Skip to content

Commit 30de94a

Browse files
bcarranzabcarranza
authored
Vpc upgrade version aws module (#456)
1 parent 5939067 commit 30de94a

File tree

5 files changed

+106
-79
lines changed

5 files changed

+106
-79
lines changed

‎terraform-modules/aws/cloudposse/aws-cloudtrail-cloudwatch-alarms/main.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ module "kms_cloudtrail" {
2121
}
2222

2323
module "cloudtrail_s3_bucket" {
24-
source = "github.com/ManagedKube/terraform-aws-cloudtrail-s3-bucket.git//?ref=0.24.0"
24+
source = "github.com/ManagedKube/terraform-aws-cloudtrail-s3-bucket.git//?ref=0.25.0"
2525
#version = "master"
2626
force_destroy = var.force_destroy
2727
versioning_enabled = var.versioning_enabled
@@ -107,4 +107,4 @@ module "cis_alarms" {
107107
version = "0.14.3"
108108
log_group_name = aws_cloudwatch_log_group.default.name
109109
metrics = module.metric_configs.map_configs
110-
}
110+
}

‎terraform-modules/aws/cluster-autoscaler/main.tf‎

Lines changed: 69 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -1,87 +1,81 @@
1-
module "iam_assumable_role_admin" {
2-
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
3-
version = "3.6.0"
4-
create_role = true
5-
role_name = "cluster-autoscaler-${var.cluster_name}"
6-
provider_url = replace(var.eks_cluster_oidc_issuer_url, "https://", "")
7-
role_policy_arns = [aws_iam_policy.cluster_autoscaler.arn]
8-
oidc_fully_qualified_subjects = ["system:serviceaccount:${var.k8s_service_account_namespace}:${var.k8s_service_account_name}"]
9-
}
1+
module "iam_assumable_role_admin" {
2+
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
3+
version = "5.33.0"
4+
create_role = true
5+
role_name = "cluster-autoscaler-${var.cluster_name}"
6+
provider_url = replace(var.eks_cluster_oidc_issuer_url, "https://", "")
7+
role_policy_arns = [aws_iam_policy.cluster_autoscaler.arn]
8+
oidc_fully_qualified_subjects = ["system:serviceaccount:${var.k8s_service_account_namespace}:${var.k8s_service_account_name}"]
9+
}
1010

11-
resource "aws_iam_policy" "cluster_autoscaler" {
12-
name_prefix = "cluster-autoscaler-${var.cluster_name}"
13-
description = "EKS cluster-autoscaler policy for cluster ${var.eks_cluster_id}"
14-
policy = data.aws_iam_policy_document.cluster_autoscaler.json
15-
}
11+
resource "aws_iam_policy" "cluster_autoscaler" {
12+
name_prefix = "cluster-autoscaler-${var.cluster_name}"
13+
description = "EKS cluster-autoscaler policy for cluster ${var.eks_cluster_id}"
14+
policy = data.aws_iam_policy_document.cluster_autoscaler.json
15+
}
1616

17-
data "aws_iam_policy_document" "cluster_autoscaler" {
18-
statement {
19-
sid = "clusterAutoscalerAll"
20-
effect = "Allow"
17+
data "aws_iam_policy_document" "cluster_autoscaler" {
18+
statement {
19+
sid = "clusterAutoscalerAll"
20+
effect = "Allow"
2121

22-
actions = [
23-
"autoscaling:DescribeAutoScalingGroups",
24-
"autoscaling:DescribeAutoScalingInstances",
25-
"autoscaling:DescribeLaunchConfigurations",
26-
"autoscaling:DescribeTags",
27-
"ec2:DescribeLaunchTemplateVersions",
28-
]
22+
actions = [
23+
"autoscaling:DescribeAutoScalingGroups",
24+
"autoscaling:DescribeAutoScalingInstances",
25+
"autoscaling:DescribeLaunchConfigurations",
26+
"autoscaling:DescribeTags",
27+
"ec2:DescribeLaunchTemplateVersions",
28+
]
2929

30-
resources = ["*"]
31-
}
30+
resources = ["*"]
31+
}
3232

33-
statement {
34-
sid = "clusterAutoscalerOwn"
35-
effect = "Allow"
33+
statement {
34+
sid = "clusterAutoscalerOwn"
35+
effect = "Allow"
3636

37-
actions = [
38-
"autoscaling:SetDesiredCapacity",
39-
"autoscaling:TerminateInstanceInAutoScalingGroup",
40-
"autoscaling:UpdateAutoScalingGroup",
41-
]
37+
actions = [
38+
"autoscaling:SetDesiredCapacity",
39+
"autoscaling:TerminateInstanceInAutoScalingGroup",
40+
"autoscaling:UpdateAutoScalingGroup",
41+
]
4242

43-
resources = ["*"]
43+
resources = ["*"]
4444

45-
condition {
46-
test = "StringEquals"
47-
variable = "autoscaling:ResourceTag/kubernetes.io/cluster/${var.eks_cluster_id}"
48-
values = ["owned"]
49-
}
45+
condition {
46+
test = "StringEquals"
47+
variable = "autoscaling:ResourceTag/kubernetes.io/cluster/${var.eks_cluster_id}"
48+
values = ["owned"]
49+
}
5050

51-
condition {
52-
test = "StringEquals"
53-
variable = "autoscaling:ResourceTag/k8s.io/cluster-autoscaler/enabled"
54-
values = ["true"]
55-
}
56-
}
57-
}
51+
condition {
52+
test = "StringEquals"
53+
variable = "autoscaling:ResourceTag/k8s.io/cluster-autoscaler/enabled"
54+
values = ["true"]
55+
}
56+
}
57+
}
5858

59-
data "aws_caller_identity" "current" {}
59+
data "aws_caller_identity" "current" {}
6060

61-
#
62-
# Helm - cluster-autoscaler
63-
#
64-
data "template_file" "helm_values" {
65-
template = file("${path.module}/helm_values.yaml.tpl")
66-
vars = {
67-
awsAccountID = data.aws_caller_identity.current.account_id
68-
awsRegion = var.aws_region
69-
clusterName = var.cluster_name
70-
serviceAccountName = var.k8s_service_account_name
71-
}
72-
}
61+
module "cluster-autoscaler" {
62+
source = "github.com/ManagedKube/kubernetes-ops//terraform-modules/aws/helm/helm_generic?ref=v1.0.9"
7363

74-
module "cluster-autoscaler" {
75-
source = "github.com/ManagedKube/kubernetes-ops//terraform-modules/aws/helm/helm_generic?ref=v1.0.9"
76-
77-
repository = "https://kubernetes.github.io/autoscaler"
78-
official_chart_name = "cluster-autoscaler"
79-
user_chart_name = "cluster-autoscaler"
80-
helm_version = var.cluster-autoscaler_helm_version
81-
namespace = "kube-system"
82-
helm_values = data.template_file.helm_values.rendered
83-
84-
depends_on = [
85-
module.iam_assumable_role_admin
86-
]
87-
}
64+
repository = "https://kubernetes.github.io/autoscaler"
65+
official_chart_name = "cluster-autoscaler"
66+
user_chart_name = "cluster-autoscaler"
67+
helm_version = var.cluster-autoscaler_helm_version
68+
namespace = "kube-system"
69+
helm_values = templatefile(
70+
"${path.module}/helm_values.yaml.tpl",
71+
{
72+
awsAccountID = data.aws_caller_identity.current.account_id
73+
awsRegion = var.aws_region
74+
clusterName = var.cluster_name
75+
serviceAccountName = var.k8s_service_account_name
76+
}
77+
)
78+
depends_on = [
79+
module.iam_assumable_role_admin
80+
]
81+
}

‎terraform-modules/aws/vpc/README.md‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ No providers.
1010

1111
| Name | Source | Version |
1212
|------|--------|---------|
13-
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | 3.2.0 |
13+
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | 5.0.0 |
1414

1515
## Resources
1616

@@ -23,13 +23,21 @@ No resources.
2323
| <a name="input_aws_region"></a> [aws\_region](#input\_aws\_region) | n/a | `string` | `"us-east-1"` | no |
2424
| <a name="input_azs"></a> [azs](#input\_azs) | n/a | `list(any)` | <pre>[<br> "us-east-1a",<br> "us-east-1b",<br> "us-east-1c"<br>]</pre> | no |
2525
| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | The cluster name for the Kubernetes tags on the subnets | `string` | `"none"` | no |
26+
| <a name="input_default_security_group_egress"></a> [default\_security\_group\_egress](#input\_default\_security\_group\_egress) | List of maps of egress rules to set on the default security group | `list(map(string))` | <pre>[<br> {<br> "cidr_blocks": "10.0.0.0/8",<br> "description": "rfc1918: Private Address Space",<br> "from_port": 0,<br> "protocol": "-1",<br> "self": false,<br> "to_port": 0<br> },<br> {<br> "cidr_blocks": "172.16.0.0/12",<br> "description": "rfc1918: Private Address Space",<br> "from_port": 0,<br> "protocol": "-1",<br> "self": false,<br> "to_port": 0<br> },<br> {<br> "cidr_blocks": "192.168.0.0/16",<br> "description": "rfc1918: Private Address Space",<br> "from_port": 0,<br> "protocol": "-1",<br> "self": false,<br> "to_port": 0<br> },<br> {<br> "cidr_blocks": "100.64.0.0/10",<br> "description": "rfc6598: Private Address Space",<br> "from_port": 0,<br> "protocol": "-1",<br> "self": false,<br> "to_port": 0<br> }<br>]</pre> | no |
27+
| <a name="input_default_security_group_ingress"></a> [default\_security\_group\_ingress](#input\_default\_security\_group\_ingress) | List of maps of ingress rules to set on the default security group | `list(map(string))` | <pre>[<br> {<br> "cidr_blocks": "10.0.0.0/8",<br> "description": "rfc1918: Private Address Space",<br> "from_port": 0,<br> "protocol": "-1",<br> "self": false,<br> "to_port": 0<br> },<br> {<br> "cidr_blocks": "172.16.0.0/12",<br> "description": "rfc1918: Private Address Space",<br> "from_port": 0,<br> "protocol": "-1",<br> "self": false,<br> "to_port": 0<br> },<br> {<br> "cidr_blocks": "192.168.0.0/16",<br> "description": "rfc1918: Private Address Space",<br> "from_port": 0,<br> "protocol": "-1",<br> "self": false,<br> "to_port": 0<br> },<br> {<br> "cidr_blocks": "100.64.0.0/10",<br> "description": "rfc6598: Private Address Space",<br> "from_port": 0,<br> "protocol": "-1",<br> "self": false,<br> "to_port": 0<br> }<br>]</pre> | no |
28+
| <a name="input_default_security_group_name"></a> [default\_security\_group\_name](#input\_default\_security\_group\_name) | Name to be used on the default security group | `string` | `"default"` | no |
29+
| <a name="input_default_security_group_tags"></a> [default\_security\_group\_tags](#input\_default\_security\_group\_tags) | Additional tags for the default security group | `map(any)` | `{}` | no |
2630
| <a name="input_enable_dns_hostnames"></a> [enable\_dns\_hostnames](#input\_enable\_dns\_hostnames) | Enable dns hostname resolution | `bool` | `true` | no |
2731
| <a name="input_enable_dns_support"></a> [enable\_dns\_support](#input\_enable\_dns\_support) | Enable dns support | `bool` | `true` | no |
2832
| <a name="input_enable_nat_gateway"></a> [enable\_nat\_gateway](#input\_enable\_nat\_gateway) | n/a | `bool` | `true` | no |
2933
| <a name="input_enable_vpn_gateway"></a> [enable\_vpn\_gateway](#input\_enable\_vpn\_gateway) | n/a | `bool` | `true` | no |
3034
| <a name="input_environment_name"></a> [environment\_name](#input\_environment\_name) | n/a | `any` | n/a | yes |
3135
| <a name="input_external_nat_ip_ids"></a> [external\_nat\_ip\_ids](#input\_external\_nat\_ip\_ids) | List of EIP IDs to be assigned to the NAT Gateways (used in combination with reuse\_nat\_ips) | `list(string)` | `[]` | no |
3236
| <a name="input_k8s_worker_subnets"></a> [k8s\_worker\_subnets](#input\_k8s\_worker\_subnets) | list of alternate secondary cidrs for kubernetes workers | `list(string)` | <pre>[<br> "100.64.0.0/20",<br> "100.64.16.0/20",<br> "100.64.32.0/20"<br>]</pre> | no |
37+
| <a name="input_manage_default_network_acl"></a> [manage\_default\_network\_acl](#input\_manage\_default\_network\_acl) | Should be true to adopt and manage Default Network ACL | `bool` | `true` | no |
38+
| <a name="input_manage_default_route_table"></a> [manage\_default\_route\_table](#input\_manage\_default\_route\_table) | Should be true to manage default route table | `bool` | `true` | no |
39+
| <a name="input_manage_default_security_group"></a> [manage\_default\_security\_group](#input\_manage\_default\_security\_group) | Should be true to adopt and manage default security group | `bool` | `true` | no |
40+
| <a name="input_map_public_ip_on_launch"></a> [map\_public\_ip\_on\_launch](#input\_map\_public\_ip\_on\_launch) | Specify true to indicate that instances launched into the subnet should be assigned a public IP address. Default is `false` | `bool` | `false` | no |
3341
| <a name="input_private_subnets"></a> [private\_subnets](#input\_private\_subnets) | n/a | `list(any)` | <pre>[<br> "10.0.1.0/24",<br> "10.0.2.0/24",<br> "10.0.3.0/24"<br>]</pre> | no |
3442
| <a name="input_public_subnets"></a> [public\_subnets](#input\_public\_subnets) | n/a | `list(any)` | <pre>[<br> "10.0.101.0/24",<br> "10.0.102.0/24",<br> "10.0.103.0/24"<br>]</pre> | no |
3543
| <a name="input_reuse_nat_ips"></a> [reuse\_nat\_ips](#input\_reuse\_nat\_ips) | Should be true if you don't want EIPs to be created for your NAT Gateways and will instead pass them in via the 'external\_nat\_ip\_ids' variable | `bool` | `false` | no |
@@ -42,7 +50,11 @@ No resources.
4250
| Name | Description |
4351
|------|-------------|
4452
| <a name="output_k8s_subnets"></a> [k8s\_subnets](#output\_k8s\_subnets) | A list of private k8s subnets |
53+
| <a name="output_private_route_table_ids"></a> [private\_route\_table\_ids](#output\_private\_route\_table\_ids) | A list of route table ids for private subnets |
4554
| <a name="output_private_subnets"></a> [private\_subnets](#output\_private\_subnets) | A list of private subnets |
55+
| <a name="output_public_route_table_ids"></a> [public\_route\_table\_ids](#output\_public\_route\_table\_ids) | A list of route table ids for public subnets |
4656
| <a name="output_public_subnets"></a> [public\_subnets](#output\_public\_subnets) | A list of public subnets |
4757
| <a name="output_vpc_cidr_block"></a> [vpc\_cidr\_block](#output\_vpc\_cidr\_block) | The CIDR block of the VPC |
4858
| <a name="output_vpc_id"></a> [vpc\_id](#output\_vpc\_id) | The ID of the VPC |
59+
| <a name="output_vpc_name"></a> [vpc\_name](#output\_vpc\_name) | name of vpc |
60+
| <a name="output_vpc_secondary_cidr_blocks"></a> [vpc\_secondary\_cidr\_blocks](#output\_vpc\_secondary\_cidr\_blocks) | List of secondary CIDR blocks of the VPC |

‎terraform-modules/aws/vpc/main.tf‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module "vpc" {
22
source = "terraform-aws-modules/vpc/aws"
3-
version = "3.7.0"
3+
version = "5.0.0"
44

55
name = var.environment_name
66
cidr = var.vpc_cidr
@@ -47,5 +47,9 @@ module "vpc" {
4747
default_security_group_egress = var.default_security_group_egress
4848
default_security_group_ingress = var.default_security_group_ingress
4949
default_security_group_tags = var.default_security_group_tags
50+
51+
map_public_ip_on_launch = var.map_public_ip_on_launch
52+
manage_default_network_acl = var.manage_default_network_acl
53+
manage_default_route_table = var.manage_default_route_table
5054

5155
}

‎terraform-modules/aws/vpc/variables.tf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,3 +172,20 @@ variable "default_security_group_tags" {
172172
default = {}
173173
}
174174

175+
variable "map_public_ip_on_launch" {
176+
description = "Specify true to indicate that instances launched into the subnet should be assigned a public IP address. Default is `false`"
177+
type = bool
178+
default = false
179+
}
180+
181+
variable "manage_default_network_acl" {
182+
description = "Should be true to adopt and manage Default Network ACL"
183+
type = bool
184+
default = true
185+
}
186+
187+
variable "manage_default_route_table" {
188+
description = "Should be true to manage default route table"
189+
type = bool
190+
default = true
191+
}

0 commit comments

Comments
 (0)