mirror of
https://github.com/terraform-aws-modules/terraform-aws-eks.git
synced 2025-09-09 19:32:58 +08:00
feat!: Upgrade min AWS provider and Terraform versions to 6.0 and 1.5.7 respectively (#3412)
* feat!: Upgrade min AWS provider and Terraform versions to `6.0` and `1.5.7` respectively * fix: Remove deprecated arguments in AWS v6.0 provider, upgrade Helm provider to v3.0, bump VPC module to v6.0 * fix: Remove `aws-auth` sub-module * fix: Remove `platform` and `cluster_service_ipv4_cidr` variables from `user-data` sub-module * fix: Resolve all marked `todos` that have been accumulated * fix: Set default `http_put_response_hop_limit` to `1` * fix: Remove IRSA support from Karpenter sub-module * fix: Avoid making GET requests from data sources unless absolutely necessary * feat: Add variable optional attribute definitions * feat: Bump KMS key module version to latest, add remaining variable attribute definitions * fix: Remove `cluster_` prefix from variable names to better match the underlying API * fix: Move all EFA logic to the nodegroup itself * fix: Remove arguments that do not make sense in EKS * fix: Updates from plan validation * fix: Remove more self-managed node group attributes that are commonly not used in EKS clusters * fix: Remove data plane compute `*_defaults` variables that do not work with variable optional attributes * fix: Ignore changes to `bootstrap_self_managed_addons` to aid in upgrade * feat: Add support for `region` argument on relevant resources * feat: Initial pass on upgrade guide * fix: Updates from testing and validating EKS managed node group * fix: Updates from testing and validating self-managed node group * docs: Ensure addon ussage documented is aligned * feat: Switch to dualstack OIDC issuer URL * feat: Allow sourcing over overriding the Karpenter assume role policy * fix: Use `Bool` instead of `StringEquals` for DenyHTTP queue policy * fix: Correct use of `nullable` and default value propagation
This commit is contained in:
Bryant Biggs
GitHub
@@ -16,6 +16,12 @@ variable "cluster_name" {
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "region" {
|
||||
description = "Region where the resource(s) will be managed. Defaults to the Region set in the provider configuration"
|
||||
type = string
|
||||
default = null
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Karpenter controller IAM Role
|
||||
################################################################################
|
||||
@@ -64,7 +70,7 @@ variable "iam_role_permissions_boundary_arn" {
|
||||
|
||||
variable "iam_role_tags" {
|
||||
description = "A map of additional tags to add the the IAM role"
|
||||
type = map(any)
|
||||
type = map(string)
|
||||
default = {}
|
||||
}
|
||||
|
||||
@@ -92,10 +98,42 @@ variable "iam_policy_description" {
|
||||
default = "Karpenter controller IAM policy"
|
||||
}
|
||||
|
||||
variable "iam_role_override_assume_policy_documents" {
|
||||
description = "A list of IAM policy documents to override the default assume role policy document for the Karpenter controller IAM role"
|
||||
type = list(string)
|
||||
default = []
|
||||
}
|
||||
|
||||
variable "iam_role_source_assume_policy_documents" {
|
||||
description = "A list of IAM policy documents to use as a source for the assume role policy document for the Karpenter controller IAM role"
|
||||
type = list(string)
|
||||
default = []
|
||||
}
|
||||
|
||||
variable "iam_policy_statements" {
|
||||
description = "A list of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) - used for adding specific IAM permissions as needed"
|
||||
type = any
|
||||
default = []
|
||||
type = list(object({
|
||||
sid = optional(string)
|
||||
actions = optional(list(string))
|
||||
not_actions = optional(list(string))
|
||||
effect = optional(string)
|
||||
resources = optional(list(string))
|
||||
not_resources = optional(list(string))
|
||||
principals = optional(list(object({
|
||||
type = string
|
||||
identifiers = list(string)
|
||||
})))
|
||||
not_principals = optional(list(object({
|
||||
type = string
|
||||
identifiers = list(string)
|
||||
})))
|
||||
condition = optional(list(object({
|
||||
test = string
|
||||
values = list(string)
|
||||
variable = string
|
||||
})))
|
||||
}))
|
||||
default = null
|
||||
}
|
||||
|
||||
variable "iam_role_policies" {
|
||||
@@ -110,55 +148,14 @@ variable "ami_id_ssm_parameter_arns" {
|
||||
default = []
|
||||
}
|
||||
|
||||
variable "enable_pod_identity" {
|
||||
description = "Determines whether to enable support for EKS pod identity"
|
||||
type = bool
|
||||
default = true
|
||||
}
|
||||
|
||||
# TODO - make v1 permssions the default policy at next breaking change
|
||||
variable "enable_v1_permissions" {
|
||||
description = "Determines whether to enable permissions suitable for v1+ (`true`) or for v0.33.x-v0.37.x (`false`)"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# IAM Role for Service Account (IRSA)
|
||||
################################################################################
|
||||
|
||||
variable "enable_irsa" {
|
||||
description = "Determines whether to enable support for IAM role for service accounts"
|
||||
type = bool
|
||||
default = false
|
||||
}
|
||||
|
||||
variable "irsa_oidc_provider_arn" {
|
||||
description = "OIDC provider arn used in trust policy for IAM role for service accounts"
|
||||
type = string
|
||||
default = ""
|
||||
}
|
||||
|
||||
variable "irsa_namespace_service_accounts" {
|
||||
description = "List of `namespace:serviceaccount`pairs to use in trust policy for IAM role for service accounts"
|
||||
type = list(string)
|
||||
default = ["karpenter:karpenter"]
|
||||
}
|
||||
|
||||
variable "irsa_assume_role_condition_test" {
|
||||
description = "Name of the [IAM condition operator](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html) to evaluate when assuming the role"
|
||||
type = string
|
||||
default = "StringEquals"
|
||||
}
|
||||
|
||||
################################################################################
|
||||
# Pod Identity Association
|
||||
################################################################################
|
||||
# TODO - Change default to `true` at next breaking change
|
||||
|
||||
variable "create_pod_identity_association" {
|
||||
description = "Determines whether to create pod identity association"
|
||||
type = bool
|
||||
default = false
|
||||
default = true
|
||||
}
|
||||
|
||||
variable "namespace" {
|
||||
|
||||
Reference in New Issue
Block a user