Skip to content

Commit 0492955

Browse files
yutachaosbryantbiggsantonbabenko
authored
feat: Added appmesh controller support to iam-role-for-service-accounts-eks (#231)
Co-authored-by: Bryant Biggs <[email protected]> Co-authored-by: Anton Babenko <[email protected]>
1 parent ae3b6a4 commit 0492955

File tree

5 files changed

+212
-0
lines changed

5 files changed

+212
-0
lines changed

‎examples/iam-role-for-service-accounts-eks/README.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@ No providers.
3131
| Name | Source | Version |
3232
|------|--------|---------|
3333
| <a name="module_amazon_managed_service_prometheus_irsa_role"></a> [amazon\_managed\_service\_prometheus\_irsa\_role](#module\_amazon\_managed\_service\_prometheus\_irsa\_role) | ../../modules/iam-role-for-service-accounts-eks | n/a |
34+
| <a name="module_appmesh_controller_irsa_role"></a> [appmesh\_controller\_irsa\_role](#module\_appmesh\_controller\_irsa\_role) | ../../modules/iam-role-for-service-accounts-eks | n/a |
35+
| <a name="module_appmesh_envoy_proxy_irsa_role"></a> [appmesh\_envoy\_proxy\_irsa\_role](#module\_appmesh\_envoy\_proxy\_irsa\_role) | ../../modules/iam-role-for-service-accounts-eks | n/a |
3436
| <a name="module_cert_manager_irsa_role"></a> [cert\_manager\_irsa\_role](#module\_cert\_manager\_irsa\_role) | ../../modules/iam-role-for-service-accounts-eks | n/a |
3537
| <a name="module_cluster_autoscaler_irsa_role"></a> [cluster\_autoscaler\_irsa\_role](#module\_cluster\_autoscaler\_irsa\_role) | ../../modules/iam-role-for-service-accounts-eks | n/a |
3638
| <a name="module_disabled"></a> [disabled](#module\_disabled) | ../../modules/iam-role-for-service-accounts-eks | n/a |

‎examples/iam-role-for-service-accounts-eks/main.tf

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -213,6 +213,38 @@ module "load_balancer_controller_targetgroup_binding_only_irsa_role" {
213213
tags = local.tags
214214
}
215215

216+
module "appmesh_controller_irsa_role" {
217+
source = "../../modules/iam-role-for-service-accounts-eks"
218+
219+
role_name = "appmesh-controller"
220+
attach_appmesh_controller_policy = true
221+
222+
oidc_providers = {
223+
ex = {
224+
provider_arn = module.eks.oidc_provider_arn
225+
namespace_service_accounts = ["appmesh-system:appmesh-controller"]
226+
}
227+
}
228+
229+
tags = local.tags
230+
}
231+
232+
module "appmesh_envoy_proxy_irsa_role" {
233+
source = "../../modules/iam-role-for-service-accounts-eks"
234+
235+
role_name = "appmesh-envoy-proxy"
236+
attach_appmesh_envoy_proxy_policy = true
237+
238+
oidc_providers = {
239+
ex = {
240+
provider_arn = module.eks.oidc_provider_arn
241+
namespace_service_accounts = ["appmesh-system:appmesh-envoy-proxy"]
242+
}
243+
}
244+
245+
tags = local.tags
246+
}
247+
216248
module "amazon_managed_service_prometheus_irsa_role" {
217249
source = "../../modules/iam-role-for-service-accounts-eks"
218250

‎modules/iam-role-for-service-accounts-eks/README.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ Creates an IAM role which can be assumed by AWS EKS `ServiceAccount`s with optio
1111
- [Karpenter](https://github.com/aws/karpenter/blob/main/website/content/en/preview/getting-started/cloudformation.yaml)
1212
- [Load Balancer Controller](https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/install/iam_policy.json)
1313
- [Load Balancer Controller Target Group Binding Only](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/deploy/installation/#iam-permission-subset-for-those-who-use-targetgroupbinding-only-and-dont-plan-to-use-the-aws-load-balancer-controller-to-manage-security-group-rules)
14+
- [Appmesh Controller](https://github.com/aws/aws-app-mesh-controller-for-k8s/blob/master/config/iam/controller-iam-policy.json)
1415
- [Managed Service for Prometheus](https://docs.aws.amazon.com/prometheus/latest/userguide/set-up-irsa.html)
1516
- [Node Termination Handler](https://github.com/aws/aws-node-termination-handler#5-create-an-iam-role-for-the-pods)
1617
- [VPC CNI](https://docs.aws.amazon.com/eks/latest/userguide/cni-iam-role.html)
@@ -115,6 +116,8 @@ No modules.
115116
| Name | Type |
116117
|------|------|
117118
| [aws_iam_policy.amazon_managed_service_prometheus](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
119+
| [aws_iam_policy.appmesh_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
120+
| [aws_iam_policy.appmesh_envoy_proxy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
118121
| [aws_iam_policy.cert_manager](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
119122
| [aws_iam_policy.cluster_autoscaler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
120123
| [aws_iam_policy.ebs_csi](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
@@ -129,6 +132,8 @@ No modules.
129132
| [aws_iam_policy.vpc_cni](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
130133
| [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
131134
| [aws_iam_role_policy_attachment.amazon_managed_service_prometheus](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
135+
| [aws_iam_role_policy_attachment.appmesh_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
136+
| [aws_iam_role_policy_attachment.appmesh_envoy_proxy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
132137
| [aws_iam_role_policy_attachment.cert_manager](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
133138
| [aws_iam_role_policy_attachment.cluster_autoscaler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
134139
| [aws_iam_role_policy_attachment.ebs_csi](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
@@ -144,6 +149,8 @@ No modules.
144149
| [aws_iam_role_policy_attachment.vpc_cni](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
145150
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
146151
| [aws_iam_policy_document.amazon_managed_service_prometheus](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
152+
| [aws_iam_policy_document.appmesh_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
153+
| [aws_iam_policy_document.appmesh_envoy_proxy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
147154
| [aws_iam_policy_document.cert_manager](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
148155
| [aws_iam_policy_document.cluster_autoscaler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
149156
| [aws_iam_policy_document.ebs_csi](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
@@ -166,6 +173,8 @@ No modules.
166173
| <a name="input_amazon_managed_service_prometheus_workspace_arns"></a> [amazon\_managed\_service\_prometheus\_workspace\_arns](#input\_amazon\_managed\_service\_prometheus\_workspace\_arns) | List of AMP Workspace ARNs to read and write metrics | `list(string)` | <pre>[<br> "*"<br>]</pre> | no |
167174
| <a name="input_assume_role_condition_test"></a> [assume\_role\_condition\_test](#input\_assume\_role\_condition\_test) | Name of the [IAM condition operator](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html) to evaluate when assuming the role | `string` | `"StringEquals"` | no |
168175
| <a name="input_attach_amazon_managed_service_prometheus_policy"></a> [attach\_amazon\_managed\_service\_prometheus\_policy](#input\_attach\_amazon\_managed\_service\_prometheus\_policy) | Determines whether to attach the Amazon Managed Service for Prometheus IAM policy to the role | `bool` | `false` | no |
176+
| <a name="input_attach_appmesh_controller_policy"></a> [attach\_appmesh\_controller\_policy](#input\_attach\_appmesh\_controller\_policy) | Determines whether to attach the Appmesh Controller policy to the role | `bool` | `false` | no |
177+
| <a name="input_attach_appmesh_envoy_proxy_policy"></a> [attach\_appmesh\_envoy\_proxy\_policy](#input\_attach\_appmesh\_envoy\_proxy\_policy) | Determines whether to attach the Appmesh envoy proxy policy to the role | `bool` | `false` | no |
169178
| <a name="input_attach_cert_manager_policy"></a> [attach\_cert\_manager\_policy](#input\_attach\_cert\_manager\_policy) | Determines whether to attach the Cert Manager IAM policy to the role | `bool` | `false` | no |
170179
| <a name="input_attach_cluster_autoscaler_policy"></a> [attach\_cluster\_autoscaler\_policy](#input\_attach\_cluster\_autoscaler\_policy) | Determines whether to attach the Cluster Autoscaler IAM policy to the role | `bool` | `false` | no |
171180
| <a name="input_attach_ebs_csi_policy"></a> [attach\_ebs\_csi\_policy](#input\_attach\_ebs\_csi\_policy) | Determines whether to attach the EBS CSI IAM policy to the role | `bool` | `false` | no |

‎modules/iam-role-for-service-accounts-eks/policies.tf

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -896,6 +896,161 @@ resource "aws_iam_role_policy_attachment" "load_balancer_controller_targetgroup_
896896
policy_arn = aws_iam_policy.load_balancer_controller_targetgroup_only[0].arn
897897
}
898898

899+
################################################################################
900+
# Appmesh Controller
901+
################################################################################
902+
# https://github.com/aws/eks-charts/tree/master/stable/appmesh-controller#prerequisites
903+
# https://raw.githubusercontent.com/aws/aws-app-mesh-controller-for-k8s/master/config/iam/controller-iam-policy.json
904+
data "aws_iam_policy_document" "appmesh_controller" {
905+
count = var.create_role && var.attach_appmesh_controller_policy ? 1 : 0
906+
907+
statement {
908+
actions = [
909+
"appmesh:ListVirtualRouters",
910+
"appmesh:ListVirtualServices",
911+
"appmesh:ListRoutes",
912+
"appmesh:ListGatewayRoutes",
913+
"appmesh:ListMeshes",
914+
"appmesh:ListVirtualNodes",
915+
"appmesh:ListVirtualGateways",
916+
"appmesh:DescribeMesh",
917+
"appmesh:DescribeVirtualRouter",
918+
"appmesh:DescribeRoute",
919+
"appmesh:DescribeVirtualNode",
920+
"appmesh:DescribeVirtualGateway",
921+
"appmesh:DescribeGatewayRoute",
922+
"appmesh:DescribeVirtualService",
923+
"appmesh:CreateMesh",
924+
"appmesh:CreateVirtualRouter",
925+
"appmesh:CreateVirtualGateway",
926+
"appmesh:CreateVirtualService",
927+
"appmesh:CreateGatewayRoute",
928+
"appmesh:CreateRoute",
929+
"appmesh:CreateVirtualNode",
930+
"appmesh:UpdateMesh",
931+
"appmesh:UpdateRoute",
932+
"appmesh:UpdateVirtualGateway",
933+
"appmesh:UpdateVirtualRouter",
934+
"appmesh:UpdateGatewayRoute",
935+
"appmesh:UpdateVirtualService",
936+
"appmesh:UpdateVirtualNode",
937+
"appmesh:DeleteMesh",
938+
"appmesh:DeleteRoute",
939+
"appmesh:DeleteVirtualRouter",
940+
"appmesh:DeleteGatewayRoute",
941+
"appmesh:DeleteVirtualService",
942+
"appmesh:DeleteVirtualNode",
943+
"appmesh:DeleteVirtualGateway"
944+
]
945+
resources = ["*"]
946+
}
947+
948+
statement {
949+
actions = [
950+
"arn:${local.partition}:iam::*:role/aws-service-role/appmesh.${local.dns_suffix}/AWSServiceRoleForAppMesh"
951+
]
952+
resources = ["*"]
953+
condition {
954+
test = "StringLike"
955+
variable = "iam:AWSServiceName"
956+
values = ["appmesh.${local.dns_suffix}"]
957+
}
958+
}
959+
960+
statement {
961+
actions = [
962+
"acm:ListCertificates",
963+
"acm:DescribeCertificate",
964+
"acm-pca:DescribeCertificateAuthority",
965+
"acm-pca:ListCertificateAuthorities"
966+
]
967+
resources = ["*"]
968+
}
969+
970+
statement {
971+
actions = [
972+
"servicediscovery:CreateService",
973+
"servicediscovery:DeleteService",
974+
"servicediscovery:GetService",
975+
"servicediscovery:GetInstance",
976+
"servicediscovery:RegisterInstance",
977+
"servicediscovery:DeregisterInstance",
978+
"servicediscovery:ListInstances",
979+
"servicediscovery:ListNamespaces",
980+
"servicediscovery:ListServices",
981+
"servicediscovery:GetInstancesHealthStatus",
982+
"servicediscovery:UpdateInstanceCustomHealthStatus",
983+
"servicediscovery:GetOperation",
984+
"route53:GetHealthCheck",
985+
"route53:CreateHealthCheck",
986+
"route53:UpdateHealthCheck",
987+
"route53:ChangeResourceRecordSets",
988+
"route53:DeleteHealthCheck"
989+
]
990+
resources = ["*"]
991+
}
992+
}
993+
994+
resource "aws_iam_policy" "appmesh_controller" {
995+
count = var.create_role && var.attach_appmesh_controller_policy ? 1 : 0
996+
997+
name_prefix = "AmazonEKS_Appmesh_Controller-"
998+
path = var.role_path
999+
description = "Provides permissions to for appmesh controller"
1000+
policy = data.aws_iam_policy_document.appmesh_controller[0].json
1001+
1002+
tags = var.tags
1003+
}
1004+
1005+
resource "aws_iam_role_policy_attachment" "appmesh_controller" {
1006+
count = var.create_role && var.attach_appmesh_controller_policy ? 1 : 0
1007+
1008+
role = aws_iam_role.this[0].name
1009+
policy_arn = aws_iam_policy.appmesh_controller[0].arn
1010+
}
1011+
1012+
################################################################################
1013+
# Appmesh envoy proxy
1014+
################################################################################
1015+
# https://github.com/aws/aws-app-mesh-controller-for-k8s/blob/f4a551399c4a4428d31692d0e6d944c2b78f2753/config/helm/appmesh-controller/README.md#with-irsa
1016+
# https://raw.githubusercontent.com/aws/aws-app-mesh-controller-for-k8s/master/config/iam/envoy-iam-policy.json
1017+
data "aws_iam_policy_document" "appmesh_envoy_proxy" {
1018+
count = var.create_role && var.attach_appmesh_envoy_proxy_policy ? 1 : 0
1019+
1020+
statement {
1021+
actions = [
1022+
"appmesh:StreamAggregatedResources"
1023+
]
1024+
resources = ["*"]
1025+
}
1026+
1027+
statement {
1028+
actions = [
1029+
"acm:ExportCertificate",
1030+
"acm-pca:GetCertificateAuthorityCertificate"
1031+
]
1032+
resources = ["*"]
1033+
}
1034+
}
1035+
1036+
resource "aws_iam_policy" "appmesh_envoy_proxy" {
1037+
count = var.create_role && var.attach_appmesh_envoy_proxy_policy ? 1 : 0
1038+
1039+
name_prefix = "AmazonEKS_Appmesh_Envoy_Proxy-"
1040+
path = var.role_path
1041+
description = "Provides permissions to for appmesh envoy proxy"
1042+
policy = data.aws_iam_policy_document.appmesh_envoy_proxy[0].json
1043+
1044+
tags = var.tags
1045+
}
1046+
1047+
resource "aws_iam_role_policy_attachment" "appmesh_envoy_proxy" {
1048+
count = var.create_role && var.attach_appmesh_envoy_proxy_policy ? 1 : 0
1049+
1050+
role = aws_iam_role.this[0].name
1051+
policy_arn = aws_iam_policy.appmesh_envoy_proxy[0].arn
1052+
}
1053+
8991054
################################################################################
9001055
# Amazon Managed Service for Prometheus Policy
9011056
################################################################################

‎modules/iam-role-for-service-accounts-eks/variables.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -212,6 +212,20 @@ variable "attach_load_balancer_controller_targetgroup_binding_only_policy" {
212212
default = false
213213
}
214214

215+
# AWS Appmesh Controller
216+
variable "attach_appmesh_controller_policy" {
217+
description = "Determines whether to attach the Appmesh Controller policy to the role"
218+
type = bool
219+
default = false
220+
}
221+
222+
# AWS Appmesh envoy proxy
223+
variable "attach_appmesh_envoy_proxy_policy" {
224+
description = "Determines whether to attach the Appmesh envoy proxy policy to the role"
225+
type = bool
226+
default = false
227+
}
228+
215229
# Amazon Managed Service for Prometheus
216230
variable "attach_amazon_managed_service_prometheus_policy" {
217231
description = "Determines whether to attach the Amazon Managed Service for Prometheus IAM policy to the role"

0 commit comments

Comments
 (0)