Skip to content

Commit 5008783

Browse files
maxsxudpappamitch-hammciiiiigithub-actions[bot]
authored
feat!: support generic adoption variables (#140)
### Motivation For adopt old existing clusters into new IaC. ### Modifications Upgrade provider version: - terraform required_version to >= 1.3.2 - aws provider to >= 5.75 - kubernetes provider to >= 2.32 Upgrade module version: - eks module to 20.29.0 Added new variables: - `cluster_encryption_config` - `bootstrap_self_managed_addons` - `cluster_iam` - `cluster_networking` - `node_groups` Updated outputs: - `eks_cluster_id` renamed to `eks_cluster_name` ### Verifying this change It has been verified in test environment. ### Documentation - [x] `doc` --------- Co-authored-by: Darrell Pappa <darrell.pappa@streamnative.io> Co-authored-by: mitch-hamm <mitch.hamm@streamnative.io> Co-authored-by: Yisheng Cai <yisheng.cai@streamnative.io> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
1 parent 50f5d5c commit 5008783

File tree

14 files changed

+242
-461
lines changed

14 files changed

+242
-461
lines changed

‎.github/workflows/terraform.yml‎

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
name: "TF GH Action"
1+
name: Terraform
2+
23
on:
34
- pull_request
45

@@ -11,12 +12,12 @@ jobs:
1112
runs-on: ubuntu-latest
1213
steps:
1314
- name: Checkout
14-
uses: actions/checkout@v3
15+
uses: actions/checkout@v4
1516

1617
- name: Setup Terraform
17-
uses: hashicorp/setup-terraform@v1.3.2
18+
uses: hashicorp/setup-terraform@v3
1819
with:
19-
terraform_version: 1.1.x
20+
terraform_version: "1.5.5"
2021

2122
- name: Terraform fmt
2223
run: terraform fmt -recursive -write=false -check -diff .
@@ -27,21 +28,21 @@ jobs:
2728
runs-on: ubuntu-latest
2829
strategy:
2930
matrix:
30-
terraform_version: [1.1.x]
31+
terraform_version: ["1.5.5"]
3132
steps:
3233
- name: Checkout
33-
uses: actions/checkout@v3
34+
uses: actions/checkout@v4
3435

3536
- name: Setup Terraform ${{ matrix.terraform_version }}
36-
uses: hashicorp/setup-terraform@v1.3.2
37+
uses: hashicorp/setup-terraform@v3
3738
with:
3839
terraform_version: ${{ matrix.terraform_version }}
3940

4041
- name: Terraform Validate Root
41-
run: cd "${GITHUB_WORKSPACE}" && terraform init -backend=false && AWS_REGION=us-east-1 terraform validate -no-color
42+
run: cd "${GITHUB_WORKSPACE}" && terraform init -backend=false && AWS_REGION=us-east-1 terraform validate
4243

4344
- name: Terraform Validate Modules
44-
run: for module in modules/*/; do cd "${GITHUB_WORKSPACE}/${module}" && terraform init -backend=false && AWS_REGION=us-east-1 terraform validate -no-color ; done
45+
run: for module in modules/*/; do cd "${GITHUB_WORKSPACE}/${module}" && terraform init -backend=false && AWS_REGION=us-east-1 terraform validate; done
4546

4647
- name: Terraform Validate Examples
47-
run: for example in examples/*/; do cd "${GITHUB_WORKSPACE}/${example}" && terraform init -backend=false && AWS_REGION=us-east-1 terraform validate -no-color ; done
48+
run: for example in examples/*/; do cd "${GITHUB_WORKSPACE}/${example}" && terraform init -backend=false && AWS_REGION=us-east-1 terraform validate; done

‎README.md‎

Lines changed: 21 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -56,11 +56,11 @@ A bare minimum configuration to execute the module:
5656

5757
```hcl
5858
data "aws_eks_cluster" "cluster" {
59-
name = module.eks_cluster.eks_cluster_id
59+
name = module.eks_cluster.eks_cluster_name
6060
}
6161
6262
data "aws_eks_cluster_auth" "cluster" {
63-
name = module.eks_cluster.eks_cluster_id
63+
name = module.eks_cluster.eks_cluster_name
6464
}
6565
6666
provider "aws" {
@@ -168,24 +168,25 @@ _Note: Since this module manages all of the Kubernetes addon dependencies requir
168168

169169
| Name | Version |
170170
|------|---------|
171-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >=1.1.0 |
172-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >=3.61.0 |
173-
| <a name="requirement_helm"></a> [helm](#requirement\_helm) | 2.2.0 |
174-
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >=2.6.1 |
171+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.2 |
172+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.75 |
173+
| <a name="requirement_helm"></a> [helm](#requirement\_helm) | >= 2.16 |
174+
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.32 |
175175

176176
## Providers
177177

178178
| Name | Version |
179179
|------|---------|
180-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.71.0 |
181-
| <a name="provider_helm"></a> [helm](#provider\_helm) | 2.16.0 |
180+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.75.0 |
181+
| <a name="provider_helm"></a> [helm](#provider\_helm) | 2.16.1 |
182182
| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | 2.33.0 |
183183

184184
## Modules
185185

186186
| Name | Source | Version |
187187
|------|--------|---------|
188-
| <a name="module_eks"></a> [eks](#module\_eks) | terraform-aws-modules/eks/aws | 18.30.2 |
188+
| <a name="module_eks"></a> [eks](#module\_eks) | terraform-aws-modules/eks/aws | 20.29.0 |
189+
| <a name="module_eks_auth"></a> [eks\_auth](#module\_eks\_auth) | terraform-aws-modules/eks/aws//modules/aws-auth | 20.29.0 |
189190
| <a name="module_istio"></a> [istio](#module\_istio) | github.com/streamnative/terraform-helm-charts//modules/istio-operator | v0.8.6 |
190191
| <a name="module_vpc_tags"></a> [vpc\_tags](#module\_vpc\_tags) | ./modules/eks-vpc-tags | n/a |
191192

@@ -225,16 +226,16 @@ _Note: Since this module manages all of the Kubernetes addon dependencies requir
225226
| [aws_s3_bucket.velero](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
226227
| [aws_s3_bucket_server_side_encryption_configuration.tiered_storage](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource |
227228
| [aws_s3_bucket_server_side_encryption_configuration.velero](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource |
228-
| [helm_release.aws_load_balancer_controller](https://registry.terraform.io/providers/hashicorp/helm/2.2.0/docs/resources/release) | resource |
229-
| [helm_release.cert_issuer](https://registry.terraform.io/providers/hashicorp/helm/2.2.0/docs/resources/release) | resource |
230-
| [helm_release.cert_manager](https://registry.terraform.io/providers/hashicorp/helm/2.2.0/docs/resources/release) | resource |
231-
| [helm_release.cilium](https://registry.terraform.io/providers/hashicorp/helm/2.2.0/docs/resources/release) | resource |
232-
| [helm_release.cluster_autoscaler](https://registry.terraform.io/providers/hashicorp/helm/2.2.0/docs/resources/release) | resource |
233-
| [helm_release.csi](https://registry.terraform.io/providers/hashicorp/helm/2.2.0/docs/resources/release) | resource |
234-
| [helm_release.external_dns](https://registry.terraform.io/providers/hashicorp/helm/2.2.0/docs/resources/release) | resource |
235-
| [helm_release.metrics_server](https://registry.terraform.io/providers/hashicorp/helm/2.2.0/docs/resources/release) | resource |
236-
| [helm_release.node_termination_handler](https://registry.terraform.io/providers/hashicorp/helm/2.2.0/docs/resources/release) | resource |
237-
| [helm_release.velero](https://registry.terraform.io/providers/hashicorp/helm/2.2.0/docs/resources/release) | resource |
229+
| [helm_release.aws_load_balancer_controller](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
230+
| [helm_release.cert_issuer](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
231+
| [helm_release.cert_manager](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
232+
| [helm_release.cilium](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
233+
| [helm_release.cluster_autoscaler](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
234+
| [helm_release.csi](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
235+
| [helm_release.external_dns](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
236+
| [helm_release.metrics_server](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
237+
| [helm_release.node_termination_handler](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
238+
| [helm_release.velero](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
238239
| [kubernetes_namespace.sn_system](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource |
239240
| [kubernetes_namespace.velero](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource |
240241
| [kubernetes_storage_class.sn_default](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/storage_class) | resource |
@@ -393,10 +394,10 @@ _Note: Since this module manages all of the Kubernetes addon dependencies requir
393394
| <a name="output_eks_cluster_arn"></a> [eks\_cluster\_arn](#output\_eks\_cluster\_arn) | The ARN for the EKS cluster created by this module |
394395
| <a name="output_eks_cluster_certificate_authority_data"></a> [eks\_cluster\_certificate\_authority\_data](#output\_eks\_cluster\_certificate\_authority\_data) | Base64 encoded certificate data required to communicate with the cluster |
395396
| <a name="output_eks_cluster_endpoint"></a> [eks\_cluster\_endpoint](#output\_eks\_cluster\_endpoint) | The endpoint for the EKS cluster created by this module |
396-
| <a name="output_eks_cluster_id"></a> [eks\_cluster\_id](#output\_eks\_cluster\_id) | The id/name of the EKS cluster created by this module |
397397
| <a name="output_eks_cluster_identity_oidc_issuer_arn"></a> [eks\_cluster\_identity\_oidc\_issuer\_arn](#output\_eks\_cluster\_identity\_oidc\_issuer\_arn) | The ARN for the OIDC issuer created by this module |
398398
| <a name="output_eks_cluster_identity_oidc_issuer_string"></a> [eks\_cluster\_identity\_oidc\_issuer\_string](#output\_eks\_cluster\_identity\_oidc\_issuer\_string) | A formatted string containing the prefix for the OIDC issuer created by this module. Same as "cluster\_oidc\_issuer\_url", but with "https://" stripped from the name. This output is typically used in other StreamNative modules that request the "oidc\_issuer" input. |
399399
| <a name="output_eks_cluster_identity_oidc_issuer_url"></a> [eks\_cluster\_identity\_oidc\_issuer\_url](#output\_eks\_cluster\_identity\_oidc\_issuer\_url) | The URL for the OIDC issuer created by this module |
400+
| <a name="output_eks_cluster_name"></a> [eks\_cluster\_name](#output\_eks\_cluster\_name) | The name of the EKS cluster created by this module |
400401
| <a name="output_eks_cluster_platform_version"></a> [eks\_cluster\_platform\_version](#output\_eks\_cluster\_platform\_version) | The platform version for the EKS cluster created by this module |
401402
| <a name="output_eks_cluster_primary_security_group_id"></a> [eks\_cluster\_primary\_security\_group\_id](#output\_eks\_cluster\_primary\_security\_group\_id) | The id of the primary security group created by the EKS service itself, not by this module. This is labeled "Cluster Security Group" in the EKS console. |
402403
| <a name="output_eks_cluster_secondary_security_group_id"></a> [eks\_cluster\_secondary\_security\_group\_id](#output\_eks\_cluster\_secondary\_security\_group\_id) | The id of the secondary security group created by this module. This is labled "Additional Security Groups" in the EKS console. |

‎aws_load_balancer_controller.tf‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@
1313
# limitations under the License.
1414

1515
data "aws_iam_policy_document" "aws_load_balancer_controller" {
16+
count = var.enable_resource_creation ? 1 : 0
17+
1618
statement {
1719
actions = [
1820
"iam:CreateServiceLinkedRole",
@@ -237,6 +239,8 @@ data "aws_iam_policy_document" "aws_load_balancer_controller" {
237239
}
238240

239241
data "aws_iam_policy_document" "aws_load_balancer_controller_sts" {
242+
count = var.enable_resource_creation ? 1 : 0
243+
240244
statement {
241245
actions = [
242246
"sts:AssumeRoleWithWebIdentity"
@@ -258,7 +262,7 @@ resource "aws_iam_role" "aws_load_balancer_controller" {
258262
count = var.enable_resource_creation ? 1 : 0
259263
name = format("%s-lbc-role", module.eks.cluster_id)
260264
description = format("Role used by IRSA and the KSA aws-load-balancer-controller on StreamNative Cloud EKS cluster %s", module.eks.cluster_id)
261-
assume_role_policy = data.aws_iam_policy_document.aws_load_balancer_controller_sts.json
265+
assume_role_policy = data.aws_iam_policy_document.aws_load_balancer_controller_sts.0.json
262266
path = "/StreamNative/"
263267
permissions_boundary = var.permissions_boundary_arn
264268
tags = local.tags
@@ -275,7 +279,7 @@ resource "aws_iam_policy" "aws_load_balancer_controller" {
275279
name = format("%s-AWSLoadBalancerControllerPolicy", module.eks.cluster_id)
276280
description = "Policy that defines the permissions for the AWS Load Balancer Controller addon service running in a StreamNative Cloud EKS cluster"
277281
path = "/StreamNative/"
278-
policy = data.aws_iam_policy_document.aws_load_balancer_controller.json
282+
policy = data.aws_iam_policy_document.aws_load_balancer_controller.0.json
279283
tags = local.tags
280284
}
281285

‎cert_manager.tf‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@
1313
# limitations under the License.
1414

1515
data "aws_iam_policy_document" "cert_manager" {
16+
count = var.enable_resource_creation ? 1 : 0
17+
1618
statement {
1719
sid = "Changes"
1820
actions = [
@@ -49,6 +51,8 @@ data "aws_iam_policy_document" "cert_manager" {
4951
}
5052

5153
data "aws_iam_policy_document" "cert_manager_sts" {
54+
count = var.enable_resource_creation ? 1 : 0
55+
5256
statement {
5357
actions = [
5458
"sts:AssumeRoleWithWebIdentity"
@@ -70,7 +74,7 @@ resource "aws_iam_role" "cert_manager" {
7074
count = var.enable_resource_creation ? 1 : 0
7175
name = format("%s-cm-role", module.eks.cluster_id)
7276
description = format("Role assumed by IRSA and the KSA cert-manager on StreamNative Cloud EKS cluster %s", module.eks.cluster_id)
73-
assume_role_policy = data.aws_iam_policy_document.cert_manager_sts.json
77+
assume_role_policy = data.aws_iam_policy_document.cert_manager_sts.0.json
7478
path = "/StreamNative/"
7579
permissions_boundary = var.permissions_boundary_arn
7680
tags = local.tags
@@ -87,7 +91,7 @@ resource "aws_iam_policy" "cert_manager" {
8791
name = format("%s-CertManagerPolicy", module.eks.cluster_id)
8892
description = "Policy that defines the permissions for the Cert-Manager addon service running in a StreamNative Cloud EKS cluster"
8993
path = "/StreamNative/"
90-
policy = data.aws_iam_policy_document.cert_manager.json
94+
policy = data.aws_iam_policy_document.cert_manager.0.json
9195
tags = local.tags
9296
}
9397

‎cluster_autoscaler.tf‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@
1313
# limitations under the License.
1414

1515
data "aws_iam_policy_document" "cluster_autoscaler" {
16+
count = var.enable_resource_creation ? 1 : 0
17+
1618
statement {
1719
effect = "Allow"
1820

@@ -51,6 +53,8 @@ data "aws_iam_policy_document" "cluster_autoscaler" {
5153
}
5254

5355
data "aws_iam_policy_document" "cluster_autoscaler_sts" {
56+
count = var.enable_resource_creation ? 1 : 0
57+
5458
statement {
5559
actions = [
5660
"sts:AssumeRoleWithWebIdentity"
@@ -77,7 +81,7 @@ resource "aws_iam_role" "cluster_autoscaler" {
7781
count = var.enable_resource_creation ? 1 : 0
7882
name = format("%s-ca-role", module.eks.cluster_id)
7983
description = format("Role used by IRSA and the KSA cluster-autoscaler on StreamNative Cloud EKS cluster %s", module.eks.cluster_id)
80-
assume_role_policy = data.aws_iam_policy_document.cluster_autoscaler_sts.json
84+
assume_role_policy = data.aws_iam_policy_document.cluster_autoscaler_sts.0.json
8185
path = "/StreamNative/"
8286
permissions_boundary = var.permissions_boundary_arn
8387
tags = local.tags
@@ -94,7 +98,7 @@ resource "aws_iam_policy" "cluster_autoscaler" {
9498
name = format("%s-ClusterAutoscalerPolicy", module.eks.cluster_id)
9599
description = "Policy that defines the permissions for the Cluster Autoscaler addon service running in a StreamNative Cloud EKS cluster"
96100
path = "/StreamNative/"
97-
policy = data.aws_iam_policy_document.cluster_autoscaler.json
101+
policy = data.aws_iam_policy_document.cluster_autoscaler.0.json
98102
tags = local.tags
99103
}
100104

‎csi.tf‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@
1313
# limitations under the License.
1414

1515
data "aws_iam_policy_document" "csi" {
16+
count = var.enable_resource_creation ? 1 : 0
17+
1618
statement {
1719
actions = [
1820
"ec2:CreateSnapshot",
@@ -142,6 +144,8 @@ data "aws_iam_policy_document" "csi" {
142144
}
143145

144146
data "aws_iam_policy_document" "csi_sts" {
147+
count = var.enable_resource_creation ? 1 : 0
148+
145149
statement {
146150
actions = [
147151
"sts:AssumeRoleWithWebIdentity"
@@ -168,7 +172,7 @@ resource "aws_iam_role" "csi" {
168172
count = var.enable_resource_creation ? 1 : 0
169173
name = format("%s-csi-role", module.eks.cluster_id)
170174
description = format("Role used by IRSA and the KSA ebs-csi-controller-sa on StreamNative Cloud EKS cluster %s", module.eks.cluster_id)
171-
assume_role_policy = data.aws_iam_policy_document.csi_sts.json
175+
assume_role_policy = data.aws_iam_policy_document.csi_sts.0.json
172176
path = "/StreamNative/"
173177
permissions_boundary = var.permissions_boundary_arn
174178
tags = local.tags
@@ -185,7 +189,7 @@ resource "aws_iam_policy" "csi" {
185189
name = format("%s-CsiPolicy", module.eks.cluster_id)
186190
description = "Policy that defines the permissions for the EBS Container Storage Interface CSI addon service running in a StreamNative Cloud EKS cluster"
187191
path = "/StreamNative/"
188-
policy = data.aws_iam_policy_document.csi.json
192+
policy = data.aws_iam_policy_document.csi.0.json
189193
tags = local.tags
190194
}
191195

0 commit comments

Comments
 (0)