Skip to content

Commit 59baa99

Browse files
ThumbiceqThumbiceq
authored
Values input overrides (#3)
Changes: * Add ability to specify custom configuration options as values yaml * Add ability to opt-out from IRSA role creation * Add new variable k8s_assume_role_arn for assume role arn definition * Delegate Kubernetes namespace creation to helm provider from Kubernetes provider * Bump default chart version to the 1.5.3 * Update terraform docs version in pre-commit Breaking changes: * Removes fake dependency variable mod_dependency in favor of terraform built-in module dependency injection * Rename variable k8s_create_namespace to helm_create_namespace * Assume role arn should be specified by variable k8s_assume_role_arn instead of parameter passed in settings
1 parent 1729062 commit 59baa99

File tree

11 files changed

+201
-217
lines changed

11 files changed

+201
-217
lines changed

‎.github/workflows/main.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ on:
77
branches: [ master, main ]
88

99
env:
10-
TERRAFORM_DOCS_VERSION: "v0.11.2"
10+
TERRAFORM_DOCS_VERSION: "v0.15.0"
1111
TFLINT_VERSION: "v0.25.0"
1212
TFSEC_VERSION: "v0.39.6"
1313

‎.pre-commit-config.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ repos:
2323
# - id: terraform_tfsec
2424
- id: terraform_docs
2525
args:
26-
- '--args=--hide providers --sort-by-required'
26+
- '--args=--hide providers --sort-by required'
2727

2828
- repo: git://github.com/pecigonzalo/pre-commit-terraform-vars
2929
rev: v1.0.0

‎README.md

Lines changed: 42 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -35,54 +35,62 @@ See [Basic example](examples/basic/README.md) for further information.
3535

3636
| Name | Version |
3737
|------|---------|
38-
| terraform | >= 0.13 |
39-
| aws | >= 2.0 |
40-
| helm | >= 1.0 |
41-
| kubernetes | >= 1.10 |
42-
| local | >= 1.3 |
43-
| null | >= 2.0 |
44-
| time | >= 0.6 |
38+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13 |
39+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 2.0 |
40+
| <a name="requirement_helm"></a> [helm](#requirement\_helm) | >= 1.0 |
41+
| <a name="requirement_time"></a> [time](#requirement\_time) | >= 0.6 |
42+
| <a name="requirement_utils"></a> [utils](#requirement\_utils) | >= 0.12.0 |
4543

4644
## Modules
4745

48-
No Modules.
46+
No modules.
4947

5048
## Resources
5149

52-
| Name |
53-
|------|
54-
| [aws_iam_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) |
55-
| [aws_iam_policy_document](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) |
56-
| [aws_iam_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) |
57-
| [aws_iam_role_policy_attachment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) |
58-
| [aws_region](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) |
59-
| [helm_release](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) |
60-
| [time_sleep](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) |
50+
| Name | Type |
51+
|------|------|
52+
| [aws_iam_policy.cert_manager](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
53+
| [aws_iam_role.cert_manager](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
54+
| [aws_iam_role_policy_attachment.cert_manager](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
55+
| [helm_release.cert_manager](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
56+
| [helm_release.default_cluster_issuer](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
57+
| [time_sleep.default_cluster_issuer](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
58+
| [aws_iam_policy_document.cert_manager](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
59+
| [aws_iam_policy_document.cert_manager_assume](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
60+
| [aws_iam_policy_document.cert_manager_irsa](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
61+
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
62+
| [utils_deep_merge_yaml.default_cluster_issuer_values](https://registry.terraform.io/providers/cloudposse/utils/latest/docs/data-sources/deep_merge_yaml) | data source |
63+
| [utils_deep_merge_yaml.values](https://registry.terraform.io/providers/cloudposse/utils/latest/docs/data-sources/deep_merge_yaml) | data source |
6164

6265
## Inputs
6366

6467
| Name | Description | Type | Default | Required |
6568
|------|-------------|------|---------|:--------:|
66-
| cluster\_identity\_oidc\_issuer | The OIDC Identity issuer for the cluster | `string` | n/a | yes |
67-
| cluster\_identity\_oidc\_issuer\_arn | The OIDC Identity issuer ARN for the cluster that can be used to associate IAM roles with a service account | `string` | n/a | yes |
68-
| cluster\_name | The name of the cluster | `string` | n/a | yes |
69-
| cluster\_issuer\_enabled | Variable indicating whether default ClusterIssuer CRD is enabled | `bool` | `false` | no |
70-
| cluster\_issuer\_settings | Additional settings which will be passed to the Helm chart cluster\_issuer values, see https://github.com/lablabs/terraform-aws-eks-aws-cert-manager/blob/master/helm/defaultClusterIssuer/values.yaml | `map(any)` | `{}` | no |
71-
| enabled | Variable indicating whether deployment is enabled | `bool` | `true` | no |
72-
| helm\_chart\_name | Helm chart name to be installed | `string` | `"cert-manager"` | no |
73-
| helm\_chart\_version | Version of the Helm chart | `string` | `"v1.2.0"` | no |
74-
| helm\_release\_name | Helm release name | `string` | `"cert-manager"` | no |
75-
| helm\_repo\_url | Helm repository | `string` | `"https://charts.jetstack.io"` | no |
76-
| k8s\_create\_namespace | Whether to create k8s namespace with name defined by `k8s_namespace` | `bool` | `false` | no |
77-
| k8s\_namespace | The k8s namespace in which the cert-manager service account has been created | `string` | `"kube-system"` | no |
78-
| k8s\_service\_account\_name | The k8s cert-manager service account name | `string` | `"cert-manager"` | no |
79-
| mod\_dependency | Dependence variable binds all AWS resources allocated by this module, dependent modules reference this variable | `any` | `null` | no |
80-
| policy\_allowed\_zone\_ids | List of the Route53 zone ids for service account IAM role access | `list(string)` | <pre>[<br> "*"<br>]</pre> | no |
81-
| settings | Additional settings which will be passed to the Helm chart values, see https://artifacthub.io/packages/helm/jetstack/cert-manager | `map(any)` | `{}` | no |
69+
| <a name="input_cluster_identity_oidc_issuer"></a> [cluster\_identity\_oidc\_issuer](#input\_cluster\_identity\_oidc\_issuer) | The OIDC Identity issuer for the cluster | `string` | n/a | yes |
70+
| <a name="input_cluster_identity_oidc_issuer_arn"></a> [cluster\_identity\_oidc\_issuer\_arn](#input\_cluster\_identity\_oidc\_issuer\_arn) | The OIDC Identity issuer ARN for the cluster that can be used to associate IAM roles with a service account | `string` | n/a | yes |
71+
| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | The name of the cluster | `string` | n/a | yes |
72+
| <a name="input_cluster_issuer_enabled"></a> [cluster\_issuer\_enabled](#input\_cluster\_issuer\_enabled) | Variable indicating whether default ClusterIssuer CRD is enabled | `bool` | `false` | no |
73+
| <a name="input_cluster_issuer_settings"></a> [cluster\_issuer\_settings](#input\_cluster\_issuer\_settings) | Additional settings which will be passed to the Helm chart cluster\_issuer values, see https://github.com/lablabs/terraform-aws-eks-aws-cert-manager/blob/master/helm/defaultClusterIssuer/values.yaml | `map(any)` | `{}` | no |
74+
| <a name="input_cluster_issuers_values"></a> [cluster\_issuers\_values](#input\_cluster\_issuers\_values) | Additional values for cert manager cluster issuers helm chart. Values will be merged, in order, as Helm does with multiple -f options | `string` | `""` | no |
75+
| <a name="input_enabled"></a> [enabled](#input\_enabled) | Variable indicating whether deployment is enabled | `bool` | `true` | no |
76+
| <a name="input_helm_chart_name"></a> [helm\_chart\_name](#input\_helm\_chart\_name) | Helm chart name to be installed | `string` | `"cert-manager"` | no |
77+
| <a name="input_helm_chart_version"></a> [helm\_chart\_version](#input\_helm\_chart\_version) | Version of the Helm chart | `string` | `"1.5.3"` | no |
78+
| <a name="input_helm_create_namespace"></a> [helm\_create\_namespace](#input\_helm\_create\_namespace) | Whether to create k8s namespace with name defined by `k8s_namespace` | `bool` | `true` | no |
79+
| <a name="input_helm_release_name"></a> [helm\_release\_name](#input\_helm\_release\_name) | Helm release name | `string` | `"cert-manager"` | no |
80+
| <a name="input_helm_repo_url"></a> [helm\_repo\_url](#input\_helm\_repo\_url) | Helm repository | `string` | `"https://charts.jetstack.io"` | no |
81+
| <a name="input_k8s_assume_role_arn"></a> [k8s\_assume\_role\_arn](#input\_k8s\_assume\_role\_arn) | Whether to create and use default role or assume existing role. Useful for hosted zones in another AWS account. Default (empty string) use default role. | `string` | `""` | no |
82+
| <a name="input_k8s_irsa_role_create"></a> [k8s\_irsa\_role\_create](#input\_k8s\_irsa\_role\_create) | Whether to create IRSA role and annotate service account | `bool` | `true` | no |
83+
| <a name="input_k8s_namespace"></a> [k8s\_namespace](#input\_k8s\_namespace) | The K8s namespace in which the external-dns will be installed | `string` | `"kube-system"` | no |
84+
| <a name="input_k8s_rbac_create"></a> [k8s\_rbac\_create](#input\_k8s\_rbac\_create) | Whether to create and use RBAC resources | `bool` | `true` | no |
85+
| <a name="input_k8s_service_account_create"></a> [k8s\_service\_account\_create](#input\_k8s\_service\_account\_create) | Whether to create Service Account | `bool` | `true` | no |
86+
| <a name="input_k8s_service_account_name"></a> [k8s\_service\_account\_name](#input\_k8s\_service\_account\_name) | The k8s cert-manager service account name | `string` | `"cert-manager"` | no |
87+
| <a name="input_policy_allowed_zone_ids"></a> [policy\_allowed\_zone\_ids](#input\_policy\_allowed\_zone\_ids) | List of the Route53 zone ids for service account IAM role access | `list(string)` | <pre>[<br> "*"<br>]</pre> | no |
88+
| <a name="input_settings"></a> [settings](#input\_settings) | Additional settings which will be passed to the Helm chart values, see https://artifacthub.io/packages/helm/cert-manager/cert-manager | `map(any)` | `{}` | no |
89+
| <a name="input_values"></a> [values](#input\_values) | Additional values for cert manager helm chart. Values will be merged, in order, as Helm does with multiple -f options | `string` | `""` | no |
8290

8391
## Outputs
8492

85-
No output.
93+
No outputs.
8694
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
8795

8896
## Contributing and reporting issues

‎examples/basic/README.md

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -11,23 +11,23 @@ No requirements.
1111

1212
| Name | Source | Version |
1313
|------|--------|---------|
14-
| cert-manager | ../../ | |
15-
| eks_cluster | cloudposse/eks-cluster/aws | |
16-
| eks_workers | cloudposse/eks-workers/aws | |
17-
| vpc | terraform-aws-modules/vpc/aws | |
14+
| <a name="module_cert-manager"></a> [cert-manager](#module\_cert-manager) | ../../ | n/a |
15+
| <a name="module_eks_cluster"></a> [eks\_cluster](#module\_eks\_cluster) | cloudposse/eks-cluster/aws | 0.43.2 |
16+
| <a name="module_eks_node_group"></a> [eks\_node\_group](#module\_eks\_node\_group) | cloudposse/eks-node-group/aws | 0.25.0 |
17+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | 3.6.0 |
1818

1919
## Resources
2020

21-
| Name |
22-
|------|
23-
| [aws_eks_cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) |
24-
| [aws_eks_cluster_auth](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) |
21+
| Name | Type |
22+
|------|------|
23+
| [aws_eks_cluster.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
24+
| [aws_eks_cluster_auth.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source |
2525

2626
## Inputs
2727

28-
No input.
28+
No inputs.
2929

3030
## Outputs
3131

32-
No output.
32+
No outputs.
3333
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/basic/main.tf

Lines changed: 17 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,37 @@
11
module "vpc" {
2-
source = "terraform-aws-modules/vpc/aws"
2+
source = "terraform-aws-modules/vpc/aws"
3+
version = "3.6.0"
34

4-
name = "cluster-autoscaler-vpc"
5+
name = "cert-manager-vpc"
56
cidr = "10.0.0.0/16"
67
azs = ["eu-central-1a", "eu-central-1b"]
78
public_subnets = ["10.0.101.0/24", "10.0.102.0/24"]
89
enable_nat_gateway = true
910
}
1011

1112
module "eks_cluster" {
12-
source = "cloudposse/eks-cluster/aws"
13+
source = "cloudposse/eks-cluster/aws"
14+
version = "0.43.2"
1315

1416
region = "eu-central-1"
1517
subnet_ids = module.vpc.public_subnets
1618
vpc_id = module.vpc.vpc_id
17-
name = "cluster-autoscaler"
18-
19-
workers_security_group_ids = [module.eks_workers.security_group_id]
20-
workers_role_arns = [module.eks_workers.workers_role_arn]
19+
name = "cert-manager"
2120
}
2221

23-
module "eks_workers" {
24-
source = "cloudposse/eks-workers/aws"
25-
26-
cluster_certificate_authority_data = module.eks_cluster.eks_cluster_certificate_authority_data
27-
cluster_endpoint = module.eks_cluster.eks_cluster_endpoint
28-
cluster_name = module.eks_cluster.eks_cluster_id
29-
cluster_security_group_id = module.eks_cluster.security_group_id
30-
instance_type = "t3.medium"
31-
max_size = 1
32-
min_size = 1
33-
subnet_ids = module.vpc.public_subnets
34-
vpc_id = module.vpc.vpc_id
35-
36-
associate_public_ip_address = true
22+
module "eks_node_group" {
23+
source = "cloudposse/eks-node-group/aws"
24+
version = "0.25.0"
25+
26+
cluster_name = "cert-manager"
27+
instance_types = ["t3.medium"]
28+
subnet_ids = module.vpc.public_subnets
29+
min_size = 1
30+
desired_size = 1
31+
max_size = 2
32+
depends_on = [module.eks_cluster.kubernetes_config_map_id]
3733
}
3834

39-
# Use the module:
40-
4135
module "cert-manager" {
4236
source = "../../"
4337

‎examples/basic/providers.tf

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,6 @@ data "aws_eks_cluster_auth" "this" {
1010
name = module.eks_cluster.eks_cluster_id
1111
}
1212

13-
provider "kubernetes" {
14-
host = data.aws_eks_cluster.this.endpoint
15-
cluster_ca_certificate = base64decode(data.aws_eks_cluster.this.certificate_authority.0.data)
16-
token = data.aws_eks_cluster_auth.this.token
17-
}
18-
1913
provider "helm" {
2014
kubernetes {
2115
host = data.aws_eks_cluster.this.endpoint

‎helm/defaultClusterIssuer/values.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,11 @@ route53:
55
enabled: true
66
name: "default"
77
acme:
8-
server: https://acme-staging-v02.api.letsencrypt.org/directory
9-
email: user@example.com
8+
server: https://acme-v02.api.letsencrypt.org/directory
9+
email: default@example.com
1010
privateKeySecretRef:
1111
name: cluster-issuer-secret
12-
region: "eu-west-1"
12+
region: "eu-central-1"
1313
#hostedZoneID: DIKER8JEXAMPLE # optional, see policy above
1414
#roleArn: arn:aws:iam::YYYYYYYYYYYY:role/dns-manager
1515
dnsZones:

‎iam.tf

Lines changed: 8 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,9 @@
1-
# aws.assumeRoleArn
2-
31
locals {
4-
assume_role = length(try(var.cluster_issuer_settings["route53.roleArn"], "")) > 0 ? true : false
2+
assume_role = length(var.k8s_assume_role_arn) > 0 ? true : false
53
}
64

7-
### iam ###
8-
# Policy
95
data "aws_iam_policy_document" "cert_manager" {
10-
count = var.enabled && !local.assume_role ? 1 : 0
6+
count = local.k8s_irsa_role_create && !local.assume_role ? 1 : 0
117

128
statement {
139
sid = "ChangeResourceRecordSets"
@@ -49,7 +45,7 @@ data "aws_iam_policy_document" "cert_manager" {
4945
}
5046

5147
data "aws_iam_policy_document" "cert_manager_assume" {
52-
count = var.enabled && local.assume_role ? 1 : 0
48+
count = local.k8s_irsa_role_create && local.assume_role ? 1 : 0
5349

5450
statement {
5551
sid = "AllowAssumeCertManagerRole"
@@ -61,27 +57,23 @@ data "aws_iam_policy_document" "cert_manager_assume" {
6157
]
6258

6359
resources = [
64-
var.cluster_issuer_settings["route53.roleArn"]
60+
var.k8s_assume_role_arn
6561
]
6662
}
6763
}
6864

69-
7065
resource "aws_iam_policy" "cert_manager" {
71-
count = var.enabled ? 1 : 0
66+
count = local.k8s_irsa_role_create ? 1 : 0
7267

7368
name = "${var.cluster_name}-cert-manager"
7469
path = "/"
7570
description = "Policy for cert-manager service"
7671

7772
policy = local.assume_role ? data.aws_iam_policy_document.cert_manager_assume[0].json : data.aws_iam_policy_document.cert_manager[0].json
78-
79-
depends_on = [var.mod_dependency]
8073
}
8174

82-
# Role
8375
data "aws_iam_policy_document" "cert_manager_irsa" {
84-
count = var.enabled ? 1 : 0
76+
count = local.k8s_irsa_role_create ? 1 : 0
8577

8678
statement {
8779
actions = ["sts:AssumeRoleWithWebIdentity"]
@@ -105,19 +97,15 @@ data "aws_iam_policy_document" "cert_manager_irsa" {
10597
}
10698

10799
resource "aws_iam_role" "cert_manager" {
108-
count = var.enabled ? 1 : 0
100+
count = local.k8s_irsa_role_create ? 1 : 0
109101

110102
name = "${var.cluster_name}-cert-manager"
111103
assume_role_policy = data.aws_iam_policy_document.cert_manager_irsa[0].json
112-
113-
depends_on = [var.mod_dependency]
114104
}
115105

116106
resource "aws_iam_role_policy_attachment" "cert_manager" {
117-
count = var.enabled ? 1 : 0
107+
count = local.k8s_irsa_role_create ? 1 : 0
118108

119109
role = aws_iam_role.cert_manager[0].name
120110
policy_arn = aws_iam_policy.cert_manager[0].arn
121-
122-
depends_on = [var.mod_dependency]
123111
}

0 commit comments

Comments
 (0)