xpk/terraform-aws-eks
1
0
Fork 0
mirror of https://github.com/terraform-aws-modules/terraform-aws-eks.git synced 2025-09-09 19:32:58 +08:00
Code Activity

Renamed destroy-time flag

Browse Source
This commit is contained in:
syst0m
2019-11-14 15:41:18 +00:00
parent 430051694e
commit 96294f639f
8 changed files with 50 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+14 -1
View File
@@ -44,6 +44,19 @@ module "my-cluster" {
}
}
```
## Conditional creation
Sometimes you need to have a way to create EKS resources conditionally but Terraform does not allow to use `count` inside `module` block, so the solution is to specify argument `create_cluster`.
```hcl
# This cluster will not be created
module "eks" {
source = "terraform-aws-modules/eks/aws"
create_cluster = false
# ... omitted
}
```
## Other documentation
@@ -123,7 +136,7 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a
| cluster\_security\_group\_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the workers | string | `""` | no |
| cluster\_version | Kubernetes version to use for the EKS cluster. | string | `"1.14"` | no |
| config\_output\_path | Where to save the Kubectl config file (if `write_kubeconfig = true`). Assumed to be a directory if the value ends with a forward slash `/`. | string | `"./"` | no |
| enabled | Controls if EKS resources should be created (it affects almost all resources) | bool | `"true"` | no |
| create\_cluster | Controls if EKS resources should be created (it affects almost all resources) | bool | `"true"` | no |
| iam\_path | If provided, all IAM roles will be created on this path. | string | `"/"` | no |
| kubeconfig\_aws\_authenticator\_additional\_args | Any additional arguments to pass to the authenticator such as the role to assume. e.g. ["-r", "MyEksRole"]. | list(string) | `[]` | no |
| kubeconfig\_aws\_authenticator\_command | Command to use to fetch AWS EKS credentials. | string | `"aws-iam-authenticator"` | no |
aws_auth.tf
+3 -3
View File
@@ -1,11 +1,11 @@
resource "local_file" "config_map_aws_auth" {
count = var.write_aws_auth_config && var.enabled ? 1 : 0
count = var.write_aws_auth_config && var.create_cluster ? 1 : 0
content = data.template_file.config_map_aws_auth[0].rendered
filename = "${var.config_output_path}config-map-aws-auth_${var.cluster_name}.yaml"
}
resource "null_resource" "update_config_map_aws_auth" {
count = var.manage_aws_auth && var.enabled ? 1 : 0
count = var.manage_aws_auth && var.create_cluster ? 1 : 0
depends_on = [aws_eks_cluster.this]
provisioner "local-exec" {
@@ -77,7 +77,7 @@ data "template_file" "worker_role_arns" {
}
data "template_file" "config_map_aws_auth" {
count = var.enabled ? 1 : 0
count = var.create_cluster ? 1 : 0
template = file("${path.module}/templates/config-map-aws-auth.yaml.tpl")
vars = {
cluster.tf
+8 -8
View File
@@ -1,5 +1,5 @@
resource "aws_cloudwatch_log_group" "this" {
count = length(var.cluster_enabled_log_types) > 0 && var.enabled ? 1 : 0
count = length(var.cluster_enabled_log_types) > 0 && var.create_cluster ? 1 : 0
name = "/aws/eks/${var.cluster_name}/cluster"
retention_in_days = var.cluster_log_retention_in_days
kms_key_id = var.cluster_log_kms_key_id
@@ -7,7 +7,7 @@ resource "aws_cloudwatch_log_group" "this" {
}
resource "aws_eks_cluster" "this" {
count = var.enabled ? 1 : 0
count = var.create_cluster ? 1 : 0
name = var.cluster_name
enabled_cluster_log_types = var.cluster_enabled_log_types
role_arn = local.cluster_iam_role_arn
@@ -34,7 +34,7 @@ resource "aws_eks_cluster" "this" {
}
resource "aws_security_group" "cluster" {
count = var.cluster_create_security_group && var.enabled ? 1 : 0
count = var.cluster_create_security_group && var.create_cluster ? 1 : 0
name_prefix = var.cluster_name
description = "EKS cluster security group."
vpc_id = var.vpc_id
@@ -47,7 +47,7 @@ resource "aws_security_group" "cluster" {
}
resource "aws_security_group_rule" "cluster_egress_internet" {
count = var.cluster_create_security_group && var.enabled ? 1 : 0
count = var.cluster_create_security_group && var.create_cluster ? 1 : 0
description = "Allow cluster egress access to the Internet."
protocol = "-1"
security_group_id = local.cluster_security_group_id
@@ -58,7 +58,7 @@ resource "aws_security_group_rule" "cluster_egress_internet" {
}
resource "aws_security_group_rule" "cluster_https_worker_ingress" {
count = var.cluster_create_security_group && var.enabled ? 1 : 0
count = var.cluster_create_security_group && var.create_cluster ? 1 : 0
description = "Allow pods to communicate with the EKS cluster API."
protocol = "tcp"
security_group_id = local.cluster_security_group_id
@@ -69,7 +69,7 @@ resource "aws_security_group_rule" "cluster_https_worker_ingress" {
}
resource "aws_iam_role" "cluster" {
count = var.manage_cluster_iam_resources && var.enabled ? 1 : 0
count = var.manage_cluster_iam_resources && var.create_cluster ? 1 : 0
name_prefix = var.cluster_name
assume_role_policy = data.aws_iam_policy_document.cluster_assume_role_policy.json
permissions_boundary = var.permissions_boundary
@@ -79,13 +79,13 @@ resource "aws_iam_role" "cluster" {
}
resource "aws_iam_role_policy_attachment" "cluster_AmazonEKSClusterPolicy" {
count = var.manage_cluster_iam_resources && var.enabled ? 1 : 0
count = var.manage_cluster_iam_resources && var.create_cluster ? 1 : 0
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
role = local.cluster_iam_role_name
}
resource "aws_iam_role_policy_attachment" "cluster_AmazonEKSServicePolicy" {
count = var.manage_cluster_iam_resources && var.enabled ? 1 : 0
count = var.manage_cluster_iam_resources && var.create_cluster ? 1 : 0
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
role = local.cluster_iam_role_name
}
data.tf
+1 -1
View File
@@ -63,7 +63,7 @@ data "aws_iam_policy_document" "cluster_assume_role_policy" {
}
data "template_file" "kubeconfig" {
count = var.enabled ? 1 : 0
count = var.create_cluster ? 1 : 0
template = file("${path.module}/templates/kubeconfig.tpl")
vars = {
kubectl.tf
+1 -1
View File
@@ -1,5 +1,5 @@
resource "local_file" "kubeconfig" {
count = var.write_kubeconfig && var.enabled ? 1 : 0
count = var.write_kubeconfig && var.create_cluster ? 1 : 0
content = data.template_file.kubeconfig[0].rendered
filename = "${substr(var.config_output_path, -1, 1) == "/" ? "${var.config_output_path}kubeconfig_${var.cluster_name}" : var.config_output_path}"
}
variables.tf
+1 -1
View File
@@ -294,7 +294,7 @@ variable "attach_worker_cni_policy" {
default = true
}
variable "enabled" {
variable "create_cluster" {
description = "Controls if EKS resources should be created (it affects almost all resources)"
type = bool
default = true
workers.tf
+18 -18
View File
@@ -1,7 +1,7 @@
# Worker Groups using Launch Configurations
resource "aws_autoscaling_group" "workers" {
count = var.enabled ? local.worker_group_count : 0
count = var.create_cluster ? local.worker_group_count : 0
name_prefix = join(
"-",
compact(
@@ -143,7 +143,7 @@ resource "aws_autoscaling_group" "workers" {
}
resource "aws_launch_configuration" "workers" {
count = var.enabled ? local.worker_group_count : 0
count = var.create_cluster ? local.worker_group_count : 0
name_prefix = "${aws_eks_cluster.this[count.index].name}-${lookup(var.worker_groups[count.index], "name", count.index)}"
associate_public_ip_address = lookup(
var.worker_groups[count.index],
@@ -232,7 +232,7 @@ resource "aws_launch_configuration" "workers" {
}
resource "random_pet" "workers" {
count = var.enabled ? local.worker_group_count : 0
count = var.create_cluster ? local.worker_group_count : 0
separator = "-"
length = 2
@@ -243,7 +243,7 @@ resource "random_pet" "workers" {
}
resource "aws_security_group" "workers" {
count = var.worker_create_security_group && var.enabled ? 1 : 0
count = var.worker_create_security_group && var.create_cluster ? 1 : 0
name_prefix = aws_eks_cluster.this[count.index].name
description = "Security group for all nodes in the cluster."
vpc_id = var.vpc_id
@@ -257,7 +257,7 @@ resource "aws_security_group" "workers" {
}
resource "aws_security_group_rule" "workers_egress_internet" {
count = var.worker_create_security_group && var.enabled ? 1 : 0
count = var.worker_create_security_group && var.create_cluster ? 1 : 0
description = "Allow nodes all egress to the Internet."
protocol = "-1"
security_group_id = local.worker_security_group_id
@@ -268,7 +268,7 @@ resource "aws_security_group_rule" "workers_egress_internet" {
}
resource "aws_security_group_rule" "workers_ingress_self" {
count = var.worker_create_security_group && var.enabled ? 1 : 0
count = var.worker_create_security_group && var.create_cluster ? 1 : 0
description = "Allow node to communicate with each other."
protocol = "-1"
security_group_id = local.worker_security_group_id
@@ -279,7 +279,7 @@ resource "aws_security_group_rule" "workers_ingress_self" {
}
resource "aws_security_group_rule" "workers_ingress_cluster" {
count = var.worker_create_security_group && var.enabled ? 1 : 0
count = var.worker_create_security_group && var.create_cluster ? 1 : 0
description = "Allow workers pods to receive communication from the cluster control plane."
protocol = "tcp"
security_group_id = local.worker_security_group_id
@@ -290,7 +290,7 @@ resource "aws_security_group_rule" "workers_ingress_cluster" {
}
resource "aws_security_group_rule" "workers_ingress_cluster_kubelet" {
count = var.worker_create_security_group && var.enabled ? var.worker_sg_ingress_from_port > 10250 ? 1 : 0 : 0
count = var.worker_create_security_group && var.create_cluster ? var.worker_sg_ingress_from_port > 10250 ? 1 : 0 : 0
description = "Allow workers Kubelets to receive communication from the cluster control plane."
protocol = "tcp"
security_group_id = local.worker_security_group_id
@@ -301,7 +301,7 @@ resource "aws_security_group_rule" "workers_ingress_cluster_kubelet" {
}
resource "aws_security_group_rule" "workers_ingress_cluster_https" {
count = var.worker_create_security_group && var.enabled ? 1 : 0
count = var.worker_create_security_group && var.create_cluster ? 1 : 0
description = "Allow pods running extension API servers on port 443 to receive communication from cluster control plane."
protocol = "tcp"
security_group_id = local.worker_security_group_id
@@ -312,7 +312,7 @@ resource "aws_security_group_rule" "workers_ingress_cluster_https" {
}
resource "aws_iam_role" "workers" {
count = var.manage_worker_iam_resources && var.enabled ? 1 : 0
count = var.manage_worker_iam_resources && var.create_cluster ? 1 : 0
name_prefix = var.workers_role_name != "" ? null : aws_eks_cluster.this[count.index].name
name = var.workers_role_name != "" ? var.workers_role_name : null
assume_role_policy = data.aws_iam_policy_document.workers_assume_role_policy.json
@@ -323,7 +323,7 @@ resource "aws_iam_role" "workers" {
}
resource "aws_iam_instance_profile" "workers" {
count = var.manage_worker_iam_resources && var.enabled ? local.worker_group_count : 0
count = var.manage_worker_iam_resources && var.create_cluster ? local.worker_group_count : 0
name_prefix = aws_eks_cluster.this[count.index].name
role = lookup(
var.worker_groups[count.index],
@@ -335,37 +335,37 @@ resource "aws_iam_instance_profile" "workers" {
}
resource "aws_iam_role_policy_attachment" "workers_AmazonEKSWorkerNodePolicy" {
count = var.manage_worker_iam_resources && var.enabled ? 1 : 0
count = var.manage_worker_iam_resources && var.create_cluster ? 1 : 0
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"
role = aws_iam_role.workers[0].name
}
resource "aws_iam_role_policy_attachment" "workers_AmazonEKS_CNI_Policy" {
count = var.manage_worker_iam_resources && var.attach_worker_cni_policy && var.enabled ? 1 : 0
count = var.manage_worker_iam_resources && var.attach_worker_cni_policy && var.create_cluster ? 1 : 0
policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
role = aws_iam_role.workers[0].name
}
resource "aws_iam_role_policy_attachment" "workers_AmazonEC2ContainerRegistryReadOnly" {
count = var.manage_worker_iam_resources && var.enabled ? 1 : 0
count = var.manage_worker_iam_resources && var.create_cluster ? 1 : 0
policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"
role = aws_iam_role.workers[0].name
}
resource "aws_iam_role_policy_attachment" "workers_additional_policies" {
count = var.manage_worker_iam_resources && var.enabled ? length(var.workers_additional_policies) : 0
count = var.manage_worker_iam_resources && var.create_cluster ? length(var.workers_additional_policies) : 0
role = aws_iam_role.workers[0].name
policy_arn = var.workers_additional_policies[count.index]
}
resource "aws_iam_role_policy_attachment" "workers_autoscaling" {
count = var.manage_worker_iam_resources && var.manage_worker_autoscaling_policy && var.attach_worker_autoscaling_policy && var.enabled ? 1 : 0
count = var.manage_worker_iam_resources && var.manage_worker_autoscaling_policy && var.attach_worker_autoscaling_policy && var.create_cluster ? 1 : 0
policy_arn = aws_iam_policy.worker_autoscaling[0].arn
role = aws_iam_role.workers[0].name
}
resource "aws_iam_policy" "worker_autoscaling" {
count = var.manage_worker_iam_resources && var.manage_worker_autoscaling_policy && var.enabled ? 1 : 0
count = var.manage_worker_iam_resources && var.manage_worker_autoscaling_policy && var.create_cluster ? 1 : 0
name_prefix = "eks-worker-autoscaling-${aws_eks_cluster.this[count.index].name}"
description = "EKS worker node autoscaling policy for cluster ${aws_eks_cluster.this[count.index].name}"
policy = data.aws_iam_policy_document.worker_autoscaling[0].json
@@ -373,7 +373,7 @@ resource "aws_iam_policy" "worker_autoscaling" {
}
data "aws_iam_policy_document" "worker_autoscaling" {
count = var.manage_worker_iam_resources && var.manage_worker_autoscaling_policy && var.enabled ? 1 : 0
count = var.manage_worker_iam_resources && var.manage_worker_autoscaling_policy && var.create_cluster ? 1 : 0
statement {
sid = "eksWorkerAutoscalingAll"
effect = "Allow"
workers_launch_template.tf
+4 -4
View File
@@ -1,7 +1,7 @@
# Worker Groups using Launch Templates
resource "aws_autoscaling_group" "workers_launch_template" {
count = var.enabled ? local.worker_group_launch_template_count : 0
count = var.create_cluster ? local.worker_group_launch_template_count : 0
name_prefix = join(
"-",
compact(
@@ -218,7 +218,7 @@ resource "aws_autoscaling_group" "workers_launch_template" {
}
resource "aws_launch_template" "workers_launch_template" {
count = var.enabled ? (local.worker_group_launch_template_count) : 0
count = var.create_cluster ? (local.worker_group_launch_template_count) : 0
name_prefix = "${aws_eks_cluster.this[count.index].name}-${lookup(
var.worker_groups_launch_template[count.index],
"name",
@@ -382,7 +382,7 @@ resource "aws_launch_template" "workers_launch_template" {
}
resource "random_pet" "workers_launch_template" {
count = var.enabled ? local.worker_group_launch_template_count : 0
count = var.create_cluster ? local.worker_group_launch_template_count : 0
separator = "-"
length = 2
@@ -401,7 +401,7 @@ resource "random_pet" "workers_launch_template" {
}
resource "aws_iam_instance_profile" "workers_launch_template" {
count = var.manage_worker_iam_resources && var.enabled ? local.worker_group_launch_template_count : 0
count = var.manage_worker_iam_resources && var.create_cluster ? local.worker_group_launch_template_count : 0
name_prefix = aws_eks_cluster.this[count.index].name
role = lookup(
var.worker_groups_launch_template[count.index],