Skip to content

Commit 693af4e

Browse files
gtoonstragtoonstra
committed
fix: Prefix for forward reference of service accounts is wrong
1 parent fbecbcb commit 693af4e

File tree

5 files changed

+100
-70
lines changed

5 files changed

+100
-70
lines changed

‎main.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -206,6 +206,7 @@ module "eks" {
206206

207207
k8s_access_bedrock = var.k8s_access_bedrock
208208
clickhouse_backup_bucket_arn = local.clickhouse_backup_bucket_arn
209+
service_account_prefix = var.service_account_prefix
209210
}
210211

211212
locals {

‎modules/eks/main.tf‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ module "ebs_csi_irsa_role" {
66

77
name = "${var.deployment_name}-ebs-csi-controller"
88
attach_ebs_csi_policy = true
9+
use_name_prefix = false
910

1011
oidc_providers = {
1112
ex = {
@@ -21,6 +22,7 @@ module "k8s_load_balancer_controller_role" {
2122

2223
name = "${var.deployment_name}-lb-controller"
2324
attach_load_balancer_controller_policy = true
25+
use_name_prefix = false
2426

2527
oidc_providers = {
2628
ex = {
@@ -37,6 +39,7 @@ module "cluster_autoscaler_role" {
3739
name = "${var.deployment_name}-cluster-autoscaler"
3840
attach_cluster_autoscaler_policy = true
3941
cluster_autoscaler_cluster_names = [module.eks.cluster_name]
42+
use_name_prefix = false
4043

4144
oidc_providers = {
4245
ex = {
@@ -79,7 +82,7 @@ module "eks" {
7982
})
8083
},
8184
aws-ebs-csi-driver = {
82-
service_account_role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${var.deployment_name}-ebs-csi-controller"
85+
service_account_role_arn = module.ebs_csi_irsa_role.iam_role_arn
8386
most_recent = true
8487
before_compute = true
8588
configuration_values = jsonencode({

‎modules/eks/roles.tf‎

Lines changed: 83 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -64,208 +64,222 @@ resource "aws_iam_policy" "clickhouse_backup_policy" {
6464

6565
# dfshell
6666
module "dfshell_role" {
67-
count = 1
68-
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
69-
name = "${var.deployment_name}-${var.dfshell_service_account_name}"
70-
version = "6.2.1"
67+
count = 1
68+
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
69+
name = "${var.deployment_name}-${var.dfshell_service_account_name}"
70+
version = "6.2.1"
71+
use_name_prefix = false
7172

7273
oidc_providers = {
7374
ex = {
7475
provider_arn = module.eks.oidc_provider_arn
75-
namespace_service_accounts = ["${var.deployment_name}:${var.dfshell_service_account_name}"]
76+
namespace_service_accounts = ["${var.deployment_name}:${var.service_account_prefix}${var.dfshell_service_account_name}"]
7677
}
7778
}
7879
}
7980

8081
# worker_portal
8182
module "worker_portal_role" {
82-
count = 1
83-
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
84-
name = "${var.deployment_name}-${var.worker_portal_service_account_name}"
85-
version = "6.2.1"
83+
count = 1
84+
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
85+
name = "${var.deployment_name}-${var.worker_portal_service_account_name}"
86+
version = "6.2.1"
87+
use_name_prefix = false
8688

8789
oidc_providers = {
8890
ex = {
8991
provider_arn = module.eks.oidc_provider_arn
90-
namespace_service_accounts = ["${var.deployment_name}:${var.worker_portal_service_account_name}"]
92+
namespace_service_accounts = ["${var.deployment_name}:${var.service_account_prefix}${var.worker_portal_service_account_name}"]
9193
}
9294
}
9395
}
9496

9597
# operator
9698
module "operator_role" {
97-
count = 1
98-
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
99-
name = "${var.deployment_name}-${var.operator_service_account_name}"
100-
version = "6.2.1"
99+
count = 1
100+
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
101+
name = "${var.deployment_name}-${var.operator_service_account_name}"
102+
version = "6.2.1"
103+
use_name_prefix = false
101104

102105
oidc_providers = {
103106
ex = {
104107
provider_arn = module.eks.oidc_provider_arn
105-
namespace_service_accounts = ["${var.deployment_name}:${var.operator_service_account_name}"]
108+
namespace_service_accounts = ["${var.deployment_name}:${var.service_account_prefix}${var.operator_service_account_name}"]
106109
}
107110
}
108111
}
109112

110113
# server
111114
module "server_role" {
112-
count = 1
113-
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
114-
name = "${var.deployment_name}-${var.server_service_account_name}"
115-
version = "6.2.1"
115+
count = 1
116+
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
117+
name = "${var.deployment_name}-${var.server_service_account_name}"
118+
version = "6.2.1"
119+
use_name_prefix = false
116120

117121
oidc_providers = {
118122
ex = {
119123
provider_arn = module.eks.oidc_provider_arn
120-
namespace_service_accounts = ["${var.deployment_name}:${var.server_service_account_name}"]
124+
namespace_service_accounts = ["${var.deployment_name}:${var.service_account_prefix}${var.server_service_account_name}"]
121125
}
122126
}
123127
}
124128

125129
# scheduler
126130
module "scheduler_role" {
127-
count = 1
128-
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
129-
name = "${var.deployment_name}-${var.scheduler_service_account_name}"
130-
version = "6.2.1"
131+
count = 1
132+
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
133+
name = "${var.deployment_name}-${var.scheduler_service_account_name}"
134+
version = "6.2.1"
135+
use_name_prefix = false
131136

132137
oidc_providers = {
133138
ex = {
134139
provider_arn = module.eks.oidc_provider_arn
135-
namespace_service_accounts = ["${var.deployment_name}:${var.scheduler_service_account_name}"]
140+
namespace_service_accounts = ["${var.deployment_name}:${var.service_account_prefix}${var.scheduler_service_account_name}"]
136141
}
137142
}
138143
}
139144

140145
# worker
141146
module "worker_role" {
142-
count = 1
143-
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
144-
name = "${var.deployment_name}-${var.worker_service_account_name}"
145-
version = "6.2.1"
147+
count = 1
148+
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
149+
name = "${var.deployment_name}-${var.worker_service_account_name}"
150+
version = "6.2.1"
151+
use_name_prefix = false
146152

147153
oidc_providers = {
148154
ex = {
149155
provider_arn = module.eks.oidc_provider_arn
150-
namespace_service_accounts = ["${var.deployment_name}:${var.worker_service_account_name}"]
156+
namespace_service_accounts = ["${var.deployment_name}:${var.service_account_prefix}${var.worker_service_account_name}"]
151157
}
152158
}
153159
}
154160

155161
# worker_catalog
156162
module "worker_catalog_role" {
157-
count = 1
158-
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
159-
name = "${var.deployment_name}-${var.worker_catalog_service_account_name}"
160-
version = "6.2.1"
163+
count = 1
164+
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
165+
name = "${var.deployment_name}-${var.worker_catalog_service_account_name}"
166+
version = "6.2.1"
167+
use_name_prefix = false
161168

162169
oidc_providers = {
163170
ex = {
164171
provider_arn = module.eks.oidc_provider_arn
165-
namespace_service_accounts = ["${var.deployment_name}:${var.worker_catalog_service_account_name}"]
172+
namespace_service_accounts = ["${var.deployment_name}:${var.service_account_prefix}${var.worker_catalog_service_account_name}"]
166173
}
167174
}
168175
}
169176

170177
# worker_interactive
171178
module "worker_interactive_role" {
172-
count = 1
173-
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
174-
name = "${var.deployment_name}-${var.worker_interactive_service_account_name}"
175-
version = "6.2.1"
179+
count = 1
180+
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
181+
name = "${var.deployment_name}-${var.worker_interactive_service_account_name}"
182+
version = "6.2.1"
183+
use_name_prefix = false
176184

177185
oidc_providers = {
178186
ex = {
179187
provider_arn = module.eks.oidc_provider_arn
180-
namespace_service_accounts = ["${var.deployment_name}:${var.worker_interactive_service_account_name}"]
188+
namespace_service_accounts = ["${var.deployment_name}:${var.service_account_prefix}${var.worker_interactive_service_account_name}"]
181189
}
182190
}
183191
}
184192

185193
# worker_singletons
186194
module "worker_singletons_role" {
187-
count = 1
188-
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
189-
name = "${var.deployment_name}-${var.worker_singletons_service_account_name}"
190-
version = "6.2.1"
195+
count = 1
196+
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
197+
name = "${var.deployment_name}-${var.worker_singletons_service_account_name}"
198+
version = "6.2.1"
199+
use_name_prefix = false
191200

192201
oidc_providers = {
193202
ex = {
194203
provider_arn = module.eks.oidc_provider_arn
195-
namespace_service_accounts = ["${var.deployment_name}:${var.worker_singletons_service_account_name}"]
204+
namespace_service_accounts = ["${var.deployment_name}:${var.service_account_prefix}${var.worker_singletons_service_account_name}"]
196205
}
197206
}
198207
}
199208

200209
# worker_lineage
201210
module "worker_lineage_role" {
202-
count = 1
203-
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
204-
name = "${var.deployment_name}-${var.worker_lineage_service_account_name}"
205-
version = "6.2.1"
211+
count = 1
212+
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
213+
name = "${var.deployment_name}-${var.worker_lineage_service_account_name}"
214+
version = "6.2.1"
215+
use_name_prefix = false
206216

207217
oidc_providers = {
208218
ex = {
209219
provider_arn = module.eks.oidc_provider_arn
210-
namespace_service_accounts = ["${var.deployment_name}:${var.worker_lineage_service_account_name}"]
220+
namespace_service_accounts = ["${var.deployment_name}:${var.service_account_prefix}${var.worker_lineage_service_account_name}"]
211221
}
212222
}
213223
}
214224

215225
# worker_monitor
216226
module "worker_monitor_role" {
217-
count = 1
218-
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
219-
name = "${var.deployment_name}-${var.worker_monitor_service_account_name}"
220-
version = "6.2.1"
227+
count = 1
228+
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
229+
name = "${var.deployment_name}-${var.worker_monitor_service_account_name}"
230+
version = "6.2.1"
231+
use_name_prefix = false
221232

222233
oidc_providers = {
223234
ex = {
224235
provider_arn = module.eks.oidc_provider_arn
225-
namespace_service_accounts = ["${var.deployment_name}:${var.worker_monitor_service_account_name}"]
236+
namespace_service_accounts = ["${var.deployment_name}:${var.service_account_prefix}${var.worker_monitor_service_account_name}"]
226237
}
227238
}
228239
}
229240

230241
# storage_worker
231242
module "storage_worker_role" {
232-
count = 1
233-
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
234-
name = "${var.deployment_name}-${var.storage_worker_service_account_name}"
235-
version = "6.2.1"
243+
count = 1
244+
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
245+
name = "${var.deployment_name}-${var.storage_worker_service_account_name}"
246+
version = "6.2.1"
247+
use_name_prefix = false
236248

237249
oidc_providers = {
238250
ex = {
239251
provider_arn = module.eks.oidc_provider_arn
240-
namespace_service_accounts = ["${var.deployment_name}:${var.storage_worker_service_account_name}"]
252+
namespace_service_accounts = ["${var.deployment_name}:${var.service_account_prefix}${var.storage_worker_service_account_name}"]
241253
}
242254
}
243255
}
244256

245257
module "clickhouse_backup_role" {
246-
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
247-
name = "${var.deployment_name}-${var.clickhouse_backup_service_account_name}"
248-
version = "6.2.1"
258+
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
259+
name = "${var.deployment_name}-${var.clickhouse_backup_service_account_name}"
260+
version = "6.2.1"
261+
use_name_prefix = false
249262

250263
oidc_providers = {
251264
ex = {
252265
provider_arn = module.eks.oidc_provider_arn
253-
namespace_service_accounts = ["${var.deployment_name}:${var.clickhouse_backup_service_account_name}"]
266+
namespace_service_accounts = ["${var.deployment_name}:${var.service_account_prefix}${var.clickhouse_backup_service_account_name}"]
254267
}
255268
}
256269
}
257270

258271
# storage_worker
259272
module "dma_role" {
260-
count = 1
261-
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
262-
name = "${var.deployment_name}-${var.dma_service_account_name}"
263-
version = "6.2.1"
273+
count = 1
274+
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts"
275+
name = "${var.deployment_name}-${var.dma_service_account_name}"
276+
version = "6.2.1"
277+
use_name_prefix = false
264278

265279
oidc_providers = {
266280
ex = {
267281
provider_arn = module.eks.oidc_provider_arn
268-
namespace_service_accounts = ["${var.deployment_name}:${var.dma_service_account_name}"]
282+
namespace_service_accounts = ["${var.deployment_name}:${var.service_account_prefix}${var.dma_service_account_name}"]
269283
}
270284
}
271285
}

‎modules/eks/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,12 @@ variable "sg_tags" {
107107
default = {}
108108
}
109109

110+
variable "service_account_prefix" {
111+
type = string
112+
default = "datafold-"
113+
description = "Prefix for service account names (e.g., 'datafold-' for 'datafold-server', or '' for no prefix)"
114+
}
115+
110116
variable "clickhouse_backup_service_account_name" {
111117
type = string
112118
default = "clickhouse"

‎variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -771,6 +771,12 @@ variable "k8s_access_bedrock" {
771771
description = "Allow cluster to access bedrock in this region"
772772
}
773773

774+
variable "service_account_prefix" {
775+
type = string
776+
default = "datafold-"
777+
description = "Prefix for service account names to match Helm chart naming (e.g., 'datafold-' for 'datafold-server', or '' for no prefix)"
778+
}
779+
774780
# ┏━╸╻╺┳╸╻ ╻╻ ╻┏┓ ┏━┓┏━╸╻ ╻┏━╸┏━┓┏━┓┏━╸ ┏━┓┏━┓┏━┓╻ ╻╻ ╻
775781
# ┃╺┓┃ ┃ ┣━┫┃ ┃┣┻┓ ┣┳┛┣╸ ┃┏┛┣╸ ┣┳┛┗━┓┣╸ ┣━┛┣┳┛┃ ┃┏╋┛┗┳┛
776782
# ┗━┛╹ ╹ ╹ ╹┗━┛┗━┛ ╹┗╸┗━╸┗┛ ┗━╸╹┗╸┗━┛┗━╸ ╹ ╹┗╸┗━┛╹ ╹ ╹

0 commit comments

Comments
 (0)