Merge branch 'main' into aman/issue-199

wandb · May 10, 2024 · 6392963 · 6392963
2 parents 2bd3e3f + f98a053
commit 6392963
Show file tree

Hide file tree

Showing 5 changed files with 99 additions and 29 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,20 @@
 
 All notable changes to this project will be documented in this file.
 
+### [4.10.1](https://github.com/wandb/terraform-aws-wandb/compare/v4.10.0...v4.10.1) (2024-05-08)
+
+
+### Bug Fixes
+
+* Update to readme ([#213](https://github.com/wandb/terraform-aws-wandb/issues/213)) ([4ab44af](https://github.com/wandb/terraform-aws-wandb/commit/4ab44af5490141f3a50c9cd3589566580862f9a4))
+
+## [4.10.0](https://github.com/wandb/terraform-aws-wandb/compare/v4.9.0...v4.10.0) (2024-05-08)
+
+
+### Features
+
+* Set default EKS to 1.26; install vpc-cni add-on ([#207](https://github.com/wandb/terraform-aws-wandb/issues/207)) ([0fa5767](https://github.com/wandb/terraform-aws-wandb/commit/0fa5767b47d2612821f4dab3cb589ca3a8fafa2b))
+
 ## [4.9.0](https://github.com/wandb/terraform-aws-wandb/compare/v4.8.1...v4.9.0) (2024-04-30)
 
 

diff --git a/README.md b/README.md
@@ -111,6 +111,10 @@ Users can update the EKS cluster version to the latest version offered by AWS. T
 Upgrades must be executed in step-wise fashion from one version to the next. You cannot skip versions when upgrading EKS.
 <!-- BEGIN_TF_DOCS -->
 
+### Notes on EKS Add-ons
+If a terraform apply fails because an add-on is already installed, remove the add-on using the AWS console or the AWS
+CLI and re-run the apply. Running pods will not be impacted.
+
 ## Requirements
 
 | Name | Version |

diff --git a/examples/public-dns-external/main.tf b/examples/public-dns-external/main.tf
@@ -28,7 +28,7 @@ module "wandb_infra" {
   allowed_inbound_cidr      = var.allowed_inbound_cidr
   allowed_inbound_ipv6_cidr = ["::/0"]
 
-  eks_cluster_version            = "1.25"
+  eks_cluster_version            = "1.26"
   kubernetes_public_access       = true
   kubernetes_public_access_cidrs = ["0.0.0.0/0"]
 

diff --git a/modules/app_eks/add-ons.tf b/modules/app_eks/add-ons.tf
@@ -0,0 +1,80 @@
+
+### IAM policy and role for vpc-cni
+data "aws_iam_policy_document" "oidc_assume_role" {
+  statement {
+    actions = ["sts:AssumeRoleWithWebIdentity"]
+    effect  = "Allow"
+
+    condition {
+      test     = "StringEquals"
+      variable = "${replace(module.eks.cluster_oidc_issuer_url, "https://", "")}:sub"
+      values   = ["system:serviceaccount:kube-system:aws-node"]
+    }
+
+    principals {
+      identifiers = [aws_iam_openid_connect_provider.eks.arn]
+      type        = "Federated"
+    }
+  }
+}
+
+resource "aws_iam_role_policy_attachment" "eks_oidc" {
+  policy_arn = "arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"
+  role       = aws_iam_role.oidc.name
+}
+
+resource "aws_iam_role" "oidc" {
+  name               = join("-", [var.namespace, "oidc"])
+  assume_role_policy = data.aws_iam_policy_document.oidc_assume_role.json
+}
+
+
+
+### add-ons
+resource "aws_eks_addon" "aws_efs_csi_driver" {
+   depends_on = [
+     aws_eks_addon.vpc_cni
+   ]
+   cluster_name               = var.namespace
+   addon_name                 = "aws-efs-csi-driver"
+   addon_version              = "v1.7.7-eksbuild.1"
+   resolve_conflicts          = "OVERWRITE"
+ }
+
+resource "aws_eks_addon" "aws_ebs_csi_driver" {
+  depends_on = [
+    aws_eks_addon.vpc_cni
+  ]
+  cluster_name                = var.namespace
+  addon_name                  = "aws-ebs-csi-driver"
+  addon_version               = "v1.25.0-eksbuild.1"
+  resolve_conflicts           = "OVERWRITE"
+}
+
+resource "aws_eks_addon" "coredns" {
+  depends_on = [
+    aws_eks_addon.vpc_cni
+  ]
+  cluster_name                = var.namespace
+  addon_name                  = "coredns"
+  addon_version               = "v1.9.3-eksbuild.11"
+  resolve_conflicts           = "OVERWRITE"
+}
+
+resource "aws_eks_addon" "kube_proxy" {
+  depends_on = [
+    aws_eks_addon.vpc_cni
+  ]
+  cluster_name                = var.namespace
+  addon_name                  = "kube-proxy"
+  addon_version               = "v1.25.14-eksbuild.2"
+  resolve_conflicts           = "OVERWRITE"
+}
+
+resource "aws_eks_addon" "vpc_cni" {
+  cluster_name                = var.namespace
+  addon_name                  = "vpc-cni"
+  addon_version               = "v1.18.0-eksbuild.1"
+  resolve_conflicts           = "OVERWRITE"
+  service_account_role_arn = aws_iam_role.oidc.arn
+}
diff --git a/modules/app_eks/main.tf b/modules/app_eks/main.tf
@@ -14,34 +14,6 @@ locals {
 }
 
 
-resource "aws_eks_addon" "eks" {
-  cluster_name = var.namespace
-  addon_name   = "aws-ebs-csi-driver"
-  depends_on = [
-    module.eks
-  ]
-}
-
-resource "aws_eks_addon" "efs" {
-  cluster_name      = module.eks.cluster_id
-  addon_name        = "aws-efs-csi-driver"
-  addon_version     = "v1.7.1-eksbuild.1" # Ensure this version is compatible
-  resolve_conflicts = "OVERWRITE"
-  depends_on = [
-    module.eks
-  ]
-}
-
-# removed due to conflict with 
-# AWS Load Balancer Controller
-# being installed with Helm.
-# See: https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.6/
-#resource "aws_eks_addon" "vpc_cni" {
-#  cluster_name = var.namespace
-#  addon_name   = "vpc-cni"
-#  depends_on   = [module.eks]
-#}
-
 module "eks" {
   source  = "terraform-aws-modules/eks/aws"
   version = "~> 17.23"