Skip to content

Commit 0bbfb04

Browse files
brandonjbjellandbrandonjbjelland
authored
Merge pull request #49 from bti360/kubeconfig-updates
Allow Kubeconfig to be more configurable
2 parents c0726f8 + c1ebd58 commit 0bbfb04

File tree

5 files changed

+97
-46
lines changed

5 files changed

+97
-46
lines changed

‎README.md

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -95,15 +95,20 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a
9595
| Name | Description | Type | Default | Required |
9696
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :----: | :------: | :------: |
9797
| cluster_name | Name of the EKS cluster. Also used as a prefix in names of related resources. | string | - | yes |
98-
| cluster_security_group_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the workers and provide API access to your current IP/32. | string | `` | no |
98+
| cluster_security_group_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the workers and provide API access to your current IP/32. | string | `` | no |
9999
| cluster_version | Kubernetes version to use for the EKS cluster. | string | `1.10` | no |
100100
| config_output_path | Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. | string | `./` | no |
101101
| configure_kubectl_session | Configure the current session's kubectl to use the instantiated EKS cluster. | string | `true` | no |
102+
| kubeconfig_context_name | Name of the kubeconfig context. | map | `aws` | no |
103+
| kubeconfig_user_name | Name of the kubeconfig user. | map | `aws` | no |
104+
| kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | map | `heptio-authenticator-aws` | no |
105+
| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume `["-r", "MyEksRole"]` | map | `<list>` | no |
106+
| kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. `{ AWS_PROFILE = "eks"}` | map | `<map>` | no |
102107
| subnets | A list of subnets to place the EKS cluster and workers within. | list | - | yes |
103108
| tags | A map of tags to add to all resources. | string | `<map>` | no |
104109
| vpc_id | VPC where the cluster and workers will be deployed. | string | - | yes |
105110
| worker_groups | A list of maps defining worker group configurations. See workers_group_defaults for valid keys. | list | `<list>` | no |
106-
| worker_security_group_id | If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the EKS cluster. | string | `` | no |
111+
| worker_security_group_id | If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the EKS cluster. | string | `` | no |
107112
| worker_sg_ingress_from_port | Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443). | string | `1025` | no |
108113
| workers_group_defaults | Default values for target groups as defined by the list of maps. | map | `<map>` | no |
109114
| workstation_cidr | Override the default ingress rule that allows communication with the EKS cluster API. If not given, will use current IP/32. | string | - | no |

‎data.tf

Lines changed: 24 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -44,14 +44,33 @@ data "aws_iam_policy_document" "cluster_assume_role_policy" {
4444
}
4545
}
4646

47-
data template_file kubeconfig {
47+
data "template_file" "kubeconfig" {
4848
template = "${file("${path.module}/templates/kubeconfig.tpl")}"
4949

5050
vars {
51-
cluster_name = "${var.cluster_name}"
52-
endpoint = "${aws_eks_cluster.this.endpoint}"
53-
region = "${data.aws_region.current.name}"
54-
cluster_auth_base64 = "${aws_eks_cluster.this.certificate_authority.0.data}"
51+
cluster_name = "${var.cluster_name}"
52+
endpoint = "${aws_eks_cluster.this.endpoint}"
53+
region = "${data.aws_region.current.name}"
54+
cluster_auth_base64 = "${aws_eks_cluster.this.certificate_authority.0.data}"
55+
context_name = "${var.kubeconfig_context_name}"
56+
user_name = "${var.kubeconfig_user_name}"
57+
aws_authenticator_command = "${var.kubeconfig_aws_authenticator_command}"
58+
aws_authenticator_additional_args = "${length(var.kubeconfig_aws_authenticator_additional_args) > 0 ? " - ${join("\n - ", var.kubeconfig_aws_authenticator_additional_args)}" : "" }"
59+
aws_authenticator_env_variables = "${length(var.kubeconfig_aws_authenticator_env_variables) > 0 ? " env:\n${join("\n", data.template_file.aws_authenticator_env_variables.*.rendered)}" : ""}"
60+
}
61+
}
62+
63+
data "template_file" "aws_authenticator_env_variables" {
64+
template = <<EOF
65+
- name: $${key}
66+
value: $${value}
67+
EOF
68+
69+
count = "${length(var.kubeconfig_aws_authenticator_env_variables)}"
70+
71+
vars {
72+
value = "${element(values(var.kubeconfig_aws_authenticator_env_variables), count.index)}"
73+
key = "${element(keys(var.kubeconfig_aws_authenticator_env_variables), count.index)}"
5574
}
5675
}
5776

‎templates/config-map-aws-auth.yaml.tpl

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
1-
apiVersion: v1
2-
kind: ConfigMap
3-
metadata:
4-
name: aws-auth
5-
namespace: kube-system
6-
data:
7-
mapRoles: |
8-
- rolearn: ${role_arn}
9-
username: system:node:{{EC2PrivateDNSName}}
10-
groups:
11-
- system:bootstrappers
12-
- system:nodes
1+
apiVersion: v1
2+
kind: ConfigMap
3+
metadata:
4+
name: aws-auth
5+
namespace: kube-system
6+
data:
7+
mapRoles: |
8+
- rolearn: ${role_arn}
9+
username: system:node:{{EC2PrivateDNSName}}
10+
groups:
11+
- system:bootstrappers
12+
- system:nodes

‎templates/kubeconfig.tpl

Lines changed: 29 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,29 @@
1-
apiVersion: v1
2-
preferences: {}
3-
kind: Config
4-
5-
clusters:
6-
- cluster:
7-
server: ${endpoint}
8-
certificate-authority-data: ${cluster_auth_base64}
9-
name: kubernetes
10-
11-
contexts:
12-
- context:
13-
cluster: kubernetes
14-
user: aws
15-
name: aws
16-
current-context: aws
17-
18-
users:
19-
- name: aws
20-
user:
21-
exec:
22-
apiVersion: client.authentication.k8s.io/v1alpha1
23-
command: heptio-authenticator-aws
24-
args:
25-
- "token"
26-
- "-i"
27-
- "${cluster_name}"
1+
apiVersion: v1
2+
preferences: {}
3+
kind: Config
4+
5+
clusters:
6+
- cluster:
7+
server: ${endpoint}
8+
certificate-authority-data: ${cluster_auth_base64}
9+
name: ${cluster_name}
10+
11+
contexts:
12+
- context:
13+
cluster: ${cluster_name}
14+
user: ${user_name}
15+
name: ${context_name}
16+
current-context: ${context_name}
17+
18+
users:
19+
- name: ${user_name}
20+
user:
21+
exec:
22+
apiVersion: client.authentication.k8s.io/v1alpha1
23+
command: ${aws_authenticator_command}
24+
args:
25+
- "token"
26+
- "-i"
27+
- "${cluster_name}"
28+
${aws_authenticator_additional_args}
29+
${aws_authenticator_env_variables}

‎variables.tf

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,3 +78,28 @@ variable "worker_sg_ingress_from_port" {
7878
description = "Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443)."
7979
default = "1025"
8080
}
81+
82+
variable "kubeconfig_context_name" {
83+
description = "Name of the kubeconfig context."
84+
default = "aws"
85+
}
86+
87+
variable "kubeconfig_user_name" {
88+
description = "Name of the kubeconfig user."
89+
default = "aws"
90+
}
91+
92+
variable "kubeconfig_aws_authenticator_command" {
93+
description = "Command to use to to fetch AWS EKS credentials"
94+
default = "heptio-authenticator-aws"
95+
}
96+
97+
variable "kubeconfig_aws_authenticator_additional_args" {
98+
description = "Any additional arguments to pass to the authenticator such as the role to assume [\"-r\", \"MyEksRole\"]"
99+
default = []
100+
}
101+
102+
variable "kubeconfig_aws_authenticator_env_variables" {
103+
description = "Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = \"eks\"}"
104+
default = {}
105+
}

0 commit comments

Comments
 (0)