Skip to content

Commit 87e5657

Browse files
mglotovmglotov
authored
enh: do not use terraform modules for deploying aws-load-balancer-controller (#160)
1 parent f650386 commit 87e5657

File tree

8 files changed

+244
-358
lines changed

8 files changed

+244
-358
lines changed

‎terraform/layer2-k8s/eks-aws-loadbalancer-controller.tf‎

Lines changed: 241 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,246 @@
1+
locals {
2+
aws-load-balancer-controller = {
3+
chart = local.helm_charts[index(local.helm_charts.*.id, "aws-load-balancer-controller")].chart
4+
repository = lookup(local.helm_charts[index(local.helm_charts.*.id, "aws-load-balancer-controller")], "repository", null)
5+
chart_version = lookup(local.helm_charts[index(local.helm_charts.*.id, "aws-load-balancer-controller")], "version", null)
6+
}
7+
alb_ingress_controller = templatefile("${path.module}/templates/alb-ingress-controller-values.yaml",
8+
{
9+
role_arn = var.aws_loadbalancer_controller_enable ? module.aws_iam_aws_loadbalancer_controller[0].role_arn : "",
10+
region = local.region,
11+
cluster_name = local.eks_cluster_id,
12+
vpc_id = local.vpc_id
13+
})
14+
}
15+
16+
resource "helm_release" "aws_loadbalancer_controller" {
17+
count = var.aws_loadbalancer_controller_enable ? 1 : 0
18+
19+
name = "aws-load-balancer-controller"
20+
chart = local.aws-load-balancer-controller.chart
21+
repository = local.aws-load-balancer-controller.repository
22+
version = local.aws-load-balancer-controller.chart_version
23+
namespace = module.ing_namespace.name
24+
max_history = var.helm_release_history_size
25+
26+
values = [
27+
local.alb_ingress_controller
28+
]
29+
}
30+
131
#tfsec:ignore:aws-iam-no-policy-wildcards
2-
module "eks_alb_ingress" {
3-
source = "../modules/eks-aws-loadbalancer-controller"
4-
count = var.aws_loadbalancer_controller_enable ? 1 : 0
32+
module "aws_iam_aws_loadbalancer_controller" {
33+
count = var.aws_loadbalancer_controller_enable ? 1 : 0
534

6-
name = local.name
35+
source = "../modules/aws-iam-eks-trusted"
36+
name = "${local.name}-alb-ingress"
737
region = local.region
838
oidc_provider_arn = local.eks_oidc_provider_arn
9-
eks_cluster_id = local.eks_cluster_id
10-
vpc_id = local.vpc_id
11-
namespace = module.ing_namespace.name
39+
policy = jsonencode({
40+
"Version" : "2012-10-17",
41+
"Statement" : [
42+
{
43+
"Effect" : "Allow",
44+
"Action" : [
45+
"iam:CreateServiceLinkedRole",
46+
"ec2:DescribeAccountAttributes",
47+
"ec2:DescribeAddresses",
48+
"ec2:DescribeAvailabilityZones",
49+
"ec2:DescribeInternetGateways",
50+
"ec2:DescribeVpcs",
51+
"ec2:DescribeSubnets",
52+
"ec2:DescribeSecurityGroups",
53+
"ec2:DescribeInstances",
54+
"ec2:DescribeNetworkInterfaces",
55+
"ec2:DescribeTags",
56+
"ec2:GetCoipPoolUsage",
57+
"ec2:DescribeCoipPools",
58+
"elasticloadbalancing:DescribeLoadBalancers",
59+
"elasticloadbalancing:DescribeLoadBalancerAttributes",
60+
"elasticloadbalancing:DescribeListeners",
61+
"elasticloadbalancing:DescribeListenerCertificates",
62+
"elasticloadbalancing:DescribeSSLPolicies",
63+
"elasticloadbalancing:DescribeRules",
64+
"elasticloadbalancing:DescribeTargetGroups",
65+
"elasticloadbalancing:DescribeTargetGroupAttributes",
66+
"elasticloadbalancing:DescribeTargetHealth",
67+
"elasticloadbalancing:DescribeTags"
68+
],
69+
"Resource" : "*"
70+
},
71+
{
72+
"Effect" : "Allow",
73+
"Action" : [
74+
"cognito-idp:DescribeUserPoolClient",
75+
"acm:ListCertificates",
76+
"acm:DescribeCertificate",
77+
"iam:ListServerCertificates",
78+
"iam:GetServerCertificate",
79+
"waf-regional:GetWebACL",
80+
"waf-regional:GetWebACLForResource",
81+
"waf-regional:AssociateWebACL",
82+
"waf-regional:DisassociateWebACL",
83+
"wafv2:GetWebACL",
84+
"wafv2:GetWebACLForResource",
85+
"wafv2:AssociateWebACL",
86+
"wafv2:DisassociateWebACL",
87+
"shield:GetSubscriptionState",
88+
"shield:DescribeProtection",
89+
"shield:CreateProtection",
90+
"shield:DeleteProtection"
91+
],
92+
"Resource" : "*"
93+
},
94+
{
95+
"Effect" : "Allow",
96+
"Action" : [
97+
"ec2:AuthorizeSecurityGroupIngress",
98+
"ec2:RevokeSecurityGroupIngress"
99+
],
100+
"Resource" : "*"
101+
},
102+
{
103+
"Effect" : "Allow",
104+
"Action" : [
105+
"ec2:CreateSecurityGroup"
106+
],
107+
"Resource" : "*"
108+
},
109+
{
110+
"Effect" : "Allow",
111+
"Action" : [
112+
"ec2:CreateTags"
113+
],
114+
"Resource" : "arn:aws:ec2:*:*:security-group/*",
115+
"Condition" : {
116+
"StringEquals" : {
117+
"ec2:CreateAction" : "CreateSecurityGroup"
118+
},
119+
"Null" : {
120+
"aws:RequestTag/elbv2.k8s.aws/cluster" : "false"
121+
}
122+
}
123+
},
124+
{
125+
"Effect" : "Allow",
126+
"Action" : [
127+
"ec2:CreateTags",
128+
"ec2:DeleteTags"
129+
],
130+
"Resource" : "arn:aws:ec2:*:*:security-group/*",
131+
"Condition" : {
132+
"Null" : {
133+
"aws:RequestTag/elbv2.k8s.aws/cluster" : "true",
134+
"aws:ResourceTag/elbv2.k8s.aws/cluster" : "false"
135+
}
136+
}
137+
},
138+
{
139+
"Effect" : "Allow",
140+
"Action" : [
141+
"ec2:AuthorizeSecurityGroupIngress",
142+
"ec2:RevokeSecurityGroupIngress",
143+
"ec2:DeleteSecurityGroup"
144+
],
145+
"Resource" : "*",
146+
"Condition" : {
147+
"Null" : {
148+
"aws:ResourceTag/elbv2.k8s.aws/cluster" : "false"
149+
}
150+
}
151+
},
152+
{
153+
"Effect" : "Allow",
154+
"Action" : [
155+
"elasticloadbalancing:CreateLoadBalancer",
156+
"elasticloadbalancing:CreateTargetGroup"
157+
],
158+
"Resource" : "*",
159+
"Condition" : {
160+
"Null" : {
161+
"aws:RequestTag/elbv2.k8s.aws/cluster" : "false"
162+
}
163+
}
164+
},
165+
{
166+
"Effect" : "Allow",
167+
"Action" : [
168+
"elasticloadbalancing:CreateListener",
169+
"elasticloadbalancing:DeleteListener",
170+
"elasticloadbalancing:CreateRule",
171+
"elasticloadbalancing:DeleteRule"
172+
],
173+
"Resource" : "*"
174+
},
175+
{
176+
"Effect" : "Allow",
177+
"Action" : [
178+
"elasticloadbalancing:AddTags",
179+
"elasticloadbalancing:RemoveTags"
180+
],
181+
"Resource" : [
182+
"arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
183+
"arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
184+
"arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*"
185+
],
186+
"Condition" : {
187+
"Null" : {
188+
"aws:RequestTag/elbv2.k8s.aws/cluster" : "true",
189+
"aws:ResourceTag/elbv2.k8s.aws/cluster" : "false"
190+
}
191+
}
192+
},
193+
{
194+
"Effect" : "Allow",
195+
"Action" : [
196+
"elasticloadbalancing:AddTags",
197+
"elasticloadbalancing:RemoveTags"
198+
],
199+
"Resource" : [
200+
"arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*",
201+
"arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*",
202+
"arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
203+
"arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*"
204+
]
205+
},
206+
{
207+
"Effect" : "Allow",
208+
"Action" : [
209+
"elasticloadbalancing:ModifyLoadBalancerAttributes",
210+
"elasticloadbalancing:SetIpAddressType",
211+
"elasticloadbalancing:SetSecurityGroups",
212+
"elasticloadbalancing:SetSubnets",
213+
"elasticloadbalancing:DeleteLoadBalancer",
214+
"elasticloadbalancing:ModifyTargetGroup",
215+
"elasticloadbalancing:ModifyTargetGroupAttributes",
216+
"elasticloadbalancing:DeleteTargetGroup"
217+
],
218+
"Resource" : "*",
219+
"Condition" : {
220+
"Null" : {
221+
"aws:ResourceTag/elbv2.k8s.aws/cluster" : "false"
222+
}
223+
}
224+
},
225+
{
226+
"Effect" : "Allow",
227+
"Action" : [
228+
"elasticloadbalancing:RegisterTargets",
229+
"elasticloadbalancing:DeregisterTargets"
230+
],
231+
"Resource" : "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*"
232+
},
233+
{
234+
"Effect" : "Allow",
235+
"Action" : [
236+
"elasticloadbalancing:SetWebAcl",
237+
"elasticloadbalancing:ModifyListener",
238+
"elasticloadbalancing:AddListenerCertificates",
239+
"elasticloadbalancing:RemoveListenerCertificates",
240+
"elasticloadbalancing:ModifyRule"
241+
],
242+
"Resource" : "*"
243+
}
244+
]
245+
})
12246
}

‎terraform/layer2-k8s/helm-charts.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
charts:
2-
- id: aws-loadbalancer-controller
3-
chart: aws-loadbalancer-controller
2+
- id: aws-load-balancer-controller
3+
chart: aws-load-balancer-controller
44
repository: https://aws.github.io/eks-charts
55
version: 1.2.6
66
- id: aws-node-termination-handler

‎terraform/modules/eks-aws-loadbalancer-controller/templates/alb-ingress-controller-values.yaml‎ renamed to ‎terraform/layer2-k8s/templates/alb-ingress-controller-values.yaml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
replicaCount: ${replica_count}
2-
31
clusterName: ${cluster_name}
42

53
region: ${region}
@@ -10,9 +8,6 @@ serviceAccount:
108
annotations:
119
"eks.amazonaws.com/role-arn": ${role_arn}
1210

13-
image:
14-
tag: ${image_tag}
15-
1611
affinity:
1712
nodeAffinity:
1813
requiredDuringSchedulingIgnoredDuringExecution:

‎terraform/layer2-k8s/variables.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ variable "nginx_ingress_ssl_terminator" {
4141

4242
# ALB Ingress
4343
variable "aws_loadbalancer_controller_enable" {
44-
description = "Disable or Enable aws-loadbalancer-controller"
44+
description = "Disable or Enable aws-loadbalancer-controller. You need to enable it if you want to use Fargate"
4545
type = bool
4646
default = false
4747
}

‎terraform/modules/eks-aws-loadbalancer-controller/README.md‎

Lines changed: 0 additions & 33 deletions
This file was deleted.

‎terraform/modules/eks-aws-loadbalancer-controller/locals.tf‎

Lines changed: 0 additions & 11 deletions
This file was deleted.

0 commit comments

Comments
 (0)