: Upgrade min AWS provider and Terraform versions to `6.0` and `1.5.7` respectively * fix: Remove deprecated arguments in AWS v6.0 provider, upgrade Helm provider to v3.0, bump VPC module to v6.0 * fix: Remove `aws-auth` sub-module * fix: Remove `platform` and `cluster_service_ipv4_cidr` variables from `user-data` sub-module * fix: Resolve all marked `todos` that have been accumulated * fix: Set default `http_put_response_hop_limit` to `1` * fix: Remove IRSA support from Karpenter sub-module * fix: Avoid making GET requests from data sources unless absolutely necessary * feat: Add variable optional attribute definitions * feat: Bump KMS key module version to latest, add remaining variable attribute definitions * fix: Remove `cluster_` prefix from variable names to better match the underlying API * fix: Move all EFA logic to the nodegroup itself * fix: Remove arguments that do not make sense in EKS * fix: Updates from plan validation * fix: Remove more self-managed node group attributes that are commonly not used in EKS clusters * fix: Remove data plane compute `*_defaults` variables that do not work with variable optional attributes * fix: Ignore changes to `bootstrap_self_managed_addons` to aid in upgrade * feat: Add support for `region` argument on relevant resources * feat: Initial pass on upgrade guide * fix: Updates from testing and validating EKS managed node group * fix: Updates from testing and validating self-managed node group * docs: Ensure addon ussage documented is aligned * feat: Switch to dualstack OIDC issuer URL * feat: Allow sourcing over overriding the Karpenter assume role policy * fix: Use `Bool` instead of `StringEquals` for DenyHTTP queue policy * fix: Correct use of `nullable` and default value propagation
This commit is contained in:
Bryant Biggs
GitHub
@@ -28,14 +28,14 @@ module "fargate_profile" {
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.2 |
|
||||
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.95, < 6.0.0 |
|
||||
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.7 |
|
||||
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 6.0 |
|
||||
|
||||
## Providers
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.95, < 6.0.0 |
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 6.0 |
|
||||
|
||||
## Modules
|
||||
|
||||
@@ -60,26 +60,29 @@ No modules.
|
||||
|
||||
| Name | Description | Type | Default | Required |
|
||||
|------|-------------|------|---------|:--------:|
|
||||
| <a name="input_account_id"></a> [account\_id](#input\_account\_id) | The AWS account ID - pass through value to reduce number of GET requests from data sources | `string` | `""` | no |
|
||||
| <a name="input_cluster_ip_family"></a> [cluster\_ip\_family](#input\_cluster\_ip\_family) | The IP family used to assign Kubernetes pod and service addresses. Valid values are `ipv4` (default) and `ipv6` | `string` | `"ipv4"` | no |
|
||||
| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | Name of the EKS cluster | `string` | `null` | no |
|
||||
| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | Name of the EKS cluster | `string` | `""` | no |
|
||||
| <a name="input_create"></a> [create](#input\_create) | Determines whether to create Fargate profile or not | `bool` | `true` | no |
|
||||
| <a name="input_create_iam_role"></a> [create\_iam\_role](#input\_create\_iam\_role) | Determines whether an IAM role is created or to use an existing IAM role | `bool` | `true` | no |
|
||||
| <a name="input_create_iam_role_policy"></a> [create\_iam\_role\_policy](#input\_create\_iam\_role\_policy) | Determines whether an IAM role policy is created or not | `bool` | `true` | no |
|
||||
| <a name="input_iam_role_additional_policies"></a> [iam\_role\_additional\_policies](#input\_iam\_role\_additional\_policies) | Additional policies to be added to the IAM role | `map(string)` | `{}` | no |
|
||||
| <a name="input_iam_role_arn"></a> [iam\_role\_arn](#input\_iam\_role\_arn) | Existing IAM role ARN for the Fargate profile. Required if `create_iam_role` is set to `false` | `string` | `null` | no |
|
||||
| <a name="input_iam_role_attach_cni_policy"></a> [iam\_role\_attach\_cni\_policy](#input\_iam\_role\_attach\_cni\_policy) | Whether to attach the `AmazonEKS_CNI_Policy`/`AmazonEKS_CNI_IPv6_Policy` IAM policy to the IAM IAM role. WARNING: If set `false` the permissions must be assigned to the `aws-node` DaemonSet pods via another method or nodes will not be able to join the cluster | `bool` | `true` | no |
|
||||
| <a name="input_iam_role_description"></a> [iam\_role\_description](#input\_iam\_role\_description) | Description of the role | `string` | `null` | no |
|
||||
| <a name="input_iam_role_description"></a> [iam\_role\_description](#input\_iam\_role\_description) | Description of the role | `string` | `"Fargate profile IAM role"` | no |
|
||||
| <a name="input_iam_role_name"></a> [iam\_role\_name](#input\_iam\_role\_name) | Name to use on IAM role created | `string` | `""` | no |
|
||||
| <a name="input_iam_role_path"></a> [iam\_role\_path](#input\_iam\_role\_path) | IAM role path | `string` | `null` | no |
|
||||
| <a name="input_iam_role_permissions_boundary"></a> [iam\_role\_permissions\_boundary](#input\_iam\_role\_permissions\_boundary) | ARN of the policy that is used to set the permissions boundary for the IAM role | `string` | `null` | no |
|
||||
| <a name="input_iam_role_policy_statements"></a> [iam\_role\_policy\_statements](#input\_iam\_role\_policy\_statements) | A list of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) - used for adding specific IAM permissions as needed | `any` | `[]` | no |
|
||||
| <a name="input_iam_role_policy_statements"></a> [iam\_role\_policy\_statements](#input\_iam\_role\_policy\_statements) | A list of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) - used for adding specific IAM permissions as needed | <pre>list(object({<br/> sid = optional(string)<br/> actions = optional(list(string))<br/> not_actions = optional(list(string))<br/> effect = optional(string)<br/> resources = optional(list(string))<br/> not_resources = optional(list(string))<br/> principals = optional(list(object({<br/> type = string<br/> identifiers = list(string)<br/> })))<br/> not_principals = optional(list(object({<br/> type = string<br/> identifiers = list(string)<br/> })))<br/> condition = optional(list(object({<br/> test = string<br/> values = list(string)<br/> variable = string<br/> })))<br/> }))</pre> | `null` | no |
|
||||
| <a name="input_iam_role_tags"></a> [iam\_role\_tags](#input\_iam\_role\_tags) | A map of additional tags to add to the IAM role created | `map(string)` | `{}` | no |
|
||||
| <a name="input_iam_role_use_name_prefix"></a> [iam\_role\_use\_name\_prefix](#input\_iam\_role\_use\_name\_prefix) | Determines whether the IAM role name (`iam_role_name`) is used as a prefix | `bool` | `true` | no |
|
||||
| <a name="input_name"></a> [name](#input\_name) | Name of the EKS Fargate Profile | `string` | `""` | no |
|
||||
| <a name="input_selectors"></a> [selectors](#input\_selectors) | Configuration block(s) for selecting Kubernetes Pods to execute with this Fargate Profile | `any` | `[]` | no |
|
||||
| <a name="input_partition"></a> [partition](#input\_partition) | The AWS partition - pass through value to reduce number of GET requests from data sources | `string` | `""` | no |
|
||||
| <a name="input_region"></a> [region](#input\_region) | Region where the resource(s) will be managed. Defaults to the Region set in the provider configuration | `string` | `null` | no |
|
||||
| <a name="input_selectors"></a> [selectors](#input\_selectors) | Configuration block(s) for selecting Kubernetes Pods to execute with this Fargate Profile | <pre>list(object({<br/> labels = optional(map(string))<br/> namespace = string<br/> }))</pre> | `null` | no |
|
||||
| <a name="input_subnet_ids"></a> [subnet\_ids](#input\_subnet\_ids) | A list of subnet IDs for the EKS Fargate Profile | `list(string)` | `[]` | no |
|
||||
| <a name="input_tags"></a> [tags](#input\_tags) | A map of tags to add to all resources | `map(string)` | `{}` | no |
|
||||
| <a name="input_timeouts"></a> [timeouts](#input\_timeouts) | Create and delete timeout configurations for the Fargate Profile | `map(string)` | `{}` | no |
|
||||
| <a name="input_timeouts"></a> [timeouts](#input\_timeouts) | Create and delete timeout configurations for the Fargate Profile | <pre>object({<br/> create = optional(string)<br/> delete = optional(string)<br/> })</pre> | `null` | no |
|
||||
|
||||
## Outputs
|
||||
|
||||
|
||||
@@ -1,18 +1,32 @@
|
||||
data "aws_partition" "current" {}
|
||||
data "aws_caller_identity" "current" {}
|
||||
data "aws_region" "current" {}
|
||||
data "aws_region" "current" {
|
||||
count = var.create ? 1 : 0
|
||||
|
||||
region = var.region
|
||||
}
|
||||
data "aws_partition" "current" {
|
||||
count = var.create && var.partition == "" ? 1 : 0
|
||||
}
|
||||
data "aws_caller_identity" "current" {
|
||||
count = var.create && var.account_id == "" ? 1 : 0
|
||||
}
|
||||
|
||||
locals {
|
||||
account_id = try(data.aws_caller_identity.current[0].account_id, var.account_id)
|
||||
partition = try(data.aws_partition.current[0].partition, var.partition)
|
||||
region = try(data.aws_region.current[0].region, "")
|
||||
}
|
||||
|
||||
locals {
|
||||
create_iam_role = var.create && var.create_iam_role
|
||||
|
||||
iam_role_name = coalesce(var.iam_role_name, var.name, "fargate-profile")
|
||||
iam_role_policy_prefix = "arn:${data.aws_partition.current.partition}:iam::aws:policy"
|
||||
iam_role_policy_prefix = "arn:${local.partition}:iam::aws:policy"
|
||||
|
||||
ipv4_cni_policy = { for k, v in {
|
||||
AmazonEKS_CNI_Policy = "${local.iam_role_policy_prefix}/AmazonEKS_CNI_Policy"
|
||||
} : k => v if var.iam_role_attach_cni_policy && var.cluster_ip_family == "ipv4" }
|
||||
ipv6_cni_policy = { for k, v in {
|
||||
AmazonEKS_CNI_IPv6_Policy = "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:policy/AmazonEKS_CNI_IPv6_Policy"
|
||||
AmazonEKS_CNI_IPv6_Policy = "arn:${local.partition}:iam::${local.account_id}:policy/AmazonEKS_CNI_IPv6_Policy"
|
||||
} : k => v if var.iam_role_attach_cni_policy && var.cluster_ip_family == "ipv6" }
|
||||
}
|
||||
|
||||
@@ -37,7 +51,7 @@ data "aws_iam_policy_document" "assume_role_policy" {
|
||||
variable = "aws:SourceArn"
|
||||
|
||||
values = [
|
||||
"arn:${data.aws_partition.current.partition}:eks:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:fargateprofile/${var.cluster_name}/*",
|
||||
"arn:${local.partition}:eks:${local.region}:${local.account_id}:fargateprofile/${var.cluster_name}/*",
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -83,25 +97,25 @@ resource "aws_iam_role_policy_attachment" "additional" {
|
||||
################################################################################
|
||||
|
||||
locals {
|
||||
create_iam_role_policy = local.create_iam_role && var.create_iam_role_policy && length(var.iam_role_policy_statements) > 0
|
||||
create_iam_role_policy = local.create_iam_role && var.create_iam_role_policy && var.iam_role_policy_statements != null
|
||||
}
|
||||
|
||||
data "aws_iam_policy_document" "role" {
|
||||
count = local.create_iam_role_policy ? 1 : 0
|
||||
|
||||
dynamic "statement" {
|
||||
for_each = var.iam_role_policy_statements
|
||||
for_each = var.iam_role_policy_statements != null ? var.iam_role_policy_statements : []
|
||||
|
||||
content {
|
||||
sid = try(statement.value.sid, null)
|
||||
actions = try(statement.value.actions, null)
|
||||
not_actions = try(statement.value.not_actions, null)
|
||||
effect = try(statement.value.effect, null)
|
||||
resources = try(statement.value.resources, null)
|
||||
not_resources = try(statement.value.not_resources, null)
|
||||
sid = statement.value.sid
|
||||
actions = statement.value.actions
|
||||
not_actions = statement.value.not_actions
|
||||
effect = statement.value.effect
|
||||
resources = statement.value.resources
|
||||
not_resources = statement.value.not_resources
|
||||
|
||||
dynamic "principals" {
|
||||
for_each = try(statement.value.principals, [])
|
||||
for_each = statement.value.principals != null ? statement.value.principals : []
|
||||
|
||||
content {
|
||||
type = principals.value.type
|
||||
@@ -110,7 +124,7 @@ data "aws_iam_policy_document" "role" {
|
||||
}
|
||||
|
||||
dynamic "not_principals" {
|
||||
for_each = try(statement.value.not_principals, [])
|
||||
for_each = statement.value.not_principals != null ? statement.value.not_principals : []
|
||||
|
||||
content {
|
||||
type = not_principals.value.type
|
||||
@@ -119,7 +133,7 @@ data "aws_iam_policy_document" "role" {
|
||||
}
|
||||
|
||||
dynamic "condition" {
|
||||
for_each = try(statement.value.conditions, [])
|
||||
for_each = statement.value.condition != null ? statement.value.condition : []
|
||||
|
||||
content {
|
||||
test = condition.value.test
|
||||
@@ -147,25 +161,28 @@ resource "aws_iam_role_policy" "this" {
|
||||
resource "aws_eks_fargate_profile" "this" {
|
||||
count = var.create ? 1 : 0
|
||||
|
||||
region = var.region
|
||||
|
||||
cluster_name = var.cluster_name
|
||||
fargate_profile_name = var.name
|
||||
pod_execution_role_arn = var.create_iam_role ? aws_iam_role.this[0].arn : var.iam_role_arn
|
||||
subnet_ids = var.subnet_ids
|
||||
|
||||
dynamic "selector" {
|
||||
for_each = var.selectors
|
||||
for_each = var.selectors != null ? var.selectors : []
|
||||
|
||||
content {
|
||||
namespace = selector.value.namespace
|
||||
labels = lookup(selector.value, "labels", {})
|
||||
labels = selector.value.labels
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "timeouts" {
|
||||
for_each = [var.timeouts]
|
||||
for_each = var.timeouts != null ? [var.timeouts] : []
|
||||
|
||||
content {
|
||||
create = lookup(var.timeouts, "create", null)
|
||||
delete = lookup(var.timeouts, "delete", null)
|
||||
create = var.timeouts.create
|
||||
delete = var.timeouts.delete
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -2,12 +2,32 @@ variable "create" {
|
||||
description = "Determines whether to create Fargate profile or not"
|
||||
type = bool
|
||||
default = true
|
||||
nullable = false
|
||||
}
|
||||
|
||||
variable "tags" {
|
||||
description = "A map of tags to add to all resources"
|
||||
type = map(string)
|
||||
default = {}
|
||||
nullable = false
|
||||
}
|
||||
|
||||
variable "region" {
|
||||
description = "Region where the resource(s) will be managed. Defaults to the Region set in the provider configuration"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "partition" {
|
||||
description = "The AWS partition - pass through value to reduce number of GET requests from data sources"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "account_id" {
|
||||
description = "The AWS account ID - pass through value to reduce number of GET requests from data sources"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
|
||||
################################################################################
|
||||
@@ -18,6 +38,7 @@ variable "create_iam_role" {
|
||||
description = "Determines whether an IAM role is created or to use an existing IAM role"
|
||||
type = bool
|
||||
default = true
|
||||
nullable = false
|
||||
}
|
||||
|
||||
variable "cluster_ip_family" {
|
||||
@@ -42,6 +63,7 @@ variable "iam_role_use_name_prefix" {
|
||||
description = "Determines whether the IAM role name (`iam_role_name`) is used as a prefix"
|
||||
type = bool
|
||||
default = true
|
||||
nullable = false
|
||||
}
|
||||
|
||||
variable "iam_role_path" {
|
||||
@@ -53,7 +75,8 @@ variable "iam_role_path" {
|
||||
variable "iam_role_description" {
|
||||
description = "Description of the role"
|
||||
type = string
|
||||
default = null
|
||||
default = "Fargate profile IAM role"
|
||||
nullable = false
|
||||
}
|
||||
|
||||
variable "iam_role_permissions_boundary" {
|
||||
@@ -66,18 +89,21 @@ variable "iam_role_attach_cni_policy" {
|
||||
description = "Whether to attach the `AmazonEKS_CNI_Policy`/`AmazonEKS_CNI_IPv6_Policy` IAM policy to the IAM IAM role. WARNING: If set `false` the permissions must be assigned to the `aws-node` DaemonSet pods via another method or nodes will not be able to join the cluster"
|
||||
type = bool
|
||||
default = true
|
||||
nullable = false
|
||||
}
|
||||
|
||||
variable "iam_role_additional_policies" {
|
||||
description = "Additional policies to be added to the IAM role"
|
||||
type = map(string)
|
||||
default = {}
|
||||
nullable = false
|
||||
}
|
||||
|
||||
variable "iam_role_tags" {
|
||||
description = "A map of additional tags to add to the IAM role created"
|
||||
type = map(string)
|
||||
default = {}
|
||||
nullable = false
|
||||
}
|
||||
|
||||
################################################################################
|
||||
@@ -88,12 +114,33 @@ variable "create_iam_role_policy" {
|
||||
description = "Determines whether an IAM role policy is created or not"
|
||||
type = bool
|
||||
default = true
|
||||
nullable = false
|
||||
}
|
||||
|
||||
variable "iam_role_policy_statements" {
|
||||
description = "A list of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) - used for adding specific IAM permissions as needed"
|
||||
type = any
|
||||
default = []
|
||||
type = list(object({
|
||||
sid = optional(string)
|
||||
actions = optional(list(string))
|
||||
not_actions = optional(list(string))
|
||||
effect = optional(string)
|
||||
resources = optional(list(string))
|
||||
not_resources = optional(list(string))
|
||||
principals = optional(list(object({
|
||||
type = string
|
||||
identifiers = list(string)
|
||||
})))
|
||||
not_principals = optional(list(object({
|
||||
type = string
|
||||
identifiers = list(string)
|
||||
})))
|
||||
condition = optional(list(object({
|
||||
test = string
|
||||
values = list(string)
|
||||
variable = string
|
||||
})))
|
||||
}))
|
||||
default = null
|
||||
}
|
||||
|
||||
################################################################################
|
||||
@@ -103,29 +150,37 @@ variable "iam_role_policy_statements" {
|
||||
variable "cluster_name" {
|
||||
description = "Name of the EKS cluster"
|
||||
type = string
|
||||
default = null
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "name" {
|
||||
description = "Name of the EKS Fargate Profile"
|
||||
type = string
|
||||
default = ""
|
||||
nullable = false
|
||||
}
|
||||
|
||||
variable "subnet_ids" {
|
||||
description = "A list of subnet IDs for the EKS Fargate Profile"
|
||||
type = list(string)
|
||||
default = []
|
||||
nullable = false
|
||||
}
|
||||
|
||||
variable "selectors" {
|
||||
description = "Configuration block(s) for selecting Kubernetes Pods to execute with this Fargate Profile"
|
||||
type = any
|
||||
default = []
|
||||
type = list(object({
|
||||
labels = optional(map(string))
|
||||
namespace = string
|
||||
}))
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "timeouts" {
|
||||
description = "Create and delete timeout configurations for the Fargate Profile"
|
||||
type = map(string)
|
||||
default = {}
|
||||
type = object({
|
||||
create = optional(string)
|
||||
delete = optional(string)
|
||||
})
|
||||
default = null
|
||||
}
|
||||
|
||||
@@ -1,10 +1,10 @@
|
||||
terraform {
|
||||
required_version = ">= 1.3.2"
|
||||
required_version = ">= 1.5.7"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = ">= 5.95, < 6.0.0"
|
||||
version = ">= 6.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user