Skip to content

Commit cea633b

Browse files
goruhagoruha
committed
Initial commit
1 parent 03dfe13 commit cea633b

File tree

11 files changed

+946
-62
lines changed

11 files changed

+946
-62
lines changed

‎.github/settings.yml‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,7 @@
11
# Upstream changes from _extends are only recognized when modifications are made to this file in the default branch.
22
_extends: .github
33
repository:
4-
name: template
5-
description: Template for Terraform Components
4+
name: aws-eks-alb-controller-controller
5+
description: This component creates a Helm release for [alb-controller](https://github
66
homepage: https://cloudposse.com/accelerate
77
topics: terraform, terraform-component
8-
9-
10-
11-

‎CHANGELOG.md‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
## Release 1.466.0
2+
3+
PR [#1070](https://github.com/cloudposse/terraform-aws-components/pull/1070)
4+
5+
Change default for `default_ingress_ip_address_type` from `dualstack` to `ipv4`. When `dualstack` is configured, the
6+
Ingress will fail if the VPC does not have an IPv6 CIDR block, which is still a common case. When `ipv4` is configured,
7+
the Ingress will work with only an IPv4 CIDR block, and simply will not use IPv6 if it exists. This makes `ipv4` the
8+
more conservative default.
9+
10+
## Release 1.432.0
11+
12+
Better support for Kubeconfig authentication
13+
14+
## Release 1.289.1
15+
16+
PR [#821](https://github.com/cloudposse/terraform-aws-components/pull/821)
17+
18+
### Update IAM Policy and Change How it is Managed
19+
20+
The ALB controller needs a lot of permissions and has a complex IAM policy. For this reason, the project releases a
21+
complete JSON policy document that is updated as needed.
22+
23+
In this release:
24+
25+
1. We have updated the policy to the one distributed with version 2.6.0 of the ALB controller. This fixes an issue where
26+
the controller was not able to create the service-linked role for the Elastic Load Balancing service.
27+
2. To ease maintenance, we have moved the policy document to a separate file, `distributed-iam-policy.tf` and made it
28+
easy to update or override.
29+
30+
#### Gov Cloud and China Regions
31+
32+
Actually, the project releases 3 policy documents, one for each of the three AWS partitions: `aws`, `aws-cn`, and
33+
`aws-us-gov`. For simplicity, this module only uses the `aws` partition policy. If you are in another partition, you can
34+
create a `distributed-iam-policy_override.tf` file in your directory and override the
35+
`overridable_distributed_iam_policy` local variable with the policy document for your partition.

‎README.yaml‎

Lines changed: 177 additions & 49 deletions
Large diffs are not rendered by default.

‎src/distributed-iam-policy.tf‎

Lines changed: 264 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,264 @@
1+
2+
# The kubernetes-sigs/aws-load-balancer-controller/ project distributes the
3+
# AWS IAM policy that is required for the AWS Load Balancer Controller as a JSON
4+
# download at https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v<VERSION>/docs/install/iam_policy.json
5+
# See https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.6/deploy/installation/#option-a-recommended-iam-roles-for-service-accounts-irsa for details.
6+
7+
# We could directly use the URL to download and install the policy at runtime,
8+
# via the cloudposse/helm-release/aws module's ` iam_source_json_url` input,
9+
# but that lacks transparency and auditability. It also does not give us a chance
10+
# to make changes in response to bugs, such as
11+
# https://github.com/kubernetes-sigs/aws-load-balancer-controller/issues/2692#issuecomment-1426242236
12+
#
13+
# So we download the policy and insert it here as a local variable.
14+
15+
locals {
16+
# To update, just replace everything between the two "EOT"s with the contents of the downloaded JSON file.
17+
# Below is the policy as of version 2.6.0, downloaded from
18+
# https://raw.githubusercontent.com/kubernetes-sigs/aws-load-balancer-controller/v2.6.0/docs/install/iam_policy.json
19+
# This policy is for the `aws` partition. Override overridable_distributed_iam_policy for other partitions.
20+
overridable_distributed_iam_policy = <<EOT
21+
{
22+
"Version": "2012-10-17",
23+
"Statement": [
24+
{
25+
"Effect": "Allow",
26+
"Action": [
27+
"iam:CreateServiceLinkedRole"
28+
],
29+
"Resource": "*",
30+
"Condition": {
31+
"StringEquals": {
32+
"iam:AWSServiceName": "elasticloadbalancing.amazonaws.com"
33+
}
34+
}
35+
},
36+
{
37+
"Effect": "Allow",
38+
"Action": [
39+
"ec2:DescribeAccountAttributes",
40+
"ec2:DescribeAddresses",
41+
"ec2:DescribeAvailabilityZones",
42+
"ec2:DescribeInternetGateways",
43+
"ec2:DescribeVpcs",
44+
"ec2:DescribeVpcPeeringConnections",
45+
"ec2:DescribeSubnets",
46+
"ec2:DescribeSecurityGroups",
47+
"ec2:DescribeInstances",
48+
"ec2:DescribeNetworkInterfaces",
49+
"ec2:DescribeTags",
50+
"ec2:GetCoipPoolUsage",
51+
"ec2:DescribeCoipPools",
52+
"elasticloadbalancing:DescribeLoadBalancers",
53+
"elasticloadbalancing:DescribeLoadBalancerAttributes",
54+
"elasticloadbalancing:DescribeListeners",
55+
"elasticloadbalancing:DescribeListenerCertificates",
56+
"elasticloadbalancing:DescribeSSLPolicies",
57+
"elasticloadbalancing:DescribeRules",
58+
"elasticloadbalancing:DescribeTargetGroups",
59+
"elasticloadbalancing:DescribeTargetGroupAttributes",
60+
"elasticloadbalancing:DescribeTargetHealth",
61+
"elasticloadbalancing:DescribeTags",
62+
"elasticloadbalancing:DescribeTrustStores"
63+
],
64+
"Resource": "*"
65+
},
66+
{
67+
"Effect": "Allow",
68+
"Action": [
69+
"cognito-idp:DescribeUserPoolClient",
70+
"acm:ListCertificates",
71+
"acm:DescribeCertificate",
72+
"iam:ListServerCertificates",
73+
"iam:GetServerCertificate",
74+
"waf-regional:GetWebACL",
75+
"waf-regional:GetWebACLForResource",
76+
"waf-regional:AssociateWebACL",
77+
"waf-regional:DisassociateWebACL",
78+
"wafv2:GetWebACL",
79+
"wafv2:GetWebACLForResource",
80+
"wafv2:AssociateWebACL",
81+
"wafv2:DisassociateWebACL",
82+
"shield:GetSubscriptionState",
83+
"shield:DescribeProtection",
84+
"shield:CreateProtection",
85+
"shield:DeleteProtection"
86+
],
87+
"Resource": "*"
88+
},
89+
{
90+
"Effect": "Allow",
91+
"Action": [
92+
"ec2:AuthorizeSecurityGroupIngress",
93+
"ec2:RevokeSecurityGroupIngress"
94+
],
95+
"Resource": "*"
96+
},
97+
{
98+
"Effect": "Allow",
99+
"Action": [
100+
"ec2:CreateSecurityGroup"
101+
],
102+
"Resource": "*"
103+
},
104+
{
105+
"Effect": "Allow",
106+
"Action": [
107+
"ec2:CreateTags"
108+
],
109+
"Resource": "arn:aws:ec2:*:*:security-group/*",
110+
"Condition": {
111+
"StringEquals": {
112+
"ec2:CreateAction": "CreateSecurityGroup"
113+
},
114+
"Null": {
115+
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
116+
}
117+
}
118+
},
119+
{
120+
"Effect": "Allow",
121+
"Action": [
122+
"ec2:CreateTags",
123+
"ec2:DeleteTags"
124+
],
125+
"Resource": "arn:aws:ec2:*:*:security-group/*",
126+
"Condition": {
127+
"Null": {
128+
"aws:RequestTag/elbv2.k8s.aws/cluster": "true",
129+
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
130+
}
131+
}
132+
},
133+
{
134+
"Effect": "Allow",
135+
"Action": [
136+
"ec2:AuthorizeSecurityGroupIngress",
137+
"ec2:RevokeSecurityGroupIngress",
138+
"ec2:DeleteSecurityGroup"
139+
],
140+
"Resource": "*",
141+
"Condition": {
142+
"Null": {
143+
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
144+
}
145+
}
146+
},
147+
{
148+
"Effect": "Allow",
149+
"Action": [
150+
"elasticloadbalancing:CreateLoadBalancer",
151+
"elasticloadbalancing:CreateTargetGroup"
152+
],
153+
"Resource": "*",
154+
"Condition": {
155+
"Null": {
156+
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
157+
}
158+
}
159+
},
160+
{
161+
"Effect": "Allow",
162+
"Action": [
163+
"elasticloadbalancing:CreateListener",
164+
"elasticloadbalancing:DeleteListener",
165+
"elasticloadbalancing:CreateRule",
166+
"elasticloadbalancing:DeleteRule"
167+
],
168+
"Resource": "*"
169+
},
170+
{
171+
"Effect": "Allow",
172+
"Action": [
173+
"elasticloadbalancing:AddTags",
174+
"elasticloadbalancing:RemoveTags"
175+
],
176+
"Resource": [
177+
"arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
178+
"arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
179+
"arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
180+
],
181+
"Condition": {
182+
"Null": {
183+
"aws:RequestTag/elbv2.k8s.aws/cluster": "true",
184+
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
185+
}
186+
}
187+
},
188+
{
189+
"Effect": "Allow",
190+
"Action": [
191+
"elasticloadbalancing:AddTags",
192+
"elasticloadbalancing:RemoveTags"
193+
],
194+
"Resource": [
195+
"arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*",
196+
"arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*",
197+
"arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
198+
"arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*"
199+
]
200+
},
201+
{
202+
"Effect": "Allow",
203+
"Action": [
204+
"elasticloadbalancing:ModifyLoadBalancerAttributes",
205+
"elasticloadbalancing:SetIpAddressType",
206+
"elasticloadbalancing:SetSecurityGroups",
207+
"elasticloadbalancing:SetSubnets",
208+
"elasticloadbalancing:DeleteLoadBalancer",
209+
"elasticloadbalancing:ModifyTargetGroup",
210+
"elasticloadbalancing:ModifyTargetGroupAttributes",
211+
"elasticloadbalancing:DeleteTargetGroup"
212+
],
213+
"Resource": "*",
214+
"Condition": {
215+
"Null": {
216+
"aws:ResourceTag/elbv2.k8s.aws/cluster": "false"
217+
}
218+
}
219+
},
220+
{
221+
"Effect": "Allow",
222+
"Action": [
223+
"elasticloadbalancing:AddTags"
224+
],
225+
"Resource": [
226+
"arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
227+
"arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
228+
"arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
229+
],
230+
"Condition": {
231+
"StringEquals": {
232+
"elasticloadbalancing:CreateAction": [
233+
"CreateTargetGroup",
234+
"CreateLoadBalancer"
235+
]
236+
},
237+
"Null": {
238+
"aws:RequestTag/elbv2.k8s.aws/cluster": "false"
239+
}
240+
}
241+
},
242+
{
243+
"Effect": "Allow",
244+
"Action": [
245+
"elasticloadbalancing:RegisterTargets",
246+
"elasticloadbalancing:DeregisterTargets"
247+
],
248+
"Resource": "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"
249+
},
250+
{
251+
"Effect": "Allow",
252+
"Action": [
253+
"elasticloadbalancing:SetWebAcl",
254+
"elasticloadbalancing:ModifyListener",
255+
"elasticloadbalancing:AddListenerCertificates",
256+
"elasticloadbalancing:RemoveListenerCertificates",
257+
"elasticloadbalancing:ModifyRule"
258+
],
259+
"Resource": "*"
260+
}
261+
]
262+
}
263+
EOT
264+
}

‎src/main.tf‎

Lines changed: 64 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,69 @@
1-
locals {
2-
enabled = module.this.enabled
3-
}
1+
module "alb_controller" {
2+
source = "cloudposse/helm-release/aws"
3+
version = "0.10.0"
4+
5+
chart = var.chart
6+
repository = var.chart_repository
7+
description = var.chart_description
8+
chart_version = var.chart_version
9+
wait = true # required for installing IngressClassParams
10+
atomic = var.atomic
11+
cleanup_on_fail = var.cleanup_on_fail
12+
timeout = var.timeout
413

14+
create_namespace_with_kubernetes = var.create_namespace
15+
kubernetes_namespace = var.kubernetes_namespace
16+
kubernetes_namespace_labels = merge(module.this.tags, { name = var.kubernetes_namespace })
517

18+
eks_cluster_oidc_issuer_url = replace(module.eks.outputs.eks_cluster_identity_oidc_issuer, "https://", "")
619

20+
service_account_name = module.this.name
21+
service_account_namespace = var.kubernetes_namespace
722

23+
iam_role_enabled = true
24+
# See distributed-iam-policy.tf
25+
iam_source_policy_documents = [local.overridable_distributed_iam_policy]
826

27+
values = compact([
28+
# standard k8s object settings
29+
yamlencode({
30+
fullnameOverride = module.this.name,
31+
serviceAccount = {
32+
name = module.this.name
33+
},
34+
resources = var.resources
35+
rbac = {
36+
create = var.rbac_enabled
37+
}
38+
}),
39+
# alb-controller-specific values
40+
yamlencode({
41+
region = var.region
42+
vpcId = module.vpc.outputs.vpc_id
43+
clusterName = module.eks.outputs.eks_cluster_id
44+
createIngressClassResource = var.default_ingress_enabled
45+
ingressClass = var.default_ingress_class_name
46+
ingressClassParams = {
47+
name = var.default_ingress_class_name
48+
create = var.default_ingress_enabled
49+
spec = {
50+
group = {
51+
name = var.default_ingress_group
52+
}
53+
scheme = var.default_ingress_scheme
54+
ipAddressType = var.default_ingress_ip_address_type
55+
tags = [for k, v in merge(module.this.tags, var.default_ingress_additional_tags) : { key = k, value = v }]
56+
loadBalancerAttributes = var.default_ingress_load_balancer_attributes
57+
}
58+
}
59+
ingressClassConfig = {
60+
default = var.default_ingress_enabled
61+
}
62+
defaultTags = module.this.tags
63+
}),
64+
# additional values
65+
yamlencode(var.chart_values)
66+
])
67+
68+
context = module.this.context
69+
}

‎src/outputs.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
output "mock" {
2-
description = "Mock output example for the Cloud Posse Terraform component template"
3-
value = local.enabled ? "hello ${basename(abspath(path.module))}" : ""
1+
output "metadata" {
2+
value = module.alb_controller.metadata
3+
description = "Block status of the deployed release"
44
}

0 commit comments

Comments
 (0)