Skip to content

Commit c7278f2

Browse files
ivankatliarchukivankatliarchuk
committed
added oidc example
1 parent a3b861e commit c7278f2

File tree

3 files changed

+185
-4
lines changed

3 files changed

+185
-4
lines changed

‎examples/README.md‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,3 @@ These serve a few purposes:
55
1. Shows developers how to use the module in a straightforward way as integrated with other terraform community supported modules.
66
2. Serves as the test infrastructure for CI on the project.
77
3. Provides a simple way to play with the Kubernetes cluster you create.
8-
9-
## IAM Permissions
10-
11-
You can see the minimum IAM Permissions required (WORK in PROGRESS)

‎examples/oidc/README.md‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# OIDC setup
2+
3+
> Un-tested
4+
5+
Hands-on: For an example of aws_eks_cluster in use, follow the [Provision an EKS Cluster](https://learn.hashicorp.com/tutorials/terraform/eks) tutorial on HashiCorp Learn.
6+
7+
## Usage
8+
9+
To run this example you need to execute:
10+
11+
```bash
12+
$ terraform init
13+
$ terraform plan
14+
$ terraform apply
15+
```
16+
17+
Note that this example may create resources which cost money. Run `terraform destroy` when you don't need these resources.
18+
19+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
20+
## Requirements
21+
22+
No requirements.
23+
24+
## Providers
25+
26+
| Name | Version |
27+
|------|---------|
28+
| <a name="provider_aws"></a> [aws](#provider\_aws) | n/a |
29+
30+
## Modules
31+
32+
| Name | Source | Version |
33+
|------|--------|---------|
34+
| <a name="module_velero"></a> [velero](#module\_velero) | terraform-module/velero/kubernetes | ~> 1 |
35+
36+
## Resources
37+
38+
| Name | Type |
39+
|------|------|
40+
| [aws_iam_openid_connect_provider.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_openid_connect_provider) | resource |
41+
| [aws_caller_identity.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
42+
| [aws_eks_cluster.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
43+
44+
## Inputs
45+
46+
No inputs.
47+
48+
## Outputs
49+
50+
No outputs.
51+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/oidc/main.tf‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
data "aws_caller_identity" "this" {}
2+
3+
data "aws_eks_cluster" "this" {
4+
name = "my-cluster-name"
5+
}
6+
7+
locals {
8+
openid_connect_provider_uri = replace(aws_iam_openid_connect_provider.this.url, "https://", "")
9+
}
10+
11+
resource "aws_iam_openid_connect_provider" "this" {
12+
client_id_list = ["sts.amazonaws.com"]
13+
thumbprint_list = [data.tls_certificate.this.certificates[0].sha1_fingerprin]
14+
url = aws_eks_cluster.this.identity[0].oidc[0].issuer
15+
}
16+
17+
module "velero" {
18+
source = "terraform-module/velero/kubernetes"
19+
version = "~> 1"
20+
21+
count = 1
22+
23+
namespace_deploy = "velero"
24+
app_deploy = true
25+
cluster_name = "my-cluster-name"
26+
openid_connect_provider_uri = local.openid_connect_provider_uri
27+
bucket = "my-cluster-name"
28+
app = {
29+
name = "velero"
30+
version = "2.29.4"
31+
chart = "velero"
32+
force_update = false
33+
wait = true
34+
recreate_pods = true
35+
deploy = false
36+
max_history = 1
37+
image = null
38+
tag = null
39+
}
40+
tags = {}
41+
42+
values = [<<EOF
43+
# https://github.com/vmware-tanzu/helm-charts/tree/master/charts/velero
44+
45+
image:
46+
repository: velero/velero
47+
tag: v1.8.1
48+
49+
# https://aws.amazon.com/blogs/containers/backup-and-restore-your-amazon-eks-cluster-resources-using-velero/
50+
# https://github.com/vmware-tanzu/velero-plugin-for-aws
51+
initContainers:
52+
- name: velero-plugin-for-aws
53+
image: velero/velero-plugin-for-aws:v1.4.1
54+
imagePullPolicy: IfNotPresent
55+
volumeMounts:
56+
- mountPath: /target
57+
name: plugins
58+
59+
# Install CRDs as a templates. Enabled by default.
60+
installCRDs: true
61+
62+
# SecurityContext to use for the Velero deployment. Optional.
63+
# Set fsGroup for `AWS IAM Roles for Service Accounts`
64+
# see more informations at: https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html
65+
securityContext:
66+
fsGroup: 1337
67+
# fsGroup: 65534
68+
69+
##
70+
## Parameters for the `default` BackupStorageLocation and VolumeSnapshotLocation,
71+
## and additional server settings.
72+
##
73+
configuration:
74+
provider: aws
75+
76+
backupStorageLocation:
77+
name: default
78+
provider: aws
79+
bucket: "velero-backups"
80+
prefix: "velero/sandbox/my-cluster-name"
81+
config:
82+
region: eu-west-1
83+
84+
volumeSnapshotLocation:
85+
name: default
86+
provider: aws
87+
# Additional provider-specific configuration. See link above
88+
# for details of required/optional fields for your provider.
89+
config:
90+
region: eu-west-1
91+
92+
# These are server-level settings passed as CLI flags to the `velero server` command. Velero
93+
# uses default values if they're not passed in, so they only need to be explicitly specified
94+
# here if using a non-default value. The `velero server` default values are shown in the
95+
# comments below.
96+
# --------------------
97+
# `velero server` default: 1m
98+
backupSyncPeriod:
99+
# `velero server` default: 1h
100+
resticTimeout:
101+
# `velero server` default: namespaces,persistentvolumes,persistentvolumeclaims,secrets,configmaps,serviceaccounts,limitranges,pods
102+
restoreResourcePriorities:
103+
# `velero server` default: false
104+
restoreOnlyMode:
105+
106+
extraEnvVars:
107+
AWS_CLUSTER_NAME: my-cluster-name
108+
109+
# Set log-level for Velero pod. Default: info. Other options: debug, warning, error, fatal, panic.
110+
logLevel: info
111+
112+
##
113+
## End of backup/snapshot location settings.
114+
##
115+
116+
##
117+
## Settings for additional Velero resources.
118+
##
119+
rbac:
120+
create: true
121+
clusterAdministrator: true
122+
123+
credentials:
124+
# Whether a secret should be used as the source of IAM account
125+
# credentials. Set to false if, for example, using kube2iam or
126+
# kiam to provide IAM credentials for the Velero pod.
127+
useSecret: false
128+
129+
backupsEnabled: true
130+
snapshotsEnabled: true
131+
deployRestic: false
132+
EOF
133+
]
134+
}

0 commit comments

Comments
 (0)