Skip to content

Commit a4ef1f5

Browse files
bryantbiggsbryantbiggs
committed
fix: Update IRSA module to align with upstream changes
1 parent dcdbae4 commit a4ef1f5

File tree

6 files changed

+140
-66
lines changed

6 files changed

+140
-66
lines changed

‎examples/iam-role-for-service-accounts/README.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,8 @@ Run `terraform destroy` when you don't need these resources.
3333
| Name | Source | Version |
3434
|------|--------|---------|
3535
| <a name="module_amazon_managed_service_prometheus_irsa"></a> [amazon\_managed\_service\_prometheus\_irsa](#module\_amazon\_managed\_service\_prometheus\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
36-
| <a name="module_appmesh_controller_irsa"></a> [appmesh\_controller\_irsa](#module\_appmesh\_controller\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
37-
| <a name="module_appmesh_envoy_proxy_irsa"></a> [appmesh\_envoy\_proxy\_irsa](#module\_appmesh\_envoy\_proxy\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
3836
| <a name="module_cert_manager_irsa"></a> [cert\_manager\_irsa](#module\_cert\_manager\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
37+
| <a name="module_cloudwatch_observability_irsa"></a> [cloudwatch\_observability\_irsa](#module\_cloudwatch\_observability\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
3938
| <a name="module_cluster_autoscaler_irsa"></a> [cluster\_autoscaler\_irsa](#module\_cluster\_autoscaler\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
4039
| <a name="module_disabled"></a> [disabled](#module\_disabled) | ../../modules/iam-role-for-service-accounts | n/a |
4140
| <a name="module_ebs_csi_irsa"></a> [ebs\_csi\_irsa](#module\_ebs\_csi\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
@@ -45,12 +44,13 @@ Run `terraform destroy` when you don't need these resources.
4544
| <a name="module_external_dns_irsa"></a> [external\_dns\_irsa](#module\_external\_dns\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
4645
| <a name="module_external_secrets_irsa"></a> [external\_secrets\_irsa](#module\_external\_secrets\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
4746
| <a name="module_fsx_lustre_csi_irsa"></a> [fsx\_lustre\_csi\_irsa](#module\_fsx\_lustre\_csi\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
47+
| <a name="module_fsx_openzfs_csi_irsa"></a> [fsx\_openzfs\_csi\_irsa](#module\_fsx\_openzfs\_csi\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
4848
| <a name="module_irsa"></a> [irsa](#module\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
4949
| <a name="module_irsa_v2_custom_policy"></a> [irsa\_v2\_custom\_policy](#module\_irsa\_v2\_custom\_policy) | ../../modules/iam-role-for-service-accounts | n/a |
5050
| <a name="module_irsa_v2_empty"></a> [irsa\_v2\_empty](#module\_irsa\_v2\_empty) | ../../modules/iam-role-for-service-accounts | n/a |
51-
| <a name="module_karpenter_irsa"></a> [karpenter\_irsa](#module\_karpenter\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
5251
| <a name="module_load_balancer_controller_irsa"></a> [load\_balancer\_controller\_irsa](#module\_load\_balancer\_controller\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
5352
| <a name="module_load_balancer_controller_targetgroup_binding_only_irsa"></a> [load\_balancer\_controller\_targetgroup\_binding\_only\_irsa](#module\_load\_balancer\_controller\_targetgroup\_binding\_only\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
53+
| <a name="module_mountpoint_s3_csi_irsa"></a> [mountpoint\_s3\_csi\_irsa](#module\_mountpoint\_s3\_csi\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
5454
| <a name="module_node_termination_handler_irsa"></a> [node\_termination\_handler\_irsa](#module\_node\_termination\_handler\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
5555
| <a name="module_velero_irsa"></a> [velero\_irsa](#module\_velero\_irsa) | ../../modules/iam-role-for-service-accounts | n/a |
5656
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 6.0 |

‎examples/iam-role-for-service-accounts/main.tf

Lines changed: 41 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -163,6 +163,25 @@ module "efs_csi_irsa" {
163163
tags = local.tags
164164
}
165165

166+
module "mountpoint_s3_csi_irsa" {
167+
source = "../../modules/iam-role-for-service-accounts"
168+
169+
name = "mountpoint-s3-csi"
170+
171+
attach_mountpoint_s3_csi_policy = true
172+
mountpoint_s3_csi_bucket_arns = ["arn:aws:s3:::mountpoint-s3-csi-bucket"]
173+
mountpoint_s3_csi_path_arns = ["arn:aws:s3:::mountpoint-s3-csi-bucket/example/*"]
174+
175+
oidc_providers = {
176+
ex = {
177+
provider_arn = module.eks.oidc_provider_arn
178+
namespace_service_accounts = ["kube-system:s3-csi-driver-sa"]
179+
}
180+
}
181+
182+
tags = local.tags
183+
}
184+
166185
module "external_dns_irsa" {
167186
source = "../../modules/iam-role-for-service-accounts"
168187

@@ -217,19 +236,17 @@ module "fsx_lustre_csi_irsa" {
217236
tags = local.tags
218237
}
219238

220-
module "karpenter_irsa" {
239+
module "fsx_openzfs_csi_irsa" {
221240
source = "../../modules/iam-role-for-service-accounts"
222241

223-
name = "karpenter"
242+
name = "fsx-openzfs-csi"
224243

225-
attach_karpenter_policy = true
226-
karpenter_cluster_name = module.eks.cluster_name
227-
karpenter_node_iam_role_arns = [module.eks.eks_managed_node_groups["default"].iam_role_arn]
244+
attach_fsx_openzfs_csi_policy = true
228245

229246
oidc_providers = {
230-
this = {
247+
ex = {
231248
provider_arn = module.eks.oidc_provider_arn
232-
namespace_service_accounts = ["karpenter:karpenter"]
249+
namespace_service_accounts = ["kube-system:fsx-openzfs-csi-controller-sa"]
233250
}
234251
}
235252

@@ -270,40 +287,6 @@ module "load_balancer_controller_targetgroup_binding_only_irsa" {
270287
tags = local.tags
271288
}
272289

273-
module "appmesh_controller_irsa" {
274-
source = "../../modules/iam-role-for-service-accounts"
275-
276-
name = "appmesh-controller"
277-
278-
attach_appmesh_controller_policy = true
279-
280-
oidc_providers = {
281-
this = {
282-
provider_arn = module.eks.oidc_provider_arn
283-
namespace_service_accounts = ["appmesh-system:appmesh-controller"]
284-
}
285-
}
286-
287-
tags = local.tags
288-
}
289-
290-
module "appmesh_envoy_proxy_irsa" {
291-
source = "../../modules/iam-role-for-service-accounts"
292-
293-
name = "appmesh-envoy-proxy"
294-
295-
attach_appmesh_envoy_proxy_policy = true
296-
297-
oidc_providers = {
298-
this = {
299-
provider_arn = module.eks.oidc_provider_arn
300-
namespace_service_accounts = ["appmesh-system:appmesh-envoy-proxy"]
301-
}
302-
}
303-
304-
tags = local.tags
305-
}
306-
307290
module "amazon_managed_service_prometheus_irsa" {
308291
source = "../../modules/iam-role-for-service-accounts"
309292

@@ -392,6 +375,23 @@ module "vpc_cni_ipv6_irsa" {
392375
tags = local.tags
393376
}
394377

378+
module "cloudwatch_observability_irsa" {
379+
source = "../../modules/iam-role-for-service-accounts"
380+
381+
name = "cloudwatch-observability"
382+
383+
attach_cloudwatch_observability_policy = true
384+
385+
oidc_providers = {
386+
ex = {
387+
provider_arn = module.eks.oidc_provider_arn
388+
namespace_service_accounts = ["amazon-cloudwatch:cloudwatch-agent"]
389+
}
390+
}
391+
392+
tags = local.tags
393+
}
394+
395395
################################################################################
396396
# Supporting Resources
397397
################################################################################

‎examples/iam-role/README.md

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -54,18 +54,25 @@ No inputs.
5454

5555
| Name | Description |
5656
|------|-------------|
57-
| <a name="output_condition_iam_instance_profile_arn"></a> [condition\_iam\_instance\_profile\_arn](#output\_condition\_iam\_instance\_profile\_arn) | ARN assigned by AWS to the instance profile |
58-
| <a name="output_condition_iam_instance_profile_id"></a> [condition\_iam\_instance\_profile\_id](#output\_condition\_iam\_instance\_profile\_id) | Instance profile's ID |
59-
| <a name="output_condition_iam_instance_profile_name"></a> [condition\_iam\_instance\_profile\_name](#output\_condition\_iam\_instance\_profile\_name) | Name of IAM instance profile |
60-
| <a name="output_condition_iam_instance_profile_unique_id"></a> [condition\_iam\_instance\_profile\_unique\_id](#output\_condition\_iam\_instance\_profile\_unique\_id) | Stable and unique string identifying the IAM instance profile |
61-
| <a name="output_condition_iam_role_arn"></a> [condition\_iam\_role\_arn](#output\_condition\_iam\_role\_arn) | The Amazon Resource Name (ARN) specifying the IAM role |
62-
| <a name="output_condition_iam_role_name"></a> [condition\_iam\_role\_name](#output\_condition\_iam\_role\_name) | The name of the IAM role |
63-
| <a name="output_condition_iam_role_unique_id"></a> [condition\_iam\_role\_unique\_id](#output\_condition\_iam\_role\_unique\_id) | Stable and unique string identifying the IAM role |
57+
| <a name="output_github_oidc_iam_instance_profile_arn"></a> [github\_oidc\_iam\_instance\_profile\_arn](#output\_github\_oidc\_iam\_instance\_profile\_arn) | ARN assigned by AWS to the instance profile |
58+
| <a name="output_github_oidc_iam_instance_profile_id"></a> [github\_oidc\_iam\_instance\_profile\_id](#output\_github\_oidc\_iam\_instance\_profile\_id) | Instance profile's ID |
59+
| <a name="output_github_oidc_iam_instance_profile_name"></a> [github\_oidc\_iam\_instance\_profile\_name](#output\_github\_oidc\_iam\_instance\_profile\_name) | Name of IAM instance profile |
60+
| <a name="output_github_oidc_iam_instance_profile_unique_id"></a> [github\_oidc\_iam\_instance\_profile\_unique\_id](#output\_github\_oidc\_iam\_instance\_profile\_unique\_id) | Stable and unique string identifying the IAM instance profile |
61+
| <a name="output_github_oidc_iam_role_arn"></a> [github\_oidc\_iam\_role\_arn](#output\_github\_oidc\_iam\_role\_arn) | The Amazon Resource Name (ARN) specifying the IAM role |
62+
| <a name="output_github_oidc_iam_role_name"></a> [github\_oidc\_iam\_role\_name](#output\_github\_oidc\_iam\_role\_name) | The name of the IAM role |
63+
| <a name="output_github_oidc_iam_role_unique_id"></a> [github\_oidc\_iam\_role\_unique\_id](#output\_github\_oidc\_iam\_role\_unique\_id) | Stable and unique string identifying the IAM role |
6464
| <a name="output_instance_profile_iam_instance_profile_arn"></a> [instance\_profile\_iam\_instance\_profile\_arn](#output\_instance\_profile\_iam\_instance\_profile\_arn) | ARN assigned by AWS to the instance profile |
6565
| <a name="output_instance_profile_iam_instance_profile_id"></a> [instance\_profile\_iam\_instance\_profile\_id](#output\_instance\_profile\_iam\_instance\_profile\_id) | Instance profile's ID |
6666
| <a name="output_instance_profile_iam_instance_profile_name"></a> [instance\_profile\_iam\_instance\_profile\_name](#output\_instance\_profile\_iam\_instance\_profile\_name) | Name of IAM instance profile |
6767
| <a name="output_instance_profile_iam_instance_profile_unique_id"></a> [instance\_profile\_iam\_instance\_profile\_unique\_id](#output\_instance\_profile\_iam\_instance\_profile\_unique\_id) | Stable and unique string identifying the IAM instance profile |
6868
| <a name="output_instance_profile_iam_role_arn"></a> [instance\_profile\_iam\_role\_arn](#output\_instance\_profile\_iam\_role\_arn) | The Amazon Resource Name (ARN) specifying the IAM role |
6969
| <a name="output_instance_profile_iam_role_name"></a> [instance\_profile\_iam\_role\_name](#output\_instance\_profile\_iam\_role\_name) | The name of the IAM role |
7070
| <a name="output_instance_profile_iam_role_unique_id"></a> [instance\_profile\_iam\_role\_unique\_id](#output\_instance\_profile\_iam\_role\_unique\_id) | Stable and unique string identifying the IAM role |
71+
| <a name="output_saml_iam_instance_profile_arn"></a> [saml\_iam\_instance\_profile\_arn](#output\_saml\_iam\_instance\_profile\_arn) | ARN assigned by AWS to the instance profile |
72+
| <a name="output_saml_iam_instance_profile_id"></a> [saml\_iam\_instance\_profile\_id](#output\_saml\_iam\_instance\_profile\_id) | Instance profile's ID |
73+
| <a name="output_saml_iam_instance_profile_name"></a> [saml\_iam\_instance\_profile\_name](#output\_saml\_iam\_instance\_profile\_name) | Name of IAM instance profile |
74+
| <a name="output_saml_iam_instance_profile_unique_id"></a> [saml\_iam\_instance\_profile\_unique\_id](#output\_saml\_iam\_instance\_profile\_unique\_id) | Stable and unique string identifying the IAM instance profile |
75+
| <a name="output_saml_iam_role_arn"></a> [saml\_iam\_role\_arn](#output\_saml\_iam\_role\_arn) | The Amazon Resource Name (ARN) specifying the IAM role |
76+
| <a name="output_saml_iam_role_name"></a> [saml\_iam\_role\_name](#output\_saml\_iam\_role\_name) | The name of the IAM role |
77+
| <a name="output_saml_iam_role_unique_id"></a> [saml\_iam\_role\_unique\_id](#output\_saml\_iam\_role\_unique\_id) | Stable and unique string identifying the IAM role |
7178
<!-- END_TF_DOCS -->

‎examples/iam-role/outputs.tf

Lines changed: 54 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -38,40 +38,79 @@ output "instance_profile_iam_instance_profile_unique_id" {
3838
}
3939

4040
################################################################################
41-
# IAM Role - Condition
41+
# IAM Role - GitHub OIDC
4242
################################################################################
4343

44-
output "condition_iam_role_name" {
44+
output "github_oidc_iam_role_name" {
4545
description = "The name of the IAM role"
46-
value = module.iam_role_condition.name
46+
value = module.iam_role_github_oidc.name
4747
}
4848

49-
output "condition_iam_role_arn" {
49+
output "github_oidc_iam_role_arn" {
5050
description = "The Amazon Resource Name (ARN) specifying the IAM role"
51-
value = module.iam_role_condition.arn
51+
value = module.iam_role_github_oidc.arn
5252
}
5353

54-
output "condition_iam_role_unique_id" {
54+
output "github_oidc_iam_role_unique_id" {
5555
description = "Stable and unique string identifying the IAM role"
56-
value = module.iam_role_condition.unique_id
56+
value = module.iam_role_github_oidc.unique_id
5757
}
5858

59-
output "condition_iam_instance_profile_arn" {
59+
output "github_oidc_iam_instance_profile_arn" {
6060
description = "ARN assigned by AWS to the instance profile"
61-
value = module.iam_role_condition.instance_profile_arn
61+
value = module.iam_role_github_oidc.instance_profile_arn
6262
}
6363

64-
output "condition_iam_instance_profile_id" {
64+
output "github_oidc_iam_instance_profile_id" {
6565
description = "Instance profile's ID"
66-
value = module.iam_role_condition.instance_profile_id
66+
value = module.iam_role_github_oidc.instance_profile_id
6767
}
6868

69-
output "condition_iam_instance_profile_name" {
69+
output "github_oidc_iam_instance_profile_name" {
7070
description = "Name of IAM instance profile"
71-
value = module.iam_role_condition.instance_profile_name
71+
value = module.iam_role_github_oidc.instance_profile_name
7272
}
7373

74-
output "condition_iam_instance_profile_unique_id" {
74+
output "github_oidc_iam_instance_profile_unique_id" {
7575
description = "Stable and unique string identifying the IAM instance profile"
76-
value = module.iam_role_condition.instance_profile_unique_id
76+
value = module.iam_role_github_oidc.instance_profile_unique_id
77+
}
78+
79+
################################################################################
80+
# IAM Role - SAML 2.0
81+
################################################################################
82+
83+
output "saml_iam_role_name" {
84+
description = "The name of the IAM role"
85+
value = module.iam_role_saml.name
86+
}
87+
88+
output "saml_iam_role_arn" {
89+
description = "The Amazon Resource Name (ARN) specifying the IAM role"
90+
value = module.iam_role_saml.arn
91+
}
92+
93+
output "saml_iam_role_unique_id" {
94+
description = "Stable and unique string identifying the IAM role"
95+
value = module.iam_role_saml.unique_id
96+
}
97+
98+
output "saml_iam_instance_profile_arn" {
99+
description = "ARN assigned by AWS to the instance profile"
100+
value = module.iam_role_saml.instance_profile_arn
101+
}
102+
103+
output "saml_iam_instance_profile_id" {
104+
description = "Instance profile's ID"
105+
value = module.iam_role_saml.instance_profile_id
106+
}
107+
108+
output "saml_iam_instance_profile_name" {
109+
description = "Name of IAM instance profile"
110+
value = module.iam_role_saml.instance_profile_name
111+
}
112+
113+
output "saml_iam_instance_profile_unique_id" {
114+
description = "Stable and unique string identifying the IAM instance profile"
115+
value = module.iam_role_saml.instance_profile_unique_id
77116
}

‎modules/iam-role/README.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,10 @@ No modules.
179179
| Name | Description |
180180
|------|-------------|
181181
| <a name="output_arn"></a> [arn](#output\_arn) | The Amazon Resource Name (ARN) specifying the IAM role |
182+
| <a name="output_instance_profile_arn"></a> [instance\_profile\_arn](#output\_instance\_profile\_arn) | ARN assigned by AWS to the instance profile |
183+
| <a name="output_instance_profile_id"></a> [instance\_profile\_id](#output\_instance\_profile\_id) | Instance profile's ID |
184+
| <a name="output_instance_profile_name"></a> [instance\_profile\_name](#output\_instance\_profile\_name) | Name of IAM instance profile |
185+
| <a name="output_instance_profile_unique_id"></a> [instance\_profile\_unique\_id](#output\_instance\_profile\_unique\_id) | Stable and unique string identifying the IAM instance profile |
182186
| <a name="output_name"></a> [name](#output\_name) | The name of the IAM role |
183187
| <a name="output_unique_id"></a> [unique\_id](#output\_unique\_id) | Stable and unique string identifying the IAM role |
184188
<!-- END_TF_DOCS -->

‎modules/iam-role/outputs.tf

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,3 +16,27 @@ output "unique_id" {
1616
description = "Stable and unique string identifying the IAM role"
1717
value = try(aws_iam_role.this[0].unique_id, null)
1818
}
19+
20+
################################################################################
21+
# IAM Instance Profile
22+
################################################################################
23+
24+
output "instance_profile_arn" {
25+
description = "ARN assigned by AWS to the instance profile"
26+
value = try(aws_iam_instance_profile.this[0].arn, null)
27+
}
28+
29+
output "instance_profile_id" {
30+
description = "Instance profile's ID"
31+
value = try(aws_iam_instance_profile.this[0].id, null)
32+
}
33+
34+
output "instance_profile_name" {
35+
description = "Name of IAM instance profile"
36+
value = try(aws_iam_instance_profile.this[0].name, null)
37+
}
38+
39+
output "instance_profile_unique_id" {
40+
description = "Stable and unique string identifying the IAM instance profile"
41+
value = try(aws_iam_instance_profile.this[0].unique_id, null)
42+
}

0 commit comments

Comments
 (0)