This repository has been archived by the owner on Sep 27, 2024. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
BATIAI-2423: EKS module upgrade and access entry introduction (#149)
* updating eks module to 20.8.4 * UPDATED: Managed AWS auth configmap is set to false - The 'manage_aws_auth_configmap' variable in module is now set to false. * UPDATED: Updated eks module configuration Removed the manage_aws_auth_configmap setting in the eks module configuration. * UPDATED: Disable cluster creator admin permissions in EKS module The `enable_cluster_creator_admin_permissions` flag in the EKS module has been changed from `true` to `false`. - This change disables cluster creator admin permissions. - The VPC ID and subnet IDs remain same. * module upgrade and access entry * adding comments to code * updating module and access policy * update for eks module 20.8.5 upgrade and access entry for roles * [pre-commit.ci lite] apply automatic fixes * updating changelog file * updating changelog file * [pre-commit.ci lite] apply automatic fixes --------- Co-authored-by: Arun Sanna <asanna@vivsoft.io> Co-authored-by: pre-commit-ci-lite[bot] <117423508+pre-commit-ci-lite[bot]@users.noreply.github.com>
- Loading branch information
3 people
authored
May 7, 2024
1 parent
cbb5c86
commit 91e2398
Showing
7 changed files
with
125 additions
and
162 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,68 @@ | ||
|
|
||
| ################################################################################# | ||
| # Access Entry for Cluster access | ||
| ################################################################################# | ||
| ## The resources access entry and policy association is targeting roles that require cluster admins | ||
| ## it can be repeated for roles that require different cluster policy | ||
| resource "aws_eks_access_entry" "cluster_admin" { | ||
| for_each = toset(var.admin_principal_arns) | ||
|
|
||
| cluster_name = local.name | ||
| kubernetes_groups = [] | ||
| principal_arn = each.value | ||
| type = "STANDARD" | ||
| user_name = try(each.value.user_name, null) | ||
|
|
||
| depends_on = [ | ||
| module.eks_managed_node_groups, | ||
| ] | ||
| } | ||
|
|
||
| resource "aws_eks_access_policy_association" "cluster_admin" { | ||
| for_each = toset(var.admin_principal_arns) | ||
|
|
||
| access_scope { | ||
| namespaces = [] | ||
| type = "cluster" | ||
| } | ||
|
|
||
| cluster_name = local.name | ||
|
|
||
| policy_arn = "arn:${data.aws_partition.current.partition}:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy" | ||
| principal_arn = each.value | ||
|
|
||
| depends_on = [ | ||
| aws_eks_access_entry.cluster_admin, | ||
| ] | ||
| } | ||
|
|
||
| ## Creating access entry for delete_ebs_volumes_lambda with namespaced adminpolicy | ||
| resource "aws_eks_access_entry" "delete_ebs_volume" { | ||
|
|
||
| cluster_name = local.name | ||
| kubernetes_groups = [] | ||
| principal_arn = var.delete_ebs_volume_role_arn | ||
| type = "STANDARD" | ||
| user_name = (null) | ||
|
|
||
| depends_on = [ | ||
| module.eks_managed_node_groups, | ||
| kubectl_manifest.batcave_namespace | ||
| ] | ||
| } | ||
| resource "aws_eks_access_policy_association" "delete_ebs_volume" { | ||
|
|
||
| access_scope { | ||
| namespaces = ["batcave"] | ||
| type = "namespace" | ||
| } | ||
|
|
||
| cluster_name = local.name | ||
|
|
||
| policy_arn = "arn:${data.aws_partition.current.partition}:eks::aws:cluster-access-policy/AmazonEKSAdminPolicy" | ||
| principal_arn = var.delete_ebs_volume_role_arn | ||
|
|
||
| depends_on = [ | ||
| aws_eks_access_entry.delete_ebs_volume, | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.