mirror of
https://github.com/terraform-aws-modules/terraform-aws-eks.git
synced 2025-09-09 19:32:58 +08:00
feat!: Upgrade min AWS provider and Terraform versions to 6.0 and 1.5.7 respectively (#3412)
* feat!: Upgrade min AWS provider and Terraform versions to `6.0` and `1.5.7` respectively * fix: Remove deprecated arguments in AWS v6.0 provider, upgrade Helm provider to v3.0, bump VPC module to v6.0 * fix: Remove `aws-auth` sub-module * fix: Remove `platform` and `cluster_service_ipv4_cidr` variables from `user-data` sub-module * fix: Resolve all marked `todos` that have been accumulated * fix: Set default `http_put_response_hop_limit` to `1` * fix: Remove IRSA support from Karpenter sub-module * fix: Avoid making GET requests from data sources unless absolutely necessary * feat: Add variable optional attribute definitions * feat: Bump KMS key module version to latest, add remaining variable attribute definitions * fix: Remove `cluster_` prefix from variable names to better match the underlying API * fix: Move all EFA logic to the nodegroup itself * fix: Remove arguments that do not make sense in EKS * fix: Updates from plan validation * fix: Remove more self-managed node group attributes that are commonly not used in EKS clusters * fix: Remove data plane compute `*_defaults` variables that do not work with variable optional attributes * fix: Ignore changes to `bootstrap_self_managed_addons` to aid in upgrade * feat: Add support for `region` argument on relevant resources * feat: Initial pass on upgrade guide * fix: Updates from testing and validating EKS managed node group * fix: Updates from testing and validating self-managed node group * docs: Ensure addon ussage documented is aligned * feat: Switch to dualstack OIDC issuer URL * feat: Allow sourcing over overriding the Karpenter assume role policy * fix: Use `Bool` instead of `StringEquals` for DenyHTTP queue policy * fix: Correct use of `nullable` and default value propagation
This commit is contained in:
Bryant Biggs
GitHub
+11
-364
@@ -1,357 +1,4 @@
|
||||
################################################################################
|
||||
# v0.33.x - v0.37.x Controller IAM Policy
|
||||
################################################################################
|
||||
|
||||
data "aws_iam_policy_document" "v033" {
|
||||
count = local.create_iam_role ? 1 : 0
|
||||
|
||||
statement {
|
||||
sid = "AllowScopedEC2InstanceActions"
|
||||
resources = [
|
||||
"arn:${local.partition}:ec2:*::image/*",
|
||||
"arn:${local.partition}:ec2:*::snapshot/*",
|
||||
"arn:${local.partition}:ec2:*:*:spot-instances-request/*",
|
||||
"arn:${local.partition}:ec2:*:*:security-group/*",
|
||||
"arn:${local.partition}:ec2:*:*:subnet/*",
|
||||
"arn:${local.partition}:ec2:*:*:launch-template/*",
|
||||
]
|
||||
|
||||
actions = [
|
||||
"ec2:RunInstances",
|
||||
"ec2:CreateFleet"
|
||||
]
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "AllowScopedEC2InstanceActionsWithTags"
|
||||
resources = [
|
||||
"arn:${local.partition}:ec2:*:*:fleet/*",
|
||||
"arn:${local.partition}:ec2:*:*:instance/*",
|
||||
"arn:${local.partition}:ec2:*:*:volume/*",
|
||||
"arn:${local.partition}:ec2:*:*:network-interface/*",
|
||||
"arn:${local.partition}:ec2:*:*:launch-template/*",
|
||||
"arn:${local.partition}:ec2:*:*:spot-instances-request/*",
|
||||
]
|
||||
actions = [
|
||||
"ec2:RunInstances",
|
||||
"ec2:CreateFleet",
|
||||
"ec2:CreateLaunchTemplate"
|
||||
]
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:RequestTag/kubernetes.io/cluster/${var.cluster_name}"
|
||||
values = ["owned"]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringLike"
|
||||
variable = "aws:RequestTag/karpenter.sh/nodepool"
|
||||
values = ["*"]
|
||||
}
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "AllowScopedResourceCreationTagging"
|
||||
resources = [
|
||||
"arn:${local.partition}:ec2:*:*:fleet/*",
|
||||
"arn:${local.partition}:ec2:*:*:instance/*",
|
||||
"arn:${local.partition}:ec2:*:*:volume/*",
|
||||
"arn:${local.partition}:ec2:*:*:network-interface/*",
|
||||
"arn:${local.partition}:ec2:*:*:launch-template/*",
|
||||
"arn:${local.partition}:ec2:*:*:spot-instances-request/*",
|
||||
]
|
||||
actions = ["ec2:CreateTags"]
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:RequestTag/kubernetes.io/cluster/${var.cluster_name}"
|
||||
values = ["owned"]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "ec2:CreateAction"
|
||||
values = [
|
||||
"RunInstances",
|
||||
"CreateFleet",
|
||||
"CreateLaunchTemplate",
|
||||
]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringLike"
|
||||
variable = "aws:RequestTag/karpenter.sh/nodepool"
|
||||
values = ["*"]
|
||||
}
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "AllowScopedResourceTagging"
|
||||
resources = ["arn:${local.partition}:ec2:*:*:instance/*"]
|
||||
actions = ["ec2:CreateTags"]
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:ResourceTag/kubernetes.io/cluster/${var.cluster_name}"
|
||||
values = ["owned"]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringLike"
|
||||
variable = "aws:ResourceTag/karpenter.sh/nodepool"
|
||||
values = ["*"]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "ForAllValues:StringEquals"
|
||||
variable = "aws:TagKeys"
|
||||
values = [
|
||||
"karpenter.sh/nodeclaim",
|
||||
"Name",
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "AllowScopedDeletion"
|
||||
resources = [
|
||||
"arn:${local.partition}:ec2:*:*:instance/*",
|
||||
"arn:${local.partition}:ec2:*:*:launch-template/*"
|
||||
]
|
||||
|
||||
actions = [
|
||||
"ec2:TerminateInstances",
|
||||
"ec2:DeleteLaunchTemplate"
|
||||
]
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:ResourceTag/kubernetes.io/cluster/${var.cluster_name}"
|
||||
values = ["owned"]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringLike"
|
||||
variable = "aws:ResourceTag/karpenter.sh/nodepool"
|
||||
values = ["*"]
|
||||
}
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "AllowRegionalReadActions"
|
||||
resources = ["*"]
|
||||
actions = [
|
||||
"ec2:DescribeAvailabilityZones",
|
||||
"ec2:DescribeImages",
|
||||
"ec2:DescribeInstances",
|
||||
"ec2:DescribeInstanceTypeOfferings",
|
||||
"ec2:DescribeInstanceTypes",
|
||||
"ec2:DescribeLaunchTemplates",
|
||||
"ec2:DescribeSecurityGroups",
|
||||
"ec2:DescribeSpotPriceHistory",
|
||||
"ec2:DescribeSubnets"
|
||||
]
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:RequestedRegion"
|
||||
values = [local.region]
|
||||
}
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "AllowSSMReadActions"
|
||||
resources = coalescelist(var.ami_id_ssm_parameter_arns, ["arn:${local.partition}:ssm:${local.region}::parameter/aws/service/*"])
|
||||
actions = ["ssm:GetParameter"]
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "AllowPricingReadActions"
|
||||
resources = ["*"]
|
||||
actions = ["pricing:GetProducts"]
|
||||
}
|
||||
|
||||
dynamic "statement" {
|
||||
for_each = local.enable_spot_termination ? [1] : []
|
||||
|
||||
content {
|
||||
sid = "AllowInterruptionQueueActions"
|
||||
resources = [try(aws_sqs_queue.this[0].arn, null)]
|
||||
actions = [
|
||||
"sqs:DeleteMessage",
|
||||
"sqs:GetQueueAttributes",
|
||||
"sqs:GetQueueUrl",
|
||||
"sqs:ReceiveMessage"
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "AllowPassingInstanceRole"
|
||||
resources = var.create_node_iam_role ? [aws_iam_role.node[0].arn] : [var.node_iam_role_arn]
|
||||
actions = ["iam:PassRole"]
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "iam:PassedToService"
|
||||
values = ["ec2.${local.dns_suffix}"]
|
||||
}
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "AllowScopedInstanceProfileCreationActions"
|
||||
resources = ["*"]
|
||||
actions = ["iam:CreateInstanceProfile"]
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:RequestTag/kubernetes.io/cluster/${var.cluster_name}"
|
||||
values = ["owned"]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:RequestTag/topology.kubernetes.io/region"
|
||||
values = [local.region]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringLike"
|
||||
variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass"
|
||||
values = ["*"]
|
||||
}
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "AllowScopedInstanceProfileTagActions"
|
||||
resources = ["*"]
|
||||
actions = ["iam:TagInstanceProfile"]
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:ResourceTag/kubernetes.io/cluster/${var.cluster_name}"
|
||||
values = ["owned"]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:ResourceTag/topology.kubernetes.io/region"
|
||||
values = [local.region]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:RequestTag/kubernetes.io/cluster/${var.cluster_name}"
|
||||
values = ["owned"]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:ResourceTag/topology.kubernetes.io/region"
|
||||
values = [local.region]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringLike"
|
||||
variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass"
|
||||
values = ["*"]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringLike"
|
||||
variable = "aws:RequestTag/karpenter.k8s.aws/ec2nodeclass"
|
||||
values = ["*"]
|
||||
}
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "AllowScopedInstanceProfileActions"
|
||||
resources = ["*"]
|
||||
actions = [
|
||||
"iam:AddRoleToInstanceProfile",
|
||||
"iam:RemoveRoleFromInstanceProfile",
|
||||
"iam:DeleteInstanceProfile"
|
||||
]
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:ResourceTag/kubernetes.io/cluster/${var.cluster_name}"
|
||||
values = ["owned"]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringEquals"
|
||||
variable = "aws:ResourceTag/topology.kubernetes.io/region"
|
||||
values = [local.region]
|
||||
}
|
||||
|
||||
condition {
|
||||
test = "StringLike"
|
||||
variable = "aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass"
|
||||
values = ["*"]
|
||||
}
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "AllowInstanceProfileReadActions"
|
||||
resources = ["*"]
|
||||
actions = ["iam:GetInstanceProfile"]
|
||||
}
|
||||
|
||||
statement {
|
||||
sid = "AllowAPIServerEndpointDiscovery"
|
||||
resources = ["arn:${local.partition}:eks:${local.region}:${local.account_id}:cluster/${var.cluster_name}"]
|
||||
actions = ["eks:DescribeCluster"]
|
||||
}
|
||||
|
||||
dynamic "statement" {
|
||||
for_each = var.iam_policy_statements
|
||||
|
||||
content {
|
||||
sid = try(statement.value.sid, null)
|
||||
actions = try(statement.value.actions, null)
|
||||
not_actions = try(statement.value.not_actions, null)
|
||||
effect = try(statement.value.effect, null)
|
||||
resources = try(statement.value.resources, null)
|
||||
not_resources = try(statement.value.not_resources, null)
|
||||
|
||||
dynamic "principals" {
|
||||
for_each = try(statement.value.principals, [])
|
||||
|
||||
content {
|
||||
type = principals.value.type
|
||||
identifiers = principals.value.identifiers
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "not_principals" {
|
||||
for_each = try(statement.value.not_principals, [])
|
||||
|
||||
content {
|
||||
type = not_principals.value.type
|
||||
identifiers = not_principals.value.identifiers
|
||||
}
|
||||
}
|
||||
|
||||
dynamic "condition" {
|
||||
for_each = try(statement.value.conditions, [])
|
||||
|
||||
content {
|
||||
test = condition.value.test
|
||||
values = condition.value.values
|
||||
variable = condition.value.variable
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# v1.0.x Controller IAM Policy
|
||||
################################################################################
|
||||
|
||||
data "aws_iam_policy_document" "v1" {
|
||||
data "aws_iam_policy_document" "controller" {
|
||||
count = local.create_iam_role ? 1 : 0
|
||||
|
||||
statement {
|
||||
@@ -708,18 +355,18 @@ data "aws_iam_policy_document" "v1" {
|
||||
}
|
||||
|
||||
dynamic "statement" {
|
||||
for_each = var.iam_policy_statements
|
||||
for_each = var.iam_policy_statements != null ? var.iam_policy_statements : []
|
||||
|
||||
content {
|
||||
sid = try(statement.value.sid, null)
|
||||
actions = try(statement.value.actions, null)
|
||||
not_actions = try(statement.value.not_actions, null)
|
||||
effect = try(statement.value.effect, null)
|
||||
resources = try(statement.value.resources, null)
|
||||
not_resources = try(statement.value.not_resources, null)
|
||||
sid = statement.value.sid
|
||||
actions = statement.value.actions
|
||||
not_actions = statement.value.not_actions
|
||||
effect = statement.value.effect
|
||||
resources = statement.value.resources
|
||||
not_resources = statement.value.not_resources
|
||||
|
||||
dynamic "principals" {
|
||||
for_each = try(statement.value.principals, [])
|
||||
for_each = statement.value.principals != null ? statement.value.principals : []
|
||||
|
||||
content {
|
||||
type = principals.value.type
|
||||
@@ -728,7 +375,7 @@ data "aws_iam_policy_document" "v1" {
|
||||
}
|
||||
|
||||
dynamic "not_principals" {
|
||||
for_each = try(statement.value.not_principals, [])
|
||||
for_each = statement.value.not_principals != null ? statement.value.not_principals : []
|
||||
|
||||
content {
|
||||
type = not_principals.value.type
|
||||
@@ -737,7 +384,7 @@ data "aws_iam_policy_document" "v1" {
|
||||
}
|
||||
|
||||
dynamic "condition" {
|
||||
for_each = try(statement.value.conditions, [])
|
||||
for_each = statement.value.condition != null ? statement.value.condition : []
|
||||
|
||||
content {
|
||||
test = condition.value.test
|
||||
|
||||
Reference in New Issue
Block a user