diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index dfec4e2..3936c48 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -1,7 +1,7 @@ exclude: vendor repos: - repo: https://github.com/antonbabenko/pre-commit-terraform - rev: v1.25.0 + rev: v1.50.0 hooks: - id: terraform_fmt - id: terraform_docs diff --git a/CHANGELOG.md b/CHANGELOG.md index 0012504..52575b7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,11 +2,86 @@ ## [Unreleased] + +## [v11.3.1] - 2026-03-09 +### 🔧 Maintenance +- [7f8fa14](https://github.com/devopsmakers/terraform-aws-eks/commit/7f8fa14) add eks cluster authentication mode ([#10](https://github.com/devopsmakers/terraform-aws-eks/issues/10)) + + + +## [v11.3.0] - 2025-10-06 +### 🔧 Maintenance +- [cc763f2](https://github.com/devopsmakers/terraform-aws-eks/commit/cc763f2) default true for deletion protection ([#9](https://github.com/devopsmakers/terraform-aws-eks/issues/9)) +- [4449c6a](https://github.com/devopsmakers/terraform-aws-eks/commit/4449c6a) add deletion_protection ([#8](https://github.com/devopsmakers/terraform-aws-eks/issues/8)) +- **release:** [53b807c](https://github.com/devopsmakers/terraform-aws-eks/commit/53b807c) Update changelog for v11.3.0 + + + +## [v11.2.3] - 2025-03-27 +### 🔧 Maintenance +- [e87a9e7](https://github.com/devopsmakers/terraform-aws-eks/commit/e87a9e7) change log_group name back to cluster ([#7](https://github.com/devopsmakers/terraform-aws-eks/issues/7)) +- **release:** [7c944c2](https://github.com/devopsmakers/terraform-aws-eks/commit/7c944c2) Update changelog for v11.2.3 + + + +## [v11.2.2] - 2025-03-26 +### ✨ Features +- [5cff1d3](https://github.com/devopsmakers/terraform-aws-eks/commit/5cff1d3) support log_group_class - BOS-3058 ([#6](https://github.com/devopsmakers/terraform-aws-eks/issues/6)) + +### 🔧 Maintenance +- **release:** [c57d6d0](https://github.com/devopsmakers/terraform-aws-eks/commit/c57d6d0) Update changelog for v11.2.2 + + + +## [v11.2.1] - 2022-09-07 +### 🔧 Maintenance +- [71f596a](https://github.com/devopsmakers/terraform-aws-eks/commit/71f596a) update kubeconfig to current apiversion +- **release:** [0efd9f2](https://github.com/devopsmakers/terraform-aws-eks/commit/0efd9f2) Update changelog for v11.2.1 + + + +## [v11.2.0] - 2022-07-29 +### 🐛 Bug Fixes +- [d9bc92c](https://github.com/devopsmakers/terraform-aws-eks/commit/d9bc92c) replace deprecated data.template_file with templatefile function BOS-1567 ([#4](https://github.com/devopsmakers/terraform-aws-eks/issues/4)) + +### 🔧 Maintenance +- **release:** [9a8d031](https://github.com/devopsmakers/terraform-aws-eks/commit/9a8d031) Update changelog for v11.2.0 + + + +## [v11.1.0] - 2022-05-27 +### ✨ Features +- [cbde2e7](https://github.com/devopsmakers/terraform-aws-eks/commit/cbde2e7) use aws instead of aws-iam-authenticator and simplify BOS-1154 + +### 🔧 Maintenance +- [3b0cef8](https://github.com/devopsmakers/terraform-aws-eks/commit/3b0cef8) Use new version of auth (old one no longer works +- **release:** [25eec11](https://github.com/devopsmakers/terraform-aws-eks/commit/25eec11) Update changelog for v11.1.0 + + + +## [v11.0.1] - 2021-08-11 +### 🔧 Maintenance +- [b5d8e49](https://github.com/devopsmakers/terraform-aws-eks/commit/b5d8e49) Bump to allow terraform 1.0.X +- **release:** [39a322a](https://github.com/devopsmakers/terraform-aws-eks/commit/39a322a) Update changelog for v11.0.1 + + + +## [v11.0.0] - 2021-02-15 +### ✨ Features +- [626b4ef](https://github.com/devopsmakers/terraform-aws-eks/commit/626b4ef) remove automatic ASG replacement and support for name overrides + +### 🔧 Maintenance +- **release:** [d1e8c08](https://github.com/devopsmakers/terraform-aws-eks/commit/d1e8c08) Update changelog for v11.0.0 + + ## [v10.2.3] - 2020-05-18 ### 🐛 Bug Fixes - [377e8a5](https://github.com/devopsmakers/terraform-aws-eks/commit/377e8a5) issue with placement groups ([#5](https://github.com/devopsmakers/terraform-aws-eks/issues/5)) +### 🔧 Maintenance +- **release:** [dee493a](https://github.com/devopsmakers/terraform-aws-eks/commit/dee493a) Update changelog for v10.2.3 + ## [v10.2.2] - 2020-05-05 @@ -106,7 +181,16 @@ - [6338f6d](https://github.com/devopsmakers/terraform-aws-eks/commit/6338f6d) Initial commit -[Unreleased]: https://github.com/devopsmakers/terraform-aws-eks/compare/v10.2.3...HEAD +[Unreleased]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.3.1...HEAD +[v11.3.1]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.3.0...v11.3.1 +[v11.3.0]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.2.3...v11.3.0 +[v11.2.3]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.2.2...v11.2.3 +[v11.2.2]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.2.1...v11.2.2 +[v11.2.1]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.2.0...v11.2.1 +[v11.2.0]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.1.0...v11.2.0 +[v11.1.0]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.0.1...v11.1.0 +[v11.0.1]: https://github.com/devopsmakers/terraform-aws-eks/compare/v11.0.0...v11.0.1 +[v11.0.0]: https://github.com/devopsmakers/terraform-aws-eks/compare/v10.2.3...v11.0.0 [v10.2.3]: https://github.com/devopsmakers/terraform-aws-eks/compare/v10.2.2...v10.2.3 [v10.2.2]: https://github.com/devopsmakers/terraform-aws-eks/compare/v10.2.1...v10.2.2 [v10.2.1]: https://github.com/devopsmakers/terraform-aws-eks/compare/v10.2.0...v10.2.1 diff --git a/Makefile b/Makefile index 44b7972..3fbcdc9 100644 --- a/Makefile +++ b/Makefile @@ -1,9 +1,8 @@ -.PHONY: release +.PHONY: release guard -TYPE := patch -VERSION := $(shell semtag final -s $(TYPE) -o) +VERSION = $(shell semtag final -s $(TYPE) -o) -release: +release: guard git checkout master git pull origin master @echo $(VERSION) | grep "ERROR" && exit 1 || true @@ -11,4 +10,10 @@ release: git add CHANGELOG.md git commit -m "chore(release): Update changelog for $(VERSION)" git tag $(VERSION) - git push origin master --tags \ No newline at end of file + git push origin master --tags + +guard: + @if [ -z "$(TYPE)" ]; then \ + echo "ERROR: TYPE is required. Usage: make release TYPE=patch|minor|major"; \ + exit 1; \ + fi diff --git a/README.md b/README.md index 693e4ff..fb9d349 100644 --- a/README.md +++ b/README.md @@ -64,102 +64,125 @@ There are some core implementation changes from the original `eks` module: instance per worker_group further isolating the data structures in the state file. +## Requirements + +| Name | Version | +|------|---------| +| [terraform](#requirement\_terraform) | >= 0.12.9 | +| [aws](#requirement\_aws) | >= 2.52.0 | +| [kubernetes](#requirement\_kubernetes) | >= 1.6.2 | +| [local](#requirement\_local) | >= 1.2 | +| [null](#requirement\_null) | >= 2.1 | +| [random](#requirement\_random) | >= 2.1 | +| [template](#requirement\_template) | >= 2.1 | + ## Providers -No provider. +No providers. + +## Modules + +| Name | Source | Version | +|------|--------|---------| +| [aws\_auth](#module\_aws\_auth) | ./modules/aws_auth | n/a | +| [control\_plane](#module\_control\_plane) | ./modules/control_plane | n/a | +| [node\_groups](#module\_node\_groups) | ./modules/node_groups | n/a | +| [worker\_groups](#module\_worker\_groups) | ./modules/worker_groups | n/a | + +## Resources + +No resources. ## Inputs | Name | Description | Type | Default | Required | -|------|-------------|------|---------|:-----:| -| attach\_node\_cni\_policy | Whether to attach the Amazon managed `AmazonEKS_CNI_Policy` IAM policy to the default worker IAM role. WARNING: If set `false` the permissions must be assigned to the `aws-node` DaemonSet pods via another method or nodes will not be able to join the cluster. | `bool` | `true` | no | -| attach\_worker\_cni\_policy | Whether to attach the Amazon managed `AmazonEKS_CNI_Policy` IAM policy to the default worker IAM role. WARNING: If set `false` the permissions must be assigned to the `aws-node` DaemonSet pods via another method or nodes will not be able to join the cluster. | `bool` | `true` | no | -| cluster\_create\_security\_group | Whether to create a security group for the cluster or attach the cluster to `cluster_security_group_id`. | `bool` | `true` | no | -| cluster\_create\_timeout | Timeout value when creating the EKS cluster. | `string` | `"30m"` | no | -| cluster\_delete\_timeout | Timeout value when deleting the EKS cluster. | `string` | `"15m"` | no | -| cluster\_enabled\_log\_types | A list of the desired control plane logging to enable. For more information, see Amazon EKS Control Plane Logging documentation (https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html) | `list(string)` | `[]` | no | -| cluster\_encryption\_key\_arn | KMS Key ARN to encrypt EKS secrets with. | `string` | `""` | no | -| cluster\_encryption\_resources | A list of the EKS resources to encrypt. | `list(string)` | 
[
  "secrets"
]
| no | -| cluster\_endpoint\_private\_access | Indicates whether or not the Amazon EKS private API server endpoint is enabled. | `bool` | `false` | no | -| cluster\_endpoint\_public\_access | Indicates whether or not the Amazon EKS public API server endpoint is enabled. | `bool` | `true` | no | -| cluster\_endpoint\_public\_access\_cidrs | List of CIDR blocks which can access the Amazon EKS public API server endpoint. | `list(string)` | 
[
  "0.0.0.0/0"
]
| no | -| cluster\_iam\_role\_name | IAM role name for the cluster. Only applicable if manage\_cluster\_iam\_resources is set to false. | `string` | `""` | no | -| cluster\_log\_kms\_key\_id | If a KMS Key ARN is set, this key will be used to encrypt the corresponding log group. Please be sure that the KMS Key has an appropriate key policy (https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html) | `string` | `""` | no | -| cluster\_log\_retention\_in\_days | Number of days to retain log events. Default retention - 90 days. | `number` | `90` | no | -| cluster\_name | Name of the EKS cluster. Also used as a prefix in names of related resources. | `string` | n/a | yes | -| cluster\_security\_group\_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the workers | `string` | `""` | no | -| cluster\_version | Kubernetes version to use for the EKS cluster. | `string` | `"1.15"` | no | -| config\_output\_path | Where to save the Kubectl config file (if `write_kubeconfig = true`). Assumed to be a directory if the value ends with a forward slash `/`. | `string` | `"./"` | no | -| create\_eks | Controls if EKS resources should be created (it affects almost all resources) | `bool` | `true` | no | -| eks\_oidc\_root\_ca\_thumbprint | Thumbprint of Root CA for EKS OIDC, Valid until 2037 | `string` | `"9e99a48a9960b14926bb7f3b02e22da2b0ab7280"` | no | -| enable\_irsa | Whether to create OpenID Connect Provider for EKS to enable IRSA | `bool` | `false` | no | -| iam\_path | If provided, all IAM roles will be created on this path. | `string` | `"/"` | no | -| kubeconfig\_aws\_authenticator\_additional\_args | Any additional arguments to pass to the authenticator such as the role to assume. e.g. ["-r", "MyEksRole"]. | `list(string)` | `[]` | no | -| kubeconfig\_aws\_authenticator\_command | Command to use to fetch AWS EKS credentials. | `string` | `"aws-iam-authenticator"` | no | -| kubeconfig\_aws\_authenticator\_command\_args | Default arguments passed to the authenticator command. Defaults to [token -i $cluster\_name]. | `list(string)` | `[]` | no | -| kubeconfig\_aws\_authenticator\_env\_variables | Environment variables that should be used when executing the authenticator. e.g. { AWS\_PROFILE = "eks"}. | `map(string)` | `{}` | no | -| kubeconfig\_name | Override the default name used for items kubeconfig. | `string` | `""` | no | -| manage\_aws\_auth | Whether to apply the aws-auth configmap file. | `bool` | `true` | no | -| manage\_cluster\_iam\_resources | Whether to let the module manage cluster IAM resources. If set to false, cluster\_iam\_role\_name must be specified. | `bool` | `true` | no | -| manage\_node\_iam\_resources | Whether to let the module manage worker IAM resources. If set to false, iam\_instance\_profile\_name must be specified for workers. | `bool` | `true` | no | -| manage\_worker\_iam\_resources | Whether to let the module manage worker IAM resources. If set to false, iam\_instance\_profile\_name must be specified for workers. | `bool` | `true` | no | -| map\_accounts | Additional AWS account numbers to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | `list(string)` | `[]` | no | -| map\_roles | Additional IAM roles to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | 
list(object({
    rolearn  = string
    username = string
    groups   = list(string)
  }))
| `[]` | no | -| map\_users | Additional IAM users to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | 
list(object({
    userarn  = string
    username = string
    groups   = list(string)
  }))
| `[]` | no | -| node\_groups | Map of map of node groups to create. See `node_groups` module's documentation for more details | `any` | `{}` | no | -| node\_groups\_additional\_policies | Additional policies to be added to workers | `list(string)` | `[]` | no | -| node\_groups\_defaults | Map of values to be applied to all node groups. See `node_groups` module's documentaton for more details | `any` | `{}` | no | -| node\_groups\_role\_name | User defined workers role name. | `string` | `""` | no | -| permissions\_boundary | If provided, all IAM roles will be created with this permissions boundary attached. | `string` | n/a | yes | -| subnets | A list of subnets to place the EKS cluster and workers within. | `list(string)` | n/a | yes | -| tags | A map of tags to add to all resources. | `map(string)` | `{}` | no | -| vpc\_id | VPC where the cluster and workers will be deployed. | `string` | n/a | yes | -| wait\_for\_cluster\_cmd | Custom local-exec command to execute for determining if the eks cluster is healthy. Cluster endpoint will be available as an environment variable called ENDPOINT | `string` | `"until wget --no-check-certificate -O - -q $ENDPOINT/healthz \u003e/dev/null; do sleep 4; done"` | no | -| worker\_additional\_security\_group\_ids | A list of additional security group ids to attach to worker instances | `list(string)` | `[]` | no | -| worker\_ami\_name\_filter | Name filter for AWS EKS worker AMI. If not provided, the latest official AMI for the specified 'cluster\_version' is used. | `string` | `""` | no | -| worker\_ami\_name\_filter\_windows | Name filter for AWS EKS Windows worker AMI. If not provided, the latest official AMI for the specified 'cluster\_version' is used. | `string` | `""` | no | -| worker\_ami\_owner\_id | The ID of the owner for the AMI to use for the AWS EKS workers. Valid values are an AWS account ID, 'self' (the current account), or an AWS owner alias (e.g. 'amazon', 'aws-marketplace', 'microsoft'). | `string` | `"602401143452"` | no | -| worker\_ami\_owner\_id\_windows | The ID of the owner for the AMI to use for the AWS EKS Windows workers. Valid values are an AWS account ID, 'self' (the current account), or an AWS owner alias (e.g. 'amazon', 'aws-marketplace', 'microsoft'). | `string` | `"801119661308"` | no | -| worker\_create\_initial\_lifecycle\_hooks | Whether to create initial lifecycle hooks provided in worker groups. | `bool` | `false` | no | -| worker\_create\_security\_group | Whether to create a security group for the workers or attach the workers to `worker_security_group_id`. | `bool` | `true` | no | -| worker\_groups | A list of maps defining worker group configurations to be defined using AWS Launch Configurations. See workers\_group\_defaults for valid keys. | `any` | `[]` | no | -| worker\_groups\_additional\_policies | Additional policies to be added to workers | `list(string)` | `[]` | no | -| worker\_groups\_defaults | Override default values for target groups. See worker\_group\_defaults in local.tf for valid keys. | `any` | `{}` | no | -| worker\_groups\_launch\_template | A list of maps defining worker group configurations to be defined using AWS Launch Templates. See workers\_group\_defaults for valid keys. | `any` | `[]` | no | -| worker\_groups\_role\_name | User defined workers role name. | `string` | `""` | no | -| worker\_security\_group\_id | If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the EKS cluster. | `string` | `""` | no | -| worker\_sg\_ingress\_from\_port | Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443). | `number` | `1025` | no | -| write\_kubeconfig | Whether to write a Kubectl config file containing the cluster configuration. Saved to `config_output_path`. | `bool` | `true` | no | +|------|-------------|------|---------|:--------:| +| [attach\_node\_cni\_policy](#input\_attach\_node\_cni\_policy) | Whether to attach the Amazon managed `AmazonEKS_CNI_Policy` IAM policy to the default worker IAM role. WARNING: If set `false` the permissions must be assigned to the `aws-node` DaemonSet pods via another method or nodes will not be able to join the cluster. | `bool` | `true` | no | +| [attach\_worker\_cni\_policy](#input\_attach\_worker\_cni\_policy) | Whether to attach the Amazon managed `AmazonEKS_CNI_Policy` IAM policy to the default worker IAM role. WARNING: If set `false` the permissions must be assigned to the `aws-node` DaemonSet pods via another method or nodes will not be able to join the cluster. | `bool` | `true` | no | +| [bootstrap\_cluster\_creator\_admin\_permissions](#input\_bootstrap\_cluster\_creator\_admin\_permissions) | Whether to give cluster creator admin permissions when using API authentication mode. Only applicable if cluster\_authentication\_mode is set to API or API\_AND\_CONFIG\_MAP. | `bool` | `false` | no | +| [cluster\_authentication\_mode](#input\_cluster\_authentication\_mode) | The authentication mode for the cluster that is one of CONFIG\_MAP, API or API\_AND\_CONFIG\_MAP | `string` | `"API_AND_CONFIG_MAP"` | no | +| [cluster\_create\_security\_group](#input\_cluster\_create\_security\_group) | Whether to create a security group for the cluster or attach the cluster to `cluster_security_group_id`. | `bool` | `true` | no | +| [cluster\_create\_timeout](#input\_cluster\_create\_timeout) | Timeout value when creating the EKS cluster. | `string` | `"30m"` | no | +| [cluster\_delete\_timeout](#input\_cluster\_delete\_timeout) | Timeout value when deleting the EKS cluster. | `string` | `"15m"` | no | +| [cluster\_enabled\_log\_types](#input\_cluster\_enabled\_log\_types) | A list of the desired control plane logging to enable. For more information, see Amazon EKS Control Plane Logging documentation (https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html) | `list(string)` | `[]` | no | +| [cluster\_encryption\_key\_arn](#input\_cluster\_encryption\_key\_arn) | KMS Key ARN to encrypt EKS secrets with. | `string` | `""` | no | +| [cluster\_encryption\_resources](#input\_cluster\_encryption\_resources) | A list of the EKS resources to encrypt. | `list(string)` | 
[
  "secrets"
]
| no | +| [cluster\_endpoint\_private\_access](#input\_cluster\_endpoint\_private\_access) | Indicates whether or not the Amazon EKS private API server endpoint is enabled. | `bool` | `false` | no | +| [cluster\_endpoint\_public\_access](#input\_cluster\_endpoint\_public\_access) | Indicates whether or not the Amazon EKS public API server endpoint is enabled. | `bool` | `true` | no | +| [cluster\_endpoint\_public\_access\_cidrs](#input\_cluster\_endpoint\_public\_access\_cidrs) | List of CIDR blocks which can access the Amazon EKS public API server endpoint. | `list(string)` | 
[
  "0.0.0.0/0"
]
| no | +| [cluster\_iam\_role\_name](#input\_cluster\_iam\_role\_name) | IAM role name for the cluster. Only applicable if manage\_cluster\_iam\_resources is set to false. | `string` | `""` | no | +| [cluster\_log\_group\_class](#input\_cluster\_log\_group\_class) | Specified the log class of the log group. Possible values are: STANDARD or INFREQUENT\_ACCESS | `string` | `"INFREQUENT_ACCESS"` | no | +| [cluster\_log\_kms\_key\_id](#input\_cluster\_log\_kms\_key\_id) | If a KMS Key ARN is set, this key will be used to encrypt the corresponding log group. Please be sure that the KMS Key has an appropriate key policy (https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html) | `string` | `""` | no | +| [cluster\_log\_retention\_in\_days](#input\_cluster\_log\_retention\_in\_days) | Number of days to retain log events. Default retention - 90 days. | `number` | `90` | no | +| [cluster\_name](#input\_cluster\_name) | Name of the EKS cluster. Also used as a prefix in names of related resources. | `string` | n/a | yes | +| [cluster\_security\_group\_id](#input\_cluster\_security\_group\_id) | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the workers | `string` | `""` | no | +| [cluster\_version](#input\_cluster\_version) | Kubernetes version to use for the EKS cluster. | `string` | `"1.15"` | no | +| [config\_output\_path](#input\_config\_output\_path) | Where to save the Kubectl config file (if `write_kubeconfig = true`). Assumed to be a directory if the value ends with a forward slash `/`. | `string` | `"./"` | no | +| [create\_eks](#input\_create\_eks) | Controls if EKS resources should be created (it affects almost all resources) | `bool` | `true` | no | +| [eks\_oidc\_root\_ca\_thumbprint](#input\_eks\_oidc\_root\_ca\_thumbprint) | Thumbprint of Root CA for EKS OIDC, Valid until 2037 | `string` | `"9e99a48a9960b14926bb7f3b02e22da2b0ab7280"` | no | +| [enable\_irsa](#input\_enable\_irsa) | Whether to create OpenID Connect Provider for EKS to enable IRSA | `bool` | `false` | no | +| [iam\_path](#input\_iam\_path) | If provided, all IAM roles will be created on this path. | `string` | `"/"` | no | +| [kubeconfig\_name](#input\_kubeconfig\_name) | Override the default name used for items kubeconfig. | `string` | `""` | no | +| [manage\_aws\_auth](#input\_manage\_aws\_auth) | Whether to apply the aws-auth configmap file. | `bool` | `true` | no | +| [manage\_cluster\_iam\_resources](#input\_manage\_cluster\_iam\_resources) | Whether to let the module manage cluster IAM resources. If set to false, cluster\_iam\_role\_name must be specified. | `bool` | `true` | no | +| [manage\_node\_iam\_resources](#input\_manage\_node\_iam\_resources) | Whether to let the module manage worker IAM resources. If set to false, iam\_instance\_profile\_name must be specified for workers. | `bool` | `true` | no | +| [manage\_worker\_iam\_resources](#input\_manage\_worker\_iam\_resources) | Whether to let the module manage worker IAM resources. If set to false, iam\_instance\_profile\_name must be specified for workers. | `bool` | `true` | no | +| [map\_accounts](#input\_map\_accounts) | Additional AWS account numbers to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | `list(string)` | `[]` | no | +| [map\_roles](#input\_map\_roles) | Additional IAM roles to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | 
list(object({
    rolearn  = string
    username = string
    groups   = list(string)
  }))
| `[]` | no | +| [map\_users](#input\_map\_users) | Additional IAM users to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | 
list(object({
    userarn  = string
    username = string
    groups   = list(string)
  }))
| `[]` | no | +| [node\_groups](#input\_node\_groups) | Map of map of node groups to create. See `node_groups` module's documentation for more details | `any` | `{}` | no | +| [node\_groups\_additional\_policies](#input\_node\_groups\_additional\_policies) | Additional policies to be added to workers | `list(string)` | `[]` | no | +| [node\_groups\_defaults](#input\_node\_groups\_defaults) | Map of values to be applied to all node groups. See `node_groups` module's documentaton for more details | `any` | `{}` | no | +| [node\_groups\_role\_name](#input\_node\_groups\_role\_name) | User defined workers role name. | `string` | `""` | no | +| [permissions\_boundary](#input\_permissions\_boundary) | If provided, all IAM roles will be created with this permissions boundary attached. | `string` | `null` | no | +| [region](#input\_region) | AWS region | `string` | n/a | yes | +| [subnets](#input\_subnets) | A list of subnets to place the EKS cluster and workers within. | `list(string)` | n/a | yes | +| [tags](#input\_tags) | A map of tags to add to all resources. | `map(string)` | `{}` | no | +| [vpc\_id](#input\_vpc\_id) | VPC where the cluster and workers will be deployed. | `string` | n/a | yes | +| [wait\_for\_cluster\_cmd](#input\_wait\_for\_cluster\_cmd) | Custom local-exec command to execute for determining if the eks cluster is healthy. Cluster endpoint will be available as an environment variable called ENDPOINT | `string` | `"until wget --no-check-certificate -O - -q $ENDPOINT/healthz >/dev/null; do sleep 4; done"` | no | +| [worker\_additional\_security\_group\_ids](#input\_worker\_additional\_security\_group\_ids) | A list of additional security group ids to attach to worker instances | `list(string)` | `[]` | no | +| [worker\_ami\_name\_filter](#input\_worker\_ami\_name\_filter) | Name filter for AWS EKS worker AMI. If not provided, the latest official AMI for the specified 'cluster\_version' is used. | `string` | `""` | no | +| [worker\_ami\_name\_filter\_windows](#input\_worker\_ami\_name\_filter\_windows) | Name filter for AWS EKS Windows worker AMI. If not provided, the latest official AMI for the specified 'cluster\_version' is used. | `string` | `""` | no | +| [worker\_ami\_owner\_id](#input\_worker\_ami\_owner\_id) | The ID of the owner for the AMI to use for the AWS EKS workers. Valid values are an AWS account ID, 'self' (the current account), or an AWS owner alias (e.g. 'amazon', 'aws-marketplace', 'microsoft'). | `string` | `"602401143452"` | no | +| [worker\_ami\_owner\_id\_windows](#input\_worker\_ami\_owner\_id\_windows) | The ID of the owner for the AMI to use for the AWS EKS Windows workers. Valid values are an AWS account ID, 'self' (the current account), or an AWS owner alias (e.g. 'amazon', 'aws-marketplace', 'microsoft'). | `string` | `"801119661308"` | no | +| [worker\_create\_initial\_lifecycle\_hooks](#input\_worker\_create\_initial\_lifecycle\_hooks) | Whether to create initial lifecycle hooks provided in worker groups. | `bool` | `false` | no | +| [worker\_create\_security\_group](#input\_worker\_create\_security\_group) | Whether to create a security group for the workers or attach the workers to `worker_security_group_id`. | `bool` | `true` | no | +| [worker\_groups](#input\_worker\_groups) | A list of maps defining worker group configurations to be defined using AWS Launch Configurations. See workers\_group\_defaults for valid keys. | `any` | `[]` | no | +| [worker\_groups\_additional\_policies](#input\_worker\_groups\_additional\_policies) | Additional policies to be added to workers | `list(string)` | `[]` | no | +| [worker\_groups\_defaults](#input\_worker\_groups\_defaults) | Override default values for target groups. See worker\_group\_defaults in local.tf for valid keys. | `any` | `{}` | no | +| [worker\_groups\_role\_name](#input\_worker\_groups\_role\_name) | User defined workers role name. | `string` | `""` | no | +| [worker\_security\_group\_id](#input\_worker\_security\_group\_id) | If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the EKS cluster. | `string` | `""` | no | +| [worker\_sg\_ingress\_from\_port](#input\_worker\_sg\_ingress\_from\_port) | Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443). | `number` | `1025` | no | +| [write\_kubeconfig](#input\_write\_kubeconfig) | Whether to write a Kubectl config file containing the cluster configuration. Saved to `config_output_path`. | `bool` | `true` | no | ## Outputs | Name | Description | |------|-------------| -| cloudwatch\_log\_group\_name | Name of cloudwatch log group created | -| cluster\_arn | The Amazon Resource Name (ARN) of the cluster. | -| cluster\_certificate\_authority\_data | Nested attribute containing certificate-authority-data for your cluster. This is the base64 encoded certificate data required to communicate with your cluster. | -| cluster\_endpoint | The endpoint for your EKS Kubernetes API. | -| cluster\_iam\_role\_arn | IAM role ARN of the EKS cluster. | -| cluster\_id | The name/id of the EKS cluster. | -| cluster\_oidc\_issuer\_url | The URL on the EKS cluster OIDC Issuer | -| cluster\_security\_group\_id | Security group ID attached to the EKS cluster. | -| cluster\_version | The Kubernetes server version for the EKS cluster. | -| config\_map\_aws\_auth | A kubernetes configuration to authenticate to this EKS cluster. | -| kubeconfig | kubectl config file contents for this EKS cluster. | -| kubeconfig\_filename | The filename of the generated kubectl config. | -| node\_groups | Outputs from EKS node groups. Map of maps, keyed by var.node\_groups keys | -| oidc\_provider\_arn | The ARN of the OIDC Provider if `enable_irsa = true`. | -| worker\_iam\_instance\_profile\_arns | default IAM instance profile ARN for EKS worker groups | -| worker\_iam\_instance\_profile\_names | default IAM instance profile name for EKS worker groups | -| worker\_iam\_role\_arn | default IAM role ARN for EKS worker groups | -| worker\_iam\_role\_name | default IAM role name for EKS worker groups | -| worker\_security\_group\_id | Security group ID attached to the EKS workers. | -| workers\_asg\_arns | IDs of the autoscaling groups containing workers. | -| workers\_asg\_names | Names of the autoscaling groups containing workers. | -| workers\_default\_ami\_id | ID of the default worker group AMI | -| workers\_launch\_template\_arns | ARNs of the worker launch templates. | -| workers\_launch\_template\_ids | IDs of the worker launch templates. | -| workers\_launch\_template\_latest\_versions | Latest versions of the worker launch templates. | -| workers\_user\_data | User data of worker groups | - +| [cloudwatch\_log\_group\_name](#output\_cloudwatch\_log\_group\_name) | Name of cloudwatch log group created | +| [cluster\_arn](#output\_cluster\_arn) | The Amazon Resource Name (ARN) of the cluster. | +| [cluster\_certificate\_authority\_data](#output\_cluster\_certificate\_authority\_data) | Nested attribute containing certificate-authority-data for your cluster. This is the base64 encoded certificate data required to communicate with your cluster. | +| [cluster\_endpoint](#output\_cluster\_endpoint) | The endpoint for your EKS Kubernetes API. | +| [cluster\_iam\_role\_arn](#output\_cluster\_iam\_role\_arn) | IAM role ARN of the EKS cluster. | +| [cluster\_id](#output\_cluster\_id) | The name/id of the EKS cluster. | +| [cluster\_oidc\_issuer\_url](#output\_cluster\_oidc\_issuer\_url) | The URL on the EKS cluster OIDC Issuer | +| [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | Security group ID attached to the EKS cluster. | +| [cluster\_version](#output\_cluster\_version) | The Kubernetes server version for the EKS cluster. | +| [config\_map\_aws\_auth](#output\_config\_map\_aws\_auth) | A kubernetes configuration to authenticate to this EKS cluster. | +| [kubeconfig](#output\_kubeconfig) | kubectl config file contents for this EKS cluster. | +| [kubeconfig\_filename](#output\_kubeconfig\_filename) | The filename of the generated kubectl config. | +| [node\_groups](#output\_node\_groups) | Outputs from EKS node groups. Map of maps, keyed by var.node\_groups keys | +| [oidc\_provider\_arn](#output\_oidc\_provider\_arn) | The ARN of the OIDC Provider if `enable_irsa = true`. | +| [worker\_iam\_instance\_profile\_arns](#output\_worker\_iam\_instance\_profile\_arns) | default IAM instance profile ARN for EKS worker groups | +| [worker\_iam\_instance\_profile\_names](#output\_worker\_iam\_instance\_profile\_names) | default IAM instance profile name for EKS worker groups | +| [worker\_iam\_role\_arn](#output\_worker\_iam\_role\_arn) | default IAM role ARN for EKS worker groups | +| [worker\_iam\_role\_name](#output\_worker\_iam\_role\_name) | default IAM role name for EKS worker groups | +| [worker\_security\_group\_id](#output\_worker\_security\_group\_id) | Security group ID attached to the EKS workers. | +| [workers\_asg\_arns](#output\_workers\_asg\_arns) | IDs of the autoscaling groups containing workers. | +| [workers\_asg\_names](#output\_workers\_asg\_names) | Names of the autoscaling groups containing workers. | +| [workers\_default\_ami\_id](#output\_workers\_default\_ami\_id) | ID of the default worker group AMI | +| [workers\_launch\_template\_arns](#output\_workers\_launch\_template\_arns) | ARNs of the worker launch templates. | +| [workers\_launch\_template\_ids](#output\_workers\_launch\_template\_ids) | IDs of the worker launch templates. | +| [workers\_launch\_template\_latest\_versions](#output\_workers\_launch\_template\_latest\_versions) | Latest versions of the worker launch templates. | +| [workers\_user\_data](#output\_workers\_user\_data) | User data of worker groups | diff --git a/main.tf b/main.tf index 90be71c..3d5ea1a 100644 --- a/main.tf +++ b/main.tf @@ -1,37 +1,36 @@ module "control_plane" { - source = "./modules/control_plane" - - cluster_create_security_group = var.cluster_create_security_group - cluster_create_timeout = var.cluster_create_timeout - cluster_delete_timeout = var.cluster_delete_timeout - cluster_enabled_log_types = var.cluster_enabled_log_types - cluster_encryption_key_arn = var.cluster_encryption_key_arn - cluster_encryption_resources = var.cluster_encryption_resources - cluster_endpoint_private_access = var.cluster_endpoint_private_access - cluster_endpoint_public_access = var.cluster_endpoint_public_access - cluster_endpoint_public_access_cidrs = var.cluster_endpoint_public_access_cidrs - cluster_iam_role_name = var.cluster_iam_role_name - cluster_log_kms_key_id = var.cluster_log_kms_key_id - cluster_log_retention_in_days = var.cluster_log_retention_in_days - cluster_name = var.cluster_name - cluster_security_group_id = var.cluster_security_group_id - cluster_version = var.cluster_version - config_output_path = var.config_output_path - create_eks = var.create_eks - eks_oidc_root_ca_thumbprint = var.eks_oidc_root_ca_thumbprint - enable_irsa = var.enable_irsa - iam_path = var.iam_path - kubeconfig_aws_authenticator_additional_args = var.kubeconfig_aws_authenticator_additional_args - kubeconfig_aws_authenticator_command = var.kubeconfig_aws_authenticator_command - kubeconfig_aws_authenticator_command_args = var.kubeconfig_aws_authenticator_command_args - kubeconfig_aws_authenticator_env_variables = var.kubeconfig_aws_authenticator_env_variables - kubeconfig_name = var.kubeconfig_name - manage_cluster_iam_resources = var.manage_cluster_iam_resources - permissions_boundary = var.permissions_boundary - subnets = var.subnets - tags = var.tags - vpc_id = var.vpc_id - write_kubeconfig = var.write_kubeconfig + source = "./modules/control_plane" + region = var.region + cluster_create_security_group = var.cluster_create_security_group + cluster_create_timeout = var.cluster_create_timeout + cluster_delete_timeout = var.cluster_delete_timeout + cluster_enabled_log_types = var.cluster_enabled_log_types + cluster_encryption_key_arn = var.cluster_encryption_key_arn + cluster_encryption_resources = var.cluster_encryption_resources + cluster_endpoint_private_access = var.cluster_endpoint_private_access + cluster_endpoint_public_access = var.cluster_endpoint_public_access + cluster_endpoint_public_access_cidrs = var.cluster_endpoint_public_access_cidrs + cluster_iam_role_name = var.cluster_iam_role_name + cluster_log_kms_key_id = var.cluster_log_kms_key_id + cluster_log_retention_in_days = var.cluster_log_retention_in_days + cluster_log_group_class = var.cluster_log_group_class + cluster_name = var.cluster_name + cluster_security_group_id = var.cluster_security_group_id + cluster_version = var.cluster_version + cluster_authentication_mode = var.cluster_authentication_mode + bootstrap_cluster_creator_admin_permissions = var.bootstrap_cluster_creator_admin_permissions + config_output_path = var.config_output_path + create_eks = var.create_eks + eks_oidc_root_ca_thumbprint = var.eks_oidc_root_ca_thumbprint + enable_irsa = var.enable_irsa + iam_path = var.iam_path + kubeconfig_name = var.kubeconfig_name + manage_cluster_iam_resources = var.manage_cluster_iam_resources + permissions_boundary = var.permissions_boundary + subnets = var.subnets + tags = var.tags + vpc_id = var.vpc_id + write_kubeconfig = var.write_kubeconfig } module "worker_groups" { diff --git a/modules/aws_auth/README.md b/modules/aws_auth/README.md index 340654b..b82d0d6 100644 --- a/modules/aws_auth/README.md +++ b/modules/aws_auth/README.md @@ -1,32 +1,54 @@ # eks `aws_auth` submodule +## Requirements + +| Name | Version | +|------|---------| +| [terraform](#requirement\_terraform) | >= 0.12.9 | +| [aws](#requirement\_aws) | >= 2.52.0 | +| [kubernetes](#requirement\_kubernetes) | >= 1.6.2 | +| [null](#requirement\_null) | >= 2.1 | +| [template](#requirement\_template) | >= 2.1 | + ## Providers | Name | Version | |------|---------| -| aws | >= 2.52.0 | -| kubernetes | >= 1.6.2 | -| null | >= 2.1 | -| template | >= 2.1 | +| [aws](#provider\_aws) | >= 2.52.0 | +| [kubernetes](#provider\_kubernetes) | >= 1.6.2 | +| [null](#provider\_null) | >= 2.1 | +| [template](#provider\_template) | >= 2.1 | + +## Modules + +No modules. + +## Resources + +| Name | Type | +|------|------| +| [kubernetes_config_map.aws_auth](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/config_map) | resource | +| [null_resource.wait_for_cluster](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | +| [aws_eks_cluster.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source | +| [template_file.map_instances](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source | ## Inputs | Name | Description | Type | Default | Required | -|------|-------------|------|---------|:-----:| -| cluster\_name | Name of the EKS cluster. | `string` | n/a | yes | -| create\_eks | Controls if EKS resources should be created (it affects almost all resources). | `bool` | `true` | no | -| manage\_aws\_auth | Whether to apply the aws-auth configmap file. | `bool` | `true` | no | -| map\_accounts | Additional AWS account numbers to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | `list(string)` | `[]` | no | -| map\_instances | IAM instance roles to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | 
list(object({
    instance_role_arn = string
    platform          = string
  }))
| `[]` | no | -| map\_roles | Additional IAM roles to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | 
list(object({
    rolearn  = string
    username = string
    groups   = list(string)
  }))
| `[]` | no | -| map\_users | Additional IAM users to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | 
list(object({
    userarn  = string
    username = string
    groups   = list(string)
  }))
| `[]` | no | -| wait\_for\_cluster\_cmd | Custom local-exec command to execute for determining if the eks cluster is healthy. Cluster endpoint will be available as an environment variable called ENDPOINT | `string` | `"until wget --no-check-certificate -O - -q $ENDPOINT/healthz \u003e/dev/null; do sleep 4; done"` | no | +|------|-------------|------|---------|:--------:| +| [cluster\_name](#input\_cluster\_name) | Name of the EKS cluster. | `string` | n/a | yes | +| [create\_eks](#input\_create\_eks) | Controls if EKS resources should be created (it affects almost all resources). | `bool` | `true` | no | +| [manage\_aws\_auth](#input\_manage\_aws\_auth) | Whether to apply the aws-auth configmap file. | `bool` | `true` | no | +| [map\_accounts](#input\_map\_accounts) | Additional AWS account numbers to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | `list(string)` | `[]` | no | +| [map\_instances](#input\_map\_instances) | IAM instance roles to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | 
list(object({
    instance_role_arn = string
    platform          = string
  }))
| `[]` | no | +| [map\_roles](#input\_map\_roles) | Additional IAM roles to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | 
list(object({
    rolearn  = string
    username = string
    groups   = list(string)
  }))
| `[]` | no | +| [map\_users](#input\_map\_users) | Additional IAM users to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | 
list(object({
    userarn  = string
    username = string
    groups   = list(string)
  }))
| `[]` | no | +| [wait\_for\_cluster\_cmd](#input\_wait\_for\_cluster\_cmd) | Custom local-exec command to execute for determining if the eks cluster is healthy. Cluster endpoint will be available as an environment variable called ENDPOINT | `string` | `"until wget --no-check-certificate -O - -q $ENDPOINT/healthz >/dev/null; do sleep 4; done"` | no | ## Outputs | Name | Description | |------|-------------| -| config\_map\_aws\_auth | A kubernetes configuration to authenticate to this EKS cluster. | - +| [config\_map\_aws\_auth](#output\_config\_map\_aws\_auth) | A kubernetes configuration to authenticate to this EKS cluster. | diff --git a/modules/aws_auth/aws_auth.tf b/modules/aws_auth/aws_auth.tf index 71a0ca0..c7f1d9d 100644 --- a/modules/aws_auth/aws_auth.tf +++ b/modules/aws_auth/aws_auth.tf @@ -35,7 +35,7 @@ resource "kubernetes_config_map" "aws_auth" { data = { mapRoles = < +## Requirements + +| Name | Version | +|------|---------| +| [terraform](#requirement\_terraform) | >= 0.12.9 | +| [aws](#requirement\_aws) | >= 5.30.0 | +| [local](#requirement\_local) | >= 1.2 | + ## Providers | Name | Version | |------|---------| -| aws | >= 2.52.0 | -| local | >= 1.2 | -| template | >= 2.1 | +| [aws](#provider\_aws) | >= 5.30.0 | +| [local](#provider\_local) | >= 1.2 | + +## Modules + +No modules. + +## Resources + +| Name | Type | +|------|------| +| [aws_cloudwatch_log_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource | +| [aws_eks_cluster.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_cluster) | resource | +| [aws_iam_openid_connect_provider.oidc_provider](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_openid_connect_provider) | resource | +| [aws_iam_role.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | +| [aws_iam_role_policy_attachment.cluster_AmazonEKSClusterPolicy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | +| [aws_iam_role_policy_attachment.cluster_AmazonEKSServicePolicy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | +| [aws_security_group.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource | +| [aws_security_group_rule.cluster_egress_internet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource | +| [local_file.kubeconfig](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file) | resource | +| [aws_iam_policy_document.cluster_assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | +| [aws_iam_role.custom_cluster_iam_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_role) | data source | ## Inputs | Name | Description | Type | Default | Required | -|------|-------------|------|---------|:-----:| -| cluster\_create\_security\_group | Whether to create a security group for the cluster or attach the cluster to `cluster_security_group_id`. | `bool` | `true` | no | -| cluster\_create\_timeout | Timeout value when creating the EKS cluster. | `string` | `"30m"` | no | -| cluster\_delete\_timeout | Timeout value when deleting the EKS cluster. | `string` | `"15m"` | no | -| cluster\_enabled\_log\_types | A list of the desired control plane logging to enable. For more information, see Amazon EKS Control Plane Logging documentation (https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html) | `list(string)` | `[]` | no | -| cluster\_encryption\_key\_arn | KMS Key ARN to encrypt EKS resources with. | `string` | `""` | no | -| cluster\_encryption\_resources | A list of the EKS resources to encrypt. | `list(string)` | 
[
  "secrets"
]
| no | -| cluster\_endpoint\_private\_access | Indicates whether or not the Amazon EKS private API server endpoint is enabled. | `bool` | `false` | no | -| cluster\_endpoint\_public\_access | Indicates whether or not the Amazon EKS public API server endpoint is enabled. | `bool` | `true` | no | -| cluster\_endpoint\_public\_access\_cidrs | List of CIDR blocks which can access the Amazon EKS public API server endpoint. | `list(string)` | 
[
  "0.0.0.0/0"
]
| no | -| cluster\_iam\_role\_name | IAM role name for the cluster. Only applicable if manage\_cluster\_iam\_resources is set to false. | `string` | `""` | no | -| cluster\_log\_kms\_key\_id | If a KMS Key ARN is set, this key will be used to encrypt the corresponding log group. Please be sure that the KMS Key has an appropriate key policy (https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html) | `string` | `""` | no | -| cluster\_log\_retention\_in\_days | Number of days to retain log events. Default retention - 90 days. | `number` | `90` | no | -| cluster\_name | Name of the EKS cluster. Also used as a prefix in names of related resources. | `string` | n/a | yes | -| cluster\_security\_group\_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the workers | `string` | `""` | no | -| cluster\_version | Kubernetes version to use for the EKS cluster. | `string` | `"1.15"` | no | -| config\_output\_path | Where to save the Kubectl config file (if `write_kubeconfig = true`). Assumed to be a directory if the value ends with a forward slash `/`. | `string` | `"./"` | no | -| create\_eks | Controls if EKS resources should be created (it affects almost all resources) | `bool` | `true` | no | -| eks\_oidc\_root\_ca\_thumbprint | Thumbprint of Root CA for EKS OIDC, Valid until 2037 | `string` | `"9e99a48a9960b14926bb7f3b02e22da2b0ab7280"` | no | -| enable\_irsa | Whether to create OpenID Connect Provider for EKS to enable IRSA | `bool` | `false` | no | -| iam\_path | If provided, all IAM roles will be created on this path. | `string` | `"/"` | no | -| kubeconfig\_aws\_authenticator\_additional\_args | Any additional arguments to pass to the authenticator such as the role to assume. e.g. ["-r", "MyEksRole"]. | `list(string)` | `[]` | no | -| kubeconfig\_aws\_authenticator\_command | Command to use to fetch AWS EKS credentials. | `string` | `"aws-iam-authenticator"` | no | -| kubeconfig\_aws\_authenticator\_command\_args | Default arguments passed to the authenticator command. Defaults to [token -i $cluster\_name]. | `list(string)` | `[]` | no | -| kubeconfig\_aws\_authenticator\_env\_variables | Environment variables that should be used when executing the authenticator. e.g. { AWS\_PROFILE = "eks"}. | `map(string)` | `{}` | no | -| kubeconfig\_name | Override the default name used for items kubeconfig. | `string` | `""` | no | -| manage\_cluster\_iam\_resources | Whether to let the module manage cluster IAM resources. If set to false, cluster\_iam\_role\_name must be specified. | `bool` | `true` | no | -| permissions\_boundary | If provided, all IAM roles will be created with this permissions boundary attached. | `string` | n/a | yes | -| subnets | A list of subnets to place the EKS cluster and workers within. | `list(string)` | n/a | yes | -| tags | A map of tags to add to all resources. | `map(string)` | `{}` | no | -| vpc\_id | VPC where the cluster and workers will be deployed. | `string` | n/a | yes | -| write\_kubeconfig | Whether to write a Kubectl config file containing the cluster configuration. Saved to `config_output_path`. | `bool` | `true` | no | +|------|-------------|------|---------|:--------:| +| [bootstrap\_cluster\_creator\_admin\_permissions](#input\_bootstrap\_cluster\_creator\_admin\_permissions) | Whether to give cluster creator admin permissions when using API authentication mode. Only applicable if cluster\_authentication\_mode is set to API or API\_AND\_CONFIG\_MAP. | `bool` | `false` | no | +| [cluster\_authentication\_mode](#input\_cluster\_authentication\_mode) | The authentication mode for the cluster that is one of CONFIG\_MAP, API or API\_AND\_CONFIG\_MAP | `string` | `"API_AND_CONFIG_MAP"` | no | +| [cluster\_create\_security\_group](#input\_cluster\_create\_security\_group) | Whether to create a security group for the cluster or attach the cluster to `cluster_security_group_id`. | `bool` | `true` | no | +| [cluster\_create\_timeout](#input\_cluster\_create\_timeout) | Timeout value when creating the EKS cluster. | `string` | `"30m"` | no | +| [cluster\_delete\_timeout](#input\_cluster\_delete\_timeout) | Timeout value when deleting the EKS cluster. | `string` | `"15m"` | no | +| [cluster\_enabled\_log\_types](#input\_cluster\_enabled\_log\_types) | A list of the desired control plane logging to enable. For more information, see Amazon EKS Control Plane Logging documentation (https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html) | `list(string)` | `[]` | no | +| [cluster\_encryption\_key\_arn](#input\_cluster\_encryption\_key\_arn) | KMS Key ARN to encrypt EKS resources with. | `string` | `""` | no | +| [cluster\_encryption\_resources](#input\_cluster\_encryption\_resources) | A list of the EKS resources to encrypt. | `list(string)` | 
[
  "secrets"
]
| no | +| [cluster\_endpoint\_private\_access](#input\_cluster\_endpoint\_private\_access) | Indicates whether or not the Amazon EKS private API server endpoint is enabled. | `bool` | `false` | no | +| [cluster\_endpoint\_public\_access](#input\_cluster\_endpoint\_public\_access) | Indicates whether or not the Amazon EKS public API server endpoint is enabled. | `bool` | `true` | no | +| [cluster\_endpoint\_public\_access\_cidrs](#input\_cluster\_endpoint\_public\_access\_cidrs) | List of CIDR blocks which can access the Amazon EKS public API server endpoint. | `list(string)` | 
[
  "0.0.0.0/0"
]
| no | +| [cluster\_iam\_role\_name](#input\_cluster\_iam\_role\_name) | IAM role name for the cluster. Only applicable if manage\_cluster\_iam\_resources is set to false. | `string` | `""` | no | +| [cluster\_log\_group\_class](#input\_cluster\_log\_group\_class) | Specified the log class of the log group. Possible values are: STANDARD or INFREQUENT\_ACCESS | `string` | `"INFREQUENT_ACCESS"` | no | +| [cluster\_log\_kms\_key\_id](#input\_cluster\_log\_kms\_key\_id) | If a KMS Key ARN is set, this key will be used to encrypt the corresponding log group. Please be sure that the KMS Key has an appropriate key policy (https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/encrypt-log-data-kms.html) | `string` | `""` | no | +| [cluster\_log\_retention\_in\_days](#input\_cluster\_log\_retention\_in\_days) | Number of days to retain log events. Default retention - 90 days. | `number` | `90` | no | +| [cluster\_name](#input\_cluster\_name) | Name of the EKS cluster. Also used as a prefix in names of related resources. | `string` | n/a | yes | +| [cluster\_security\_group\_id](#input\_cluster\_security\_group\_id) | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the workers | `string` | `""` | no | +| [cluster\_version](#input\_cluster\_version) | Kubernetes version to use for the EKS cluster. | `string` | `"1.15"` | no | +| [config\_output\_path](#input\_config\_output\_path) | Where to save the Kubectl config file (if `write_kubeconfig = true`). Assumed to be a directory if the value ends with a forward slash `/`. | `string` | `"./"` | no | +| [create\_eks](#input\_create\_eks) | Controls if EKS resources should be created (it affects almost all resources) | `bool` | `true` | no | +| [deletion\_protection](#input\_deletion\_protection) | Whether to enable deletion protection for the EKS cluster. | `bool` | `true` | no | +| [eks\_oidc\_root\_ca\_thumbprint](#input\_eks\_oidc\_root\_ca\_thumbprint) | Thumbprint of Root CA for EKS OIDC, Valid until 2037 | `string` | `"9e99a48a9960b14926bb7f3b02e22da2b0ab7280"` | no | +| [enable\_irsa](#input\_enable\_irsa) | Whether to create OpenID Connect Provider for EKS to enable IRSA | `bool` | `false` | no | +| [iam\_path](#input\_iam\_path) | If provided, all IAM roles will be created on this path. | `string` | `"/"` | no | +| [kubeconfig\_name](#input\_kubeconfig\_name) | Override the default name used for items kubeconfig. | `string` | `""` | no | +| [manage\_cluster\_iam\_resources](#input\_manage\_cluster\_iam\_resources) | Whether to let the module manage cluster IAM resources. If set to false, cluster\_iam\_role\_name must be specified. | `bool` | `true` | no | +| [permissions\_boundary](#input\_permissions\_boundary) | If provided, all IAM roles will be created with this permissions boundary attached. | `string` | `null` | no | +| [region](#input\_region) | AWS region | `string` | n/a | yes | +| [subnets](#input\_subnets) | A list of subnets to place the EKS cluster and workers within. | `list(string)` | n/a | yes | +| [tags](#input\_tags) | A map of tags to add to all resources. | `map(string)` | `{}` | no | +| [vpc\_id](#input\_vpc\_id) | VPC where the cluster and workers will be deployed. | `string` | n/a | yes | +| [write\_kubeconfig](#input\_write\_kubeconfig) | Whether to write a Kubectl config file containing the cluster configuration. Saved to `config_output_path`. | `bool` | `true` | no | ## Outputs | Name | Description | |------|-------------| -| cloudwatch\_log\_group\_name | Name of cloudwatch log group created | -| cluster\_arn | The Amazon Resource Name (ARN) of the cluster. | -| cluster\_certificate\_authority\_data | Nested attribute containing certificate-authority-data for your cluster. This is the base64 encoded certificate data required to communicate with your cluster. | -| cluster\_endpoint | The endpoint for your EKS Kubernetes API. | -| cluster\_iam\_role\_arn | IAM role ARN of the EKS cluster. | -| cluster\_id | The name/id of the EKS cluster. | -| cluster\_oidc\_issuer\_url | The URL on the EKS cluster OIDC Issuer | -| cluster\_security\_group\_id | Security group ID attached to the EKS cluster. | -| cluster\_version | The Kubernetes server version for the EKS cluster. | -| kubeconfig | kubectl config file contents for this EKS cluster. | -| kubeconfig\_filename | The filename of the generated kubectl config. | -| oidc\_provider\_arn | The ARN of the OIDC Provider if `enable_irsa = true`. | - +| [cloudwatch\_log\_group\_name](#output\_cloudwatch\_log\_group\_name) | Name of cloudwatch log group created | +| [cluster\_arn](#output\_cluster\_arn) | The Amazon Resource Name (ARN) of the cluster. | +| [cluster\_certificate\_authority\_data](#output\_cluster\_certificate\_authority\_data) | Nested attribute containing certificate-authority-data for your cluster. This is the base64 encoded certificate data required to communicate with your cluster. | +| [cluster\_endpoint](#output\_cluster\_endpoint) | The endpoint for your EKS Kubernetes API. | +| [cluster\_iam\_role\_arn](#output\_cluster\_iam\_role\_arn) | IAM role ARN of the EKS cluster. | +| [cluster\_id](#output\_cluster\_id) | The name/id of the EKS cluster. | +| [cluster\_oidc\_issuer\_url](#output\_cluster\_oidc\_issuer\_url) | The URL on the EKS cluster OIDC Issuer | +| [cluster\_security\_group\_id](#output\_cluster\_security\_group\_id) | Security group ID attached to the EKS cluster. | +| [cluster\_version](#output\_cluster\_version) | The Kubernetes server version for the EKS cluster. | +| [kubeconfig](#output\_kubeconfig) | kubectl config file contents for this EKS cluster. | +| [kubeconfig\_filename](#output\_kubeconfig\_filename) | The filename of the generated kubectl config. | +| [oidc\_provider\_arn](#output\_oidc\_provider\_arn) | The ARN of the OIDC Provider if `enable_irsa = true`. | diff --git a/modules/control_plane/cluster.tf b/modules/control_plane/cluster.tf index 8a12623..1585a12 100644 --- a/modules/control_plane/cluster.tf +++ b/modules/control_plane/cluster.tf @@ -2,6 +2,7 @@ resource "aws_cloudwatch_log_group" "this" { count = length(var.cluster_enabled_log_types) > 0 && var.create_eks ? 1 : 0 name = "/aws/eks/${var.cluster_name}/cluster" retention_in_days = var.cluster_log_retention_in_days + log_group_class = var.cluster_log_group_class kms_key_id = var.cluster_log_kms_key_id tags = var.tags } @@ -13,6 +14,11 @@ resource "aws_eks_cluster" "this" { role_arn = local.cluster_iam_role_arn version = var.cluster_version tags = var.tags + deletion_protection = var.deletion_protection + access_config { + authentication_mode = var.cluster_authentication_mode + bootstrap_cluster_creator_admin_permissions = var.bootstrap_cluster_creator_admin_permissions + } vpc_config { security_group_ids = [local.cluster_security_group_id] diff --git a/modules/control_plane/data.tf b/modules/control_plane/data.tf index 9ab43a7..6d50f8c 100644 --- a/modules/control_plane/data.tf +++ b/modules/control_plane/data.tf @@ -13,46 +13,15 @@ data "aws_iam_policy_document" "cluster_assume_role_policy" { } } -data "template_file" "kubeconfig" { - count = var.create_eks ? 1 : 0 - template = file("${path.module}/templates/kubeconfig.tpl") - - vars = { - kubeconfig_name = local.kubeconfig_name - endpoint = aws_eks_cluster.this[0].endpoint - cluster_auth_base64 = aws_eks_cluster.this[0].certificate_authority[0].data - aws_authenticator_command = var.kubeconfig_aws_authenticator_command - aws_authenticator_command_args = length(var.kubeconfig_aws_authenticator_command_args) > 0 ? " - ${join( - "\n - ", - var.kubeconfig_aws_authenticator_command_args, - )}" : " - ${join( - "\n - ", - formatlist("\"%s\"", ["token", "-i", aws_eks_cluster.this[0].name]), - )}" - aws_authenticator_additional_args = length(var.kubeconfig_aws_authenticator_additional_args) > 0 ? " - ${join( - "\n - ", - var.kubeconfig_aws_authenticator_additional_args, - )}" : "" - aws_authenticator_env_variables = length(var.kubeconfig_aws_authenticator_env_variables) > 0 ? " env:\n${join( - "\n", - data.template_file.aws_authenticator_env_variables.*.rendered, - )}" : "" - } -} - -data "template_file" "aws_authenticator_env_variables" { - count = length(var.kubeconfig_aws_authenticator_env_variables) - - template = < +## Requirements + +| Name | Version | +|------|---------| +| [terraform](#requirement\_terraform) | >= 0.12.9 | +| [aws](#requirement\_aws) | >= 2.52.0 | +| [random](#requirement\_random) | >= 2.1 | + ## Providers | Name | Version | |------|---------| -| aws | >= 2.52.0 | -| random | >= 2.1 | +| [aws](#provider\_aws) | >= 2.52.0 | +| [random](#provider\_random) | >= 2.1 | + +## Modules + +No modules. + +## Resources + +| Name | Type | +|------|------| +| [aws_eks_node_group.node_groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_node_group) | resource | +| [aws_iam_role.node_groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | +| [aws_iam_role_policy_attachment.nodes_AmazonEC2ContainerRegistryReadOnly](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | +| [aws_iam_role_policy_attachment.nodes_AmazonEKSWorkerNodePolicy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | +| [aws_iam_role_policy_attachment.nodes_AmazonEKS_CNI_Policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | +| [aws_iam_role_policy_attachment.nodes_additional_policies](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | +| [random_pet.node_groups](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/pet) | resource | +| [aws_iam_policy_document.node_groups_assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | ## Inputs | Name | Description | Type | Default | Required | -|------|-------------|------|---------|:-----:| -| attach\_node\_cni\_policy | Whether to attach the Amazon managed `AmazonEKS_CNI_Policy` IAM policy to the default node groups IAM role. WARNING: If set `false` the permissions must be assigned to the `aws-node` DaemonSet pods via another method or nodes will not be able to join the cluster. | `bool` | `true` | no | -| cluster\_name | Name of parent cluster. | `string` | n/a | yes | -| create\_eks | Controls if EKS resources should be created (it affects almost all resources). | `bool` | `true` | no | -| iam\_path | If provided, all IAM roles will be created on this path. | `string` | `"/"` | no | -| manage\_node\_iam\_resources | Whether to let the module manage node group IAM resources. If set to false, iam\_instance\_profile\_name must be specified for nodes. | `bool` | `true` | no | -| node\_groups | Map of map of node groups to create. See documentation above for more details. | `any` | `{}` | no | -| node\_groups\_additional\_policies | Additional policies to be added to node groups. | `list(string)` | `[]` | no | -| node\_groups\_defaults | Map of values to be applied to all node groups. See documentation above for more details. | `any` | `{}` | no | -| node\_groups\_role\_name | User defined node groups role name. | `string` | `""` | no | -| permissions\_boundary | If provided, all IAM roles will be created with this permissions boundary attached. | `string` | n/a | yes | -| subnets | A list of subnets to place the EKS cluster and nodes within. | `list(string)` | n/a | yes | -| tags | A map of tags to add to all resources. | `map(string)` | n/a | yes | +|------|-------------|------|---------|:--------:| +| [attach\_node\_cni\_policy](#input\_attach\_node\_cni\_policy) | Whether to attach the Amazon managed `AmazonEKS_CNI_Policy` IAM policy to the default node groups IAM role. WARNING: If set `false` the permissions must be assigned to the `aws-node` DaemonSet pods via another method or nodes will not be able to join the cluster. | `bool` | `true` | no | +| [cluster\_name](#input\_cluster\_name) | Name of parent cluster. | `string` | n/a | yes | +| [create\_eks](#input\_create\_eks) | Controls if EKS resources should be created (it affects almost all resources). | `bool` | `true` | no | +| [iam\_path](#input\_iam\_path) | If provided, all IAM roles will be created on this path. | `string` | `"/"` | no | +| [manage\_node\_iam\_resources](#input\_manage\_node\_iam\_resources) | Whether to let the module manage node group IAM resources. If set to false, iam\_instance\_profile\_name must be specified for nodes. | `bool` | `true` | no | +| [node\_groups](#input\_node\_groups) | Map of map of node groups to create. See documentation above for more details. | `any` | `{}` | no | +| [node\_groups\_additional\_policies](#input\_node\_groups\_additional\_policies) | Additional policies to be added to node groups. | `list(string)` | `[]` | no | +| [node\_groups\_defaults](#input\_node\_groups\_defaults) | Map of values to be applied to all node groups. See documentation above for more details. | `any` | `{}` | no | +| [node\_groups\_role\_name](#input\_node\_groups\_role\_name) | User defined node groups role name. | `string` | `""` | no | +| [permissions\_boundary](#input\_permissions\_boundary) | If provided, all IAM roles will be created with this permissions boundary attached. | `string` | `null` | no | +| [subnets](#input\_subnets) | A list of subnets to place the EKS cluster and nodes within. | `list(string)` | n/a | yes | +| [tags](#input\_tags) | A map of tags to add to all resources. | `map(string)` | n/a | yes | ## Outputs | Name | Description | |------|-------------| -| aws\_auth\_roles | Roles for use in aws-auth ConfigMap | -| node\_groups | Outputs from EKS node groups. Map of maps, keyed by `var.node_groups` keys. See `aws_eks_node_group` Terraform documentation for values | - +| [aws\_auth\_roles](#output\_aws\_auth\_roles) | Roles for use in aws-auth ConfigMap | +| [node\_groups](#output\_node\_groups) | Outputs from EKS node groups. Map of maps, keyed by `var.node_groups` keys. See `aws_eks_node_group` Terraform documentation for values | diff --git a/modules/node_groups/locals.tf b/modules/node_groups/locals.tf index 0b340cf..9ea6c60 100644 --- a/modules/node_groups/locals.tf +++ b/modules/node_groups/locals.tf @@ -1,6 +1,6 @@ locals { node_group_defaults = { - iam_role_arn = concat(aws_iam_role.node_groups.*.arn, [""])[0] + iam_role_arn = concat(aws_iam_role.node_groups[*].arn, [""])[0] instance_type = "m4.large" # Size of the node group instances. desired_capacity = "1" # Desired node group capacity in the autoscaling group. Note: Ignored on change. Hint: Use the Cluster Autoscaler. max_capacity = "3" # Maximum node group capacity in the autoscaling group. diff --git a/modules/node_groups/node_groups.tf b/modules/node_groups/node_groups.tf index 444b92f..504808f 100644 --- a/modules/node_groups/node_groups.tf +++ b/modules/node_groups/node_groups.tf @@ -45,7 +45,7 @@ resource "aws_eks_node_group" "node_groups" { lifecycle { create_before_destroy = true - ignore_changes = [scaling_config.0.desired_size] + ignore_changes = [scaling_config[0].desired_size] } depends_on = [ diff --git a/modules/node_groups/versions.tf b/modules/node_groups/versions.tf index 73c25f6..b2772c7 100644 --- a/modules/node_groups/versions.tf +++ b/modules/node_groups/versions.tf @@ -2,7 +2,13 @@ terraform { required_version = ">= 0.12.9" required_providers { - aws = ">= 2.52.0" - random = ">= 2.1" + aws = { + source = "hashicorp/aws" + version = ">= 2.52.0" + } + random = { + source = "hashicorp/random" + version = ">= 2.1" + } } } diff --git a/modules/worker_groups/README.md b/modules/worker_groups/README.md index 35f87e5..94789f7 100644 --- a/modules/worker_groups/README.md +++ b/modules/worker_groups/README.md @@ -7,60 +7,98 @@ This submodule is designed for use by both the parent `eks` module and by the us `worker_groups` is a map of maps. Key of first level will be used as unique value for `for_each` resources and in the `aws_autoscaling_group` and `aws_launch_template` name. Inner map can take the below values. +## Requirements + +| Name | Version | +|------|---------| +| [terraform](#requirement\_terraform) | >= 0.12.9 | +| [aws](#requirement\_aws) | >= 2.52.0 | +| [random](#requirement\_random) | >= 2.1 | +| [template](#requirement\_template) | >= 2.1 | + ## Providers | Name | Version | |------|---------| -| aws | >= 2.52.0 | -| random | >= 2.1 | -| template | >= 2.1 | +| [aws](#provider\_aws) | >= 2.52.0 | +| [template](#provider\_template) | >= 2.1 | + +## Modules + +No modules. + +## Resources + +| Name | Type | +|------|------| +| [aws_autoscaling_group.worker_groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/autoscaling_group) | resource | +| [aws_iam_instance_profile.worker_groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_instance_profile) | resource | +| [aws_iam_role.worker_groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | +| [aws_iam_role_policy_attachment.workers_AmazonEC2ContainerRegistryReadOnly](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | +| [aws_iam_role_policy_attachment.workers_AmazonEKSWorkerNodePolicy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | +| [aws_iam_role_policy_attachment.workers_AmazonEKS_CNI_Policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | +| [aws_iam_role_policy_attachment.workers_additional_policies](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | +| [aws_launch_template.worker_groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/launch_template) | resource | +| [aws_security_group.worker_groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource | +| [aws_security_group_rule.cluster_https_workers_ingress](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource | +| [aws_security_group_rule.workers_egress_internet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource | +| [aws_security_group_rule.workers_ingress_cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource | +| [aws_security_group_rule.workers_ingress_cluster_https](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource | +| [aws_security_group_rule.workers_ingress_cluster_kubelet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource | +| [aws_security_group_rule.workers_ingress_self](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource | +| [aws_ami.eks_worker](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source | +| [aws_ami.eks_worker_windows](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ami) | data source | +| [aws_eks_cluster.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source | +| [aws_iam_instance_profile.custom_worker_group_launch_template_iam_instance_profile](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_instance_profile) | data source | +| [aws_iam_policy_document.workers_assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | +| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | +| [template_file.launch_template_userdata](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source | ## Inputs | Name | Description | Type | Default | Required | -|------|-------------|------|---------|:-----:| -| attach\_worker\_cni\_policy | Whether to attach the Amazon managed `AmazonEKS_CNI_Policy` IAM policy to the default worker groups IAM role. WARNING: If set `false` the permissions must be assigned to the `aws-worker` DaemonSet pods via another method or workers will not be able to join the cluster. | `bool` | `true` | no | -| cluster\_name | Name of the parent EKS cluster. | `string` | n/a | yes | -| cluster\_security\_group\_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the workers | `string` | n/a | yes | -| create\_eks | Controls if EKS resources should be created (it affects almost all resources). | `bool` | `true` | no | -| iam\_path | If provided, all IAM roles will be created on this path. | `string` | `"/"` | no | -| manage\_worker\_iam\_resources | Whether to let the module manage worker IAM resources. If set to false, iam\_instance\_profile\_name must be specified for workers. | `bool` | `true` | no | -| permissions\_boundary | If provided, all IAM roles will be created with this permissions boundary attached. | `string` | n/a | yes | -| subnets | A list of subnets to place the EKS cluster and workers within. | `list(string)` | n/a | yes | -| tags | A map of tags to add to all resources. | `map(string)` | n/a | yes | -| vpc\_id | VPC where the cluster and workers will be deployed. | `string` | n/a | yes | -| worker\_additional\_security\_group\_ids | A list of additional security group ids to attach to worker instances | `list(string)` | `[]` | no | -| worker\_ami\_name\_filter | Name filter for AWS EKS worker AMI. If not provided, the latest official AMI for the specified 'cluster\_version' is used. | `string` | `""` | no | -| worker\_ami\_name\_filter\_windows | Name filter for AWS EKS Windows worker AMI. If not provided, the latest official AMI for the specified 'cluster\_version' is used. | `string` | `""` | no | -| worker\_ami\_owner\_id | The ID of the owner for the AMI to use for the AWS EKS workers. Valid values are an AWS account ID, 'self' (the current account), or an AWS owner alias (e.g. 'amazon', 'aws-marketplace', 'microsoft'). | `string` | `"602401143452"` | no | -| worker\_ami\_owner\_id\_windows | The ID of the owner for the AMI to use for the AWS EKS Windows workers. Valid values are an AWS account ID, 'self' (the current account), or an AWS owner alias (e.g. 'amazon', 'aws-marketplace', 'microsoft'). | `string` | `"801119661308"` | no | -| worker\_create\_initial\_lifecycle\_hooks | Whether to create initial lifecycle hooks provided in worker groups. | `bool` | `false` | no | -| worker\_create\_security\_group | Whether to create a security group for the workers or attach the workers to `worker_security_group_id`. | `bool` | `true` | no | -| worker\_groups | Map of map of worker groups to create. See documentation above for more details. | `any` | `{}` | no | -| worker\_groups\_additional\_policies | Additional policies to be added to worker groups. | `list(string)` | `[]` | no | -| worker\_groups\_defaults | Map of values to be applied to all worker groups. See documentation above for more details. | `any` | `{}` | no | -| worker\_groups\_role\_name | User defined worker groups role name. | `string` | `""` | no | -| worker\_security\_group\_id | If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the EKS cluster. | `string` | `""` | no | -| worker\_sg\_ingress\_from\_port | Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443). | `number` | `1025` | no | -| workers\_additional\_policies | Additional policies to be added to workers | `list(string)` | `[]` | no | -| workers\_role\_name | User defined workers role name. | `string` | `""` | no | +|------|-------------|------|---------|:--------:| +| [attach\_worker\_cni\_policy](#input\_attach\_worker\_cni\_policy) | Whether to attach the Amazon managed `AmazonEKS_CNI_Policy` IAM policy to the default worker groups IAM role. WARNING: If set `false` the permissions must be assigned to the `aws-worker` DaemonSet pods via another method or workers will not be able to join the cluster. | `bool` | `true` | no | +| [cluster\_name](#input\_cluster\_name) | Name of the parent EKS cluster. | `string` | n/a | yes | +| [cluster\_security\_group\_id](#input\_cluster\_security\_group\_id) | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the workers | `string` | n/a | yes | +| [create\_eks](#input\_create\_eks) | Controls if EKS resources should be created (it affects almost all resources). | `bool` | `true` | no | +| [iam\_path](#input\_iam\_path) | If provided, all IAM roles will be created on this path. | `string` | `"/"` | no | +| [manage\_worker\_iam\_resources](#input\_manage\_worker\_iam\_resources) | Whether to let the module manage worker IAM resources. If set to false, iam\_instance\_profile\_name must be specified for workers. | `bool` | `true` | no | +| [permissions\_boundary](#input\_permissions\_boundary) | If provided, all IAM roles will be created with this permissions boundary attached. | `string` | `null` | no | +| [subnets](#input\_subnets) | A list of subnets to place the EKS cluster and workers within. | `list(string)` | n/a | yes | +| [tags](#input\_tags) | A map of tags to add to all resources. | `map(string)` | n/a | yes | +| [vpc\_id](#input\_vpc\_id) | VPC where the cluster and workers will be deployed. | `string` | n/a | yes | +| [worker\_additional\_security\_group\_ids](#input\_worker\_additional\_security\_group\_ids) | A list of additional security group ids to attach to worker instances | `list(string)` | `[]` | no | +| [worker\_ami\_name\_filter](#input\_worker\_ami\_name\_filter) | Name filter for AWS EKS worker AMI. If not provided, the latest official AMI for the specified 'cluster\_version' is used. | `string` | `""` | no | +| [worker\_ami\_name\_filter\_windows](#input\_worker\_ami\_name\_filter\_windows) | Name filter for AWS EKS Windows worker AMI. If not provided, the latest official AMI for the specified 'cluster\_version' is used. | `string` | `""` | no | +| [worker\_ami\_owner\_id](#input\_worker\_ami\_owner\_id) | The ID of the owner for the AMI to use for the AWS EKS workers. Valid values are an AWS account ID, 'self' (the current account), or an AWS owner alias (e.g. 'amazon', 'aws-marketplace', 'microsoft'). | `string` | `"602401143452"` | no | +| [worker\_ami\_owner\_id\_windows](#input\_worker\_ami\_owner\_id\_windows) | The ID of the owner for the AMI to use for the AWS EKS Windows workers. Valid values are an AWS account ID, 'self' (the current account), or an AWS owner alias (e.g. 'amazon', 'aws-marketplace', 'microsoft'). | `string` | `"801119661308"` | no | +| [worker\_create\_initial\_lifecycle\_hooks](#input\_worker\_create\_initial\_lifecycle\_hooks) | Whether to create initial lifecycle hooks provided in worker groups. | `bool` | `false` | no | +| [worker\_create\_security\_group](#input\_worker\_create\_security\_group) | Whether to create a security group for the workers or attach the workers to `worker_security_group_id`. | `bool` | `true` | no | +| [worker\_groups](#input\_worker\_groups) | Map of map of worker groups to create. See documentation above for more details. | `any` | `{}` | no | +| [worker\_groups\_additional\_policies](#input\_worker\_groups\_additional\_policies) | Additional policies to be added to worker groups. | `list(string)` | `[]` | no | +| [worker\_groups\_defaults](#input\_worker\_groups\_defaults) | Map of values to be applied to all worker groups. See documentation above for more details. | `any` | `{}` | no | +| [worker\_groups\_role\_name](#input\_worker\_groups\_role\_name) | User defined worker groups role name. | `string` | `""` | no | +| [worker\_security\_group\_id](#input\_worker\_security\_group\_id) | If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the EKS cluster. | `string` | `""` | no | +| [worker\_sg\_ingress\_from\_port](#input\_worker\_sg\_ingress\_from\_port) | Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443). | `number` | `1025` | no | +| [workers\_additional\_policies](#input\_workers\_additional\_policies) | Additional policies to be added to workers | `list(string)` | `[]` | no | +| [workers\_role\_name](#input\_workers\_role\_name) | User defined workers role name. | `string` | `""` | no | ## Outputs | Name | Description | |------|-------------| -| aws\_auth\_roles | Roles for use in aws-auth ConfigMap | -| worker\_iam\_instance\_profile\_arns | default IAM instance profile ARN for EKS worker groups | -| worker\_iam\_instance\_profile\_names | default IAM instance profile name for EKS worker groups | -| worker\_iam\_role\_arn | default IAM role ARN for EKS worker groups | -| worker\_iam\_role\_name | default IAM role name for EKS worker groups | -| worker\_security\_group\_id | Security group ID attached to the EKS workers. | -| workers\_asg\_arns | IDs of the autoscaling groups containing workers. | -| workers\_asg\_names | Names of the autoscaling groups containing workers. | -| workers\_default\_ami\_id | ID of the default worker group AMI | -| workers\_launch\_template\_arns | ARNs of the worker launch templates. | -| workers\_launch\_template\_ids | IDs of the worker launch templates. | -| workers\_launch\_template\_latest\_versions | Latest versions of the worker launch templates. | -| workers\_user\_data | User data of worker groups | - +| [aws\_auth\_roles](#output\_aws\_auth\_roles) | Roles for use in aws-auth ConfigMap | +| [worker\_iam\_instance\_profile\_arns](#output\_worker\_iam\_instance\_profile\_arns) | default IAM instance profile ARN for EKS worker groups | +| [worker\_iam\_instance\_profile\_names](#output\_worker\_iam\_instance\_profile\_names) | default IAM instance profile name for EKS worker groups | +| [worker\_iam\_role\_arn](#output\_worker\_iam\_role\_arn) | default IAM role ARN for EKS worker groups | +| [worker\_iam\_role\_name](#output\_worker\_iam\_role\_name) | default IAM role name for EKS worker groups | +| [worker\_security\_group\_id](#output\_worker\_security\_group\_id) | Security group ID attached to the EKS workers. | +| [workers\_asg\_arns](#output\_workers\_asg\_arns) | IDs of the autoscaling groups containing workers. | +| [workers\_asg\_names](#output\_workers\_asg\_names) | Names of the autoscaling groups containing workers. | +| [workers\_default\_ami\_id](#output\_workers\_default\_ami\_id) | ID of the default worker group AMI | +| [workers\_launch\_template\_arns](#output\_workers\_launch\_template\_arns) | ARNs of the worker launch templates. | +| [workers\_launch\_template\_ids](#output\_workers\_launch\_template\_ids) | IDs of the worker launch templates. | +| [workers\_launch\_template\_latest\_versions](#output\_workers\_launch\_template\_latest\_versions) | Latest versions of the worker launch templates. | +| [workers\_user\_data](#output\_workers\_user\_data) | User data of worker groups | diff --git a/modules/worker_groups/data.tf b/modules/worker_groups/data.tf index d78e107..e8fd2f0 100644 --- a/modules/worker_groups/data.tf +++ b/modules/worker_groups/data.tf @@ -69,7 +69,7 @@ data "template_file" "launch_template_userdata" { platform = each.value["platform"] cluster_name = var.cluster_name endpoint = data.aws_eks_cluster.this.endpoint - cluster_auth_base64 = data.aws_eks_cluster.this.certificate_authority.0.data + cluster_auth_base64 = data.aws_eks_cluster.this.certificate_authority[0].data pre_userdata = each.value["pre_userdata"] additional_userdata = each.value["additional_userdata"] bootstrap_extra_args = each.value["bootstrap_extra_args"] diff --git a/modules/worker_groups/locals.tf b/modules/worker_groups/locals.tf index 4a75a51..d6d0951 100644 --- a/modules/worker_groups/locals.tf +++ b/modules/worker_groups/locals.tf @@ -8,14 +8,13 @@ locals { ) ] - default_iam_role_id = concat(aws_iam_role.worker_groups.*.id, [""])[0] + default_iam_role_id = concat(aws_iam_role.worker_groups[*].id, [""])[0] default_ami_id_linux = data.aws_ami.eks_worker.id default_ami_id_windows = data.aws_ami.eks_worker_windows.id worker_create_security_group = var.worker_create_security_group && var.create_eks worker_groups_defaults = { - name = "" # Name of the worker group. Literal count.index will never be used but if name is not set, the count.index interpolation will be used. tags = [] # A list of map defining extra tags to be applied to the worker group autoscaling group. ami_id = "" # AMI ID for the eks workers. If none is provided, Terraform will search for the latest version of their EKS optimized worker AMI based on platform. desired_capacity = "1" # Desired worker capacity in the autoscaling group and changing its value will not affect the autoscaling group's desired capacity because the cluster-autoscaler manages up and down scaling of the nodes. Cluster-autoscaler add nodes when pods are in pending state and remove the nodes when they are not required by modifying the desirec_capacity of the autoscaling group. Although an issue exists in which if the value of the min_size is changed it modifies the value of desired_capacity. @@ -23,7 +22,6 @@ locals { min_size = "1" # Minimum worker capacity in the autoscaling group. NOTE: Change in this paramater will affect the desired_capacity, like changing its value to 2 will change desired_capacity value to 2 but bringing back it to 1 will not affect the desired_capacity. force_delete = false # Enable forced deletion for the autoscaling group. initial_lifecycle_hooks = [] # Initital lifecycle hook for the autoscaling group. - recreate_on_change = false # Recreate the autoscaling group when the Launch Template or Launch Configuration change. default_cooldown = null # The amount of time, in seconds, after a scaling activity completes before another scaling activity can start. health_check_grace_period = null # Time in seconds after instance comes into service before checking health. instance_type = "m4.large" # Size of the workers instances. @@ -82,7 +80,7 @@ locals { v, ) if var.create_eks } - worker_security_group_id = local.worker_create_security_group ? aws_security_group.worker_groups.0.id : var.worker_security_group_id + worker_security_group_id = local.worker_create_security_group ? aws_security_group.worker_groups[0].id : var.worker_security_group_id policy_arn_prefix = contains(["cn-northwest-1", "cn-north-1"], data.aws_region.current.name) ? "arn:aws-cn:iam::aws:policy" : "arn:aws:iam::aws:policy" diff --git a/modules/worker_groups/outputs.tf b/modules/worker_groups/outputs.tf index 08bc04e..c440306 100644 --- a/modules/worker_groups/outputs.tf +++ b/modules/worker_groups/outputs.tf @@ -10,17 +10,17 @@ output "aws_auth_roles" { output "workers_asg_arns" { description = "IDs of the autoscaling groups containing workers." - value = values(aws_autoscaling_group.worker_groups).*.arn + value = values(aws_autoscaling_group.worker_groups)[*].arn } output "workers_asg_names" { description = "Names of the autoscaling groups containing workers." - value = values(aws_autoscaling_group.worker_groups).*.id + value = values(aws_autoscaling_group.worker_groups)[*].id } output "workers_user_data" { description = "User data of worker groups" - value = values(data.template_file.launch_template_userdata).*.rendered + value = values(data.template_file.launch_template_userdata)[*].rendered } output "workers_default_ami_id" { @@ -30,17 +30,17 @@ output "workers_default_ami_id" { output "workers_launch_template_ids" { description = "IDs of the worker launch templates." - value = values(aws_launch_template.worker_groups).*.id + value = values(aws_launch_template.worker_groups)[*].id } output "workers_launch_template_arns" { description = "ARNs of the worker launch templates." - value = values(aws_launch_template.worker_groups).*.arn + value = values(aws_launch_template.worker_groups)[*].arn } output "workers_launch_template_latest_versions" { description = "Latest versions of the worker launch templates." - value = values(aws_launch_template.worker_groups).*.latest_version + value = values(aws_launch_template.worker_groups)[*].latest_version } output "worker_security_group_id" { @@ -50,19 +50,19 @@ output "worker_security_group_id" { output "worker_iam_instance_profile_arns" { description = "default IAM instance profile ARN for EKS worker groups" - value = values(aws_iam_instance_profile.worker_groups).*.arn + value = values(aws_iam_instance_profile.worker_groups)[*].arn } output "worker_iam_instance_profile_names" { description = "default IAM instance profile name for EKS worker groups" - value = values(aws_iam_instance_profile.worker_groups).*.name + value = values(aws_iam_instance_profile.worker_groups)[*].name } output "worker_iam_role_name" { description = "default IAM role name for EKS worker groups" value = coalescelist( - aws_iam_role.worker_groups.*.name, - values(data.aws_iam_instance_profile.custom_worker_group_launch_template_iam_instance_profile).*.role_name, + aws_iam_role.worker_groups[*].name, + values(data.aws_iam_instance_profile.custom_worker_group_launch_template_iam_instance_profile)[*].role_name, [""] )[0] } @@ -70,8 +70,8 @@ output "worker_iam_role_name" { output "worker_iam_role_arn" { description = "default IAM role ARN for EKS worker groups" value = coalescelist( - aws_iam_role.worker_groups.*.arn, - values(data.aws_iam_instance_profile.custom_worker_group_launch_template_iam_instance_profile).*.role_arn, + aws_iam_role.worker_groups[*].arn, + values(data.aws_iam_instance_profile.custom_worker_group_launch_template_iam_instance_profile)[*].role_arn, [""] )[0] } diff --git a/modules/worker_groups/random.tf b/modules/worker_groups/random.tf deleted file mode 100644 index c0d02e3..0000000 --- a/modules/worker_groups/random.tf +++ /dev/null @@ -1,26 +0,0 @@ -resource "random_pet" "worker_groups" { - for_each = local.worker_groups_expanded - - separator = "-" - length = 2 - - keepers = { - ami_id = coalesce(each.value["ami_id"], each.value["platform"] == "windows" ? local.default_ami_id_windows : local.default_ami_id_linux) - root_volume_size = lookup(each.value, "root_volume_size", null) - instance_type = each.value["instance_type"] - - override_instance_types = join("|", compact( - lookup(each.value, "override_instance_types", []) - )) - - iam_role_id = each.value["iam_role_id"] - key_name = each.value["key_name"] - - source_security_group_ids = join("|", compact( - lookup(each.value, "source_security_group_ids", []) - )) - - subnet_ids = join("|", each.value["subnets"]) - worker_group_name = join("-", [var.cluster_name, each.key]) - } -} diff --git a/modules/worker_groups/variables.tf b/modules/worker_groups/variables.tf index b487059..661db3b 100644 --- a/modules/worker_groups/variables.tf +++ b/modules/worker_groups/variables.tf @@ -31,6 +31,7 @@ variable "subnets" { type = list(string) } +# tflint-ignore: terraform_unused_declarations variable "worker_groups_role_name" { description = "User defined worker groups role name." type = string @@ -54,7 +55,7 @@ variable "attach_worker_cni_policy" { type = bool default = true } - +# tflint-ignore: terraform_unused_declarations variable "worker_groups_additional_policies" { description = "Additional policies to be added to worker groups." type = list(string) diff --git a/modules/worker_groups/versions.tf b/modules/worker_groups/versions.tf index 598469c..1da25a1 100644 --- a/modules/worker_groups/versions.tf +++ b/modules/worker_groups/versions.tf @@ -2,8 +2,17 @@ terraform { required_version = ">= 0.12.9" required_providers { - aws = ">= 2.52.0" - template = ">= 2.1" - random = ">= 2.1" + aws = { + source = "hashicorp/aws" + version = ">= 2.52.0" + } + template = { + source = "hashicorp/template" + version = ">= 2.1" + } + random = { + source = "hashicorp/random" + version = ">= 2.1" + } } } diff --git a/modules/worker_groups/worker_groups.tf b/modules/worker_groups/worker_groups.tf index 2ac2383..b19a0da 100644 --- a/modules/worker_groups/worker_groups.tf +++ b/modules/worker_groups/worker_groups.tf @@ -3,16 +3,7 @@ resource "aws_autoscaling_group" "worker_groups" { for_each = local.worker_groups_expanded - name_prefix = join( - "-", - compact( - [ - var.cluster_name, - coalesce(each.value["name"], each.key), - each.value["recreate_on_change"] ? random_pet.worker_groups[each.key].id : "" - ] - ) - ) + name_prefix = "${var.cluster_name}-${each.key}" desired_capacity = each.value["desired_capacity"] max_size = each.value["max_size"] @@ -91,7 +82,7 @@ resource "aws_autoscaling_group" "worker_groups" { [ { "key" = "Name" - "value" = "${var.cluster_name}-${coalesce(each.value["name"], each.key)}-eks_asg" + "value" = "${var.cluster_name}-${each.key}-eks_asg" "propagate_at_launch" = true }, { @@ -119,7 +110,7 @@ resource "aws_autoscaling_group" "worker_groups" { resource "aws_launch_template" "worker_groups" { for_each = local.worker_groups_expanded - name_prefix = "${var.cluster_name}-${coalesce(each.value["name"], each.key)}" + name_prefix = "${var.cluster_name}-${each.key}" network_interfaces { associate_public_ip_address = each.value["public_ip"] @@ -198,7 +189,7 @@ resource "aws_launch_template" "worker_groups" { tags = merge( { - "Name" = "${var.cluster_name}-${coalesce(each.value["name"], each.key)}-eks_asg", + "Name" = "${var.cluster_name}-${each.key}-eks_asg", "kubernetes.io/cluster/${var.cluster_name}" = "owned", }, var.tags, @@ -216,7 +207,7 @@ resource "aws_launch_template" "worker_groups" { resource "aws_iam_instance_profile" "worker_groups" { for_each = var.manage_worker_iam_resources ? local.worker_groups_expanded : {} - name_prefix = "${var.cluster_name}-${coalesce(each.value["name"], each.key)}" + name_prefix = "${var.cluster_name}-${each.key}" role = each.value["iam_role_id"] path = var.iam_path } diff --git a/variables.tf b/variables.tf index 53f40fe..d60011f 100644 --- a/variables.tf +++ b/variables.tf @@ -14,6 +14,12 @@ variable "cluster_log_retention_in_days" { type = number } +variable "cluster_log_group_class" { + default = "INFREQUENT_ACCESS" + description = "Specified the log class of the log group. Possible values are: STANDARD or INFREQUENT_ACCESS" + type = string +} + variable "cluster_name" { description = "Name of the EKS cluster. Also used as a prefix in names of related resources." type = string @@ -31,6 +37,18 @@ variable "cluster_version" { default = "1.15" } +variable "cluster_authentication_mode" { + description = "The authentication mode for the cluster that is one of CONFIG_MAP, API or API_AND_CONFIG_MAP" + type = string + default = "API_AND_CONFIG_MAP" +} + +variable "bootstrap_cluster_creator_admin_permissions" { + description = "Whether to give cluster creator admin permissions when using API authentication mode. Only applicable if cluster_authentication_mode is set to API or API_AND_CONFIG_MAP." + type = bool + default = false +} + variable "config_output_path" { description = "Where to save the Kubectl config file (if `write_kubeconfig = true`). Assumed to be a directory if the value ends with a forward slash `/`." type = string @@ -45,6 +63,7 @@ variable "write_kubeconfig" { variable "manage_aws_auth" { description = "Whether to apply the aws-auth configmap file." + type = bool default = true } @@ -102,12 +121,6 @@ variable "worker_groups_defaults" { default = {} } -variable "worker_groups_launch_template" { - description = "A list of maps defining worker group configurations to be defined using AWS Launch Templates. See workers_group_defaults for valid keys." - type = any - default = [] -} - variable "worker_security_group_id" { description = "If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the EKS cluster." type = string @@ -162,30 +175,6 @@ variable "node_groups_additional_policies" { default = [] } -variable "kubeconfig_aws_authenticator_command" { - description = "Command to use to fetch AWS EKS credentials." - type = string - default = "aws-iam-authenticator" -} - -variable "kubeconfig_aws_authenticator_command_args" { - description = "Default arguments passed to the authenticator command. Defaults to [token -i $cluster_name]." - type = list(string) - default = [] -} - -variable "kubeconfig_aws_authenticator_additional_args" { - description = "Any additional arguments to pass to the authenticator such as the role to assume. e.g. [\"-r\", \"MyEksRole\"]." - type = list(string) - default = [] -} - -variable "kubeconfig_aws_authenticator_env_variables" { - description = "Environment variables that should be used when executing the authenticator. e.g. { AWS_PROFILE = \"eks\"}." - type = map(string) - default = {} -} - variable "kubeconfig_name" { description = "Override the default name used for items kubeconfig." type = string @@ -347,3 +336,8 @@ variable "cluster_encryption_resources" { description = "A list of the EKS resources to encrypt." default = ["secrets"] } + +variable "region" { + type = string + description = "AWS region" +}