mirror of
https://github.com/terraform-aws-modules/terraform-aws-eks.git
synced 2025-09-09 19:32:58 +08:00
Tomislav Tomašić
124ea7c151
* Add destroy-time flag
* Update changelog
Fix cluster count
* Fix cluster count
* Fix docs
* Fix outputs
* Fix unsupported attribute on cluster_certificate_authority_data output
Co-Authored-By: Daniel Piddock <33028589+dpiddockcmp@users.noreply.github.com>
* Remove unnecessary flatten from cluster_endpoint output
Co-Authored-By: Daniel Piddock <33028589+dpiddockcmp@users.noreply.github.com>
* Improve description of var.enabled
* Fix errors manifesting when used on an existing-cluster
* Update README.md
* Renamed destroy-time flag
* Revert removal of changelog addition entry
* Update flag name in readme
* Update flag variable name
* Update cluster referencing for consistency
* Update flag name to `create_eks`
* Fixed incorrect count-based reference to aws_eks_cluster.this (there's only one)
* Replaced all incorrect aws_eks_cluster.this[count.index] references (there will be just one, so using '[0]').
* Changelog update, explicitly mentioning flag
* Fixed interpolation deprecation warning
* Fixed outputs to support conditional cluster
* Applied create_eks to aws_auth.tf
* Removed unused variable. Updated Changelog. Formatting.
* Fixed references to aws_eks_cluster.this[0] that would raise errors when setting create_eks to false whilst having launch templates or launch configurations configured.
* Readme and example updates.
* Revert "Readme and example updates."
This reverts commit 18a0746355.
* Updated readme section of conditionally creation with provider example.
* Added conditions to node_groups.
* Fixed reversed map_roles check
* Update aws_auth.tf
Revert this due to https://github.com/terraform-aws-modules/terraform-aws-eks/pull/611
92 lines
3.3 KiB
Terraform
92 lines
3.3 KiB
Terraform
resource "aws_cloudwatch_log_group" "this" {
|
|
count = length(var.cluster_enabled_log_types) > 0 && var.create_eks ? 1 : 0
|
|
name = "/aws/eks/${var.cluster_name}/cluster"
|
|
retention_in_days = var.cluster_log_retention_in_days
|
|
kms_key_id = var.cluster_log_kms_key_id
|
|
tags = var.tags
|
|
}
|
|
|
|
resource "aws_eks_cluster" "this" {
|
|
count = var.create_eks ? 1 : 0
|
|
name = var.cluster_name
|
|
enabled_cluster_log_types = var.cluster_enabled_log_types
|
|
role_arn = local.cluster_iam_role_arn
|
|
version = var.cluster_version
|
|
tags = var.tags
|
|
|
|
vpc_config {
|
|
security_group_ids = [local.cluster_security_group_id]
|
|
subnet_ids = var.subnets
|
|
endpoint_private_access = var.cluster_endpoint_private_access
|
|
endpoint_public_access = var.cluster_endpoint_public_access
|
|
}
|
|
|
|
timeouts {
|
|
create = var.cluster_create_timeout
|
|
delete = var.cluster_delete_timeout
|
|
}
|
|
|
|
depends_on = [
|
|
aws_iam_role_policy_attachment.cluster_AmazonEKSClusterPolicy,
|
|
aws_iam_role_policy_attachment.cluster_AmazonEKSServicePolicy,
|
|
aws_cloudwatch_log_group.this
|
|
]
|
|
}
|
|
|
|
resource "aws_security_group" "cluster" {
|
|
count = var.cluster_create_security_group && var.create_eks ? 1 : 0
|
|
name_prefix = var.cluster_name
|
|
description = "EKS cluster security group."
|
|
vpc_id = var.vpc_id
|
|
tags = merge(
|
|
var.tags,
|
|
{
|
|
"Name" = "${var.cluster_name}-eks_cluster_sg"
|
|
},
|
|
)
|
|
}
|
|
|
|
resource "aws_security_group_rule" "cluster_egress_internet" {
|
|
count = var.cluster_create_security_group && var.create_eks ? 1 : 0
|
|
description = "Allow cluster egress access to the Internet."
|
|
protocol = "-1"
|
|
security_group_id = local.cluster_security_group_id
|
|
cidr_blocks = ["0.0.0.0/0"]
|
|
from_port = 0
|
|
to_port = 0
|
|
type = "egress"
|
|
}
|
|
|
|
resource "aws_security_group_rule" "cluster_https_worker_ingress" {
|
|
count = var.cluster_create_security_group && var.create_eks ? 1 : 0
|
|
description = "Allow pods to communicate with the EKS cluster API."
|
|
protocol = "tcp"
|
|
security_group_id = local.cluster_security_group_id
|
|
source_security_group_id = local.worker_security_group_id
|
|
from_port = 443
|
|
to_port = 443
|
|
type = "ingress"
|
|
}
|
|
|
|
resource "aws_iam_role" "cluster" {
|
|
count = var.manage_cluster_iam_resources && var.create_eks ? 1 : 0
|
|
name_prefix = var.cluster_name
|
|
assume_role_policy = data.aws_iam_policy_document.cluster_assume_role_policy.json
|
|
permissions_boundary = var.permissions_boundary
|
|
path = var.iam_path
|
|
force_detach_policies = true
|
|
tags = var.tags
|
|
}
|
|
|
|
resource "aws_iam_role_policy_attachment" "cluster_AmazonEKSClusterPolicy" {
|
|
count = var.manage_cluster_iam_resources && var.create_eks ? 1 : 0
|
|
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
|
|
role = local.cluster_iam_role_name
|
|
}
|
|
|
|
resource "aws_iam_role_policy_attachment" "cluster_AmazonEKSServicePolicy" {
|
|
count = var.manage_cluster_iam_resources && var.create_eks ? 1 : 0
|
|
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
|
|
role = local.cluster_iam_role_name
|
|
}
|