Skip to content

Commit e00526e

Browse files
cdhessecdhesse
authored
feat: Add load_balancer_controller targetgroup binding only role (#199)
1 parent 81d5db3 commit e00526e

File tree

5 files changed

+73
-0
lines changed

5 files changed

+73
-0
lines changed

‎examples/iam-role-for-service-accounts-eks/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ No providers.
3838
| <a name="module_irsa_role"></a> [irsa\_role](#module\_irsa\_role) | ../../modules/iam-role-for-service-accounts-eks | n/a |
3939
| <a name="module_karpenter_controller_irsa_role"></a> [karpenter\_controller\_irsa\_role](#module\_karpenter\_controller\_irsa\_role) | ../../modules/iam-role-for-service-accounts-eks | n/a |
4040
| <a name="module_load_balancer_controller_irsa_role"></a> [load\_balancer\_controller\_irsa\_role](#module\_load\_balancer\_controller\_irsa\_role) | ../../modules/iam-role-for-service-accounts-eks | n/a |
41+
| <a name="module_load_balancer_controller_targetgroup_binding_only_irsa_role"></a> [load\_balancer\_controller\_targetgroup\_binding\_only\_irsa\_role](#module\_load\_balancer\_controller\_targetgroup\_binding\_only\_irsa\_role) | ../../modules/iam-role-for-service-accounts-eks | n/a |
4142
| <a name="module_node_termination_handler_irsa_role"></a> [node\_termination\_handler\_irsa\_role](#module\_node\_termination\_handler\_irsa\_role) | ../../modules/iam-role-for-service-accounts-eks | n/a |
4243
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3.0 |
4344
| <a name="module_vpc_cni_ipv4_irsa_role"></a> [vpc\_cni\_ipv4\_irsa\_role](#module\_vpc\_cni\_ipv4\_irsa\_role) | ../../modules/iam-role-for-service-accounts-eks | n/a |

‎examples/iam-role-for-service-accounts-eks/main.tf

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,22 @@ module "load_balancer_controller_irsa_role" {
182182
tags = local.tags
183183
}
184184

185+
module "load_balancer_controller_targetgroup_binding_only_irsa_role" {
186+
source = "../../modules/iam-role-for-service-accounts-eks"
187+
188+
role_name = "load_balancer_controller_targetgroup_binding_only"
189+
attach_load_balancer_controller_targetgroup_binding_only_policy = true
190+
191+
oidc_providers = {
192+
ex = {
193+
provider_arn = module.eks.oidc_provider_arn
194+
namespace_service_accounts = ["kube-system:aws-load-balancer-controller"]
195+
}
196+
}
197+
198+
tags = local.tags
199+
}
200+
185201
################################################################################
186202
# Supporting Resources
187203
################################################################################

‎modules/iam-role-for-service-accounts-eks/README.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,7 @@ No modules.
113113
| [aws_iam_policy.external_dns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
114114
| [aws_iam_policy.karpenter_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
115115
| [aws_iam_policy.load_balancer_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
116+
| [aws_iam_policy.load_balancer_controller_targetgroup_only](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
116117
| [aws_iam_policy.node_termination_handler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
117118
| [aws_iam_policy.vpc_cni](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
118119
| [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
@@ -121,6 +122,7 @@ No modules.
121122
| [aws_iam_role_policy_attachment.external_dns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
122123
| [aws_iam_role_policy_attachment.karpenter_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
123124
| [aws_iam_role_policy_attachment.load_balancer_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
125+
| [aws_iam_role_policy_attachment.load_balancer_controller_targetgroup_only](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
124126
| [aws_iam_role_policy_attachment.node_termination_handler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
125127
| [aws_iam_role_policy_attachment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
126128
| [aws_iam_role_policy_attachment.vpc_cni](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
@@ -130,6 +132,7 @@ No modules.
130132
| [aws_iam_policy_document.external_dns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
131133
| [aws_iam_policy_document.karpenter_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
132134
| [aws_iam_policy_document.load_balancer_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
135+
| [aws_iam_policy_document.load_balancer_controller_targetgroup_only](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
133136
| [aws_iam_policy_document.node_termination_handler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
134137
| [aws_iam_policy_document.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
135138
| [aws_iam_policy_document.vpc_cni](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
@@ -145,6 +148,7 @@ No modules.
145148
| <a name="input_attach_external_dns_policy"></a> [attach\_external\_dns\_policy](#input\_attach\_external\_dns\_policy) | Determines whether to attach the External DNS IAM policy to the role | `bool` | `false` | no |
146149
| <a name="input_attach_karpenter_controller_policy"></a> [attach\_karpenter\_controller\_policy](#input\_attach\_karpenter\_controller\_policy) | Determines whether to attach the Karpenter Controller policy to the role | `bool` | `false` | no |
147150
| <a name="input_attach_load_balancer_controller_policy"></a> [attach\_load\_balancer\_controller\_policy](#input\_attach\_load\_balancer\_controller\_policy) | Determines whether to attach the Load Balancer Controller policy to the role | `bool` | `false` | no |
151+
| <a name="input_attach_load_balancer_controller_targetgroup_binding_only_policy"></a> [attach\_load\_balancer\_controller\_targetgroup\_binding\_only\_policy](#input\_attach\_load\_balancer\_controller\_targetgroup\_binding\_only\_policy) | Determines whether to attach the Load Balancer Controller policy for the TargetGroupBinding only | `bool` | `false` | no |
148152
| <a name="input_attach_node_termination_handler_policy"></a> [attach\_node\_termination\_handler\_policy](#input\_attach\_node\_termination\_handler\_policy) | Determines whether to attach the Node Termination Handler policy to the role | `bool` | `false` | no |
149153
| <a name="input_attach_vpc_cni_policy"></a> [attach\_vpc\_cni\_policy](#input\_attach\_vpc\_cni\_policy) | Determines whether to attach the VPC CNI IAM policy to the role | `bool` | `false` | no |
150154
| <a name="input_cluster_autoscaler_cluster_ids"></a> [cluster\_autoscaler\_cluster\_ids](#input\_cluster\_autoscaler\_cluster\_ids) | List of cluster IDs to appropriately scope permissions within the Cluster Autoscaler IAM policy | `list(string)` | `[]` | no |

‎modules/iam-role-for-service-accounts-eks/policies.tf

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -763,3 +763,47 @@ resource "aws_iam_role_policy_attachment" "load_balancer_controller" {
763763
role = aws_iam_role.this[0].name
764764
policy_arn = aws_iam_policy.load_balancer_controller[0].arn
765765
}
766+
767+
################################################################################
768+
# AWS Load Balancer Controller TargetGroup Binding Only Policy
769+
################################################################################
770+
771+
# https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/guide/targetgroupbinding/targetgroupbinding/#reference
772+
# https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/deploy/installation/#setup-iam-manually
773+
data "aws_iam_policy_document" "load_balancer_controller_targetgroup_only" {
774+
count = var.create_role && var.attach_load_balancer_controller_targetgroup_binding_only_policy ? 1 : 0
775+
776+
statement {
777+
actions = [
778+
"ec2:DescribeSecurityGroups",
779+
"ec2:DescribeInstances",
780+
"ec2:DescribeVpcs",
781+
"elasticloadbalancing:DescribeTargetGroups",
782+
"elasticloadbalancing:DescribeTargetHealth",
783+
"elasticloadbalancing:ModifyTargetGroup",
784+
"elasticloadbalancing:ModifyTargetGroupAttributes",
785+
"elasticloadbalancing:RegisterTargets",
786+
"elasticloadbalancing:DeregisterTargets"
787+
]
788+
789+
resources = ["*"]
790+
}
791+
}
792+
793+
resource "aws_iam_policy" "load_balancer_controller_targetgroup_only" {
794+
count = var.create_role && var.attach_load_balancer_controller_targetgroup_binding_only_policy ? 1 : 0
795+
796+
name_prefix = "AmazonEKS_AWS_Load_Balancer_Controller_TargetGroup_Only-"
797+
path = var.role_path
798+
description = "Provides permissions for AWS Load Balancer Controller addon in TargetGroup binding only scenario."
799+
policy = data.aws_iam_policy_document.load_balancer_controller_targetgroup_only[0].json
800+
801+
tags = var.tags
802+
}
803+
804+
resource "aws_iam_role_policy_attachment" "load_balancer_controller_targetgroup_only" {
805+
count = var.create_role && var.attach_load_balancer_controller_targetgroup_binding_only_policy ? 1 : 0
806+
807+
role = aws_iam_role.this[0].name
808+
policy_arn = aws_iam_policy.load_balancer_controller_targetgroup_only[0].arn
809+
}

‎modules/iam-role-for-service-accounts-eks/variables.tf

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,3 +177,11 @@ variable "attach_load_balancer_controller_policy" {
177177
type = bool
178178
default = false
179179
}
180+
181+
# https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/guide/targetgroupbinding/targetgroupbinding/#reference
182+
# https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.4/deploy/installation/#setup-iam-manually
183+
variable "attach_load_balancer_controller_targetgroup_binding_only_policy" {
184+
description = "Determines whether to attach the Load Balancer Controller policy for the TargetGroupBinding only"
185+
type = bool
186+
default = false
187+
}

0 commit comments

Comments
 (0)