Skip to content

Commit 949c500

Browse files
posquit0posquit0
committed
Add eks-iam-access module
1 parent f52924d commit 949c500

File tree

9 files changed

+313
-1
lines changed

9 files changed

+313
-1
lines changed

‎.github/labeler.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@
1717
":floppy_disk: eks-fargate-profile":
1818
- modules/eks-fargate-profile/**/*
1919

20+
":floppy_disk: eks-iam-access":
21+
- modules/eks-iam-access/**/*
22+
2023
":floppy_disk: eks-max-pods":
2124
- modules/eks-max-pods/**/*
2225

‎.github/labels.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,6 +58,9 @@
5858
- color: "fbca04"
5959
description: "This issue or pull request is related to eks-fargate-profile module."
6060
name: ":floppy_disk: eks-fargate-profile"
61+
- color: "fbca04"
62+
description: "This issue or pull request is related to eks-iam-access module."
63+
name: ":floppy_disk: eks-iam-access"
6164
- color: "fbca04"
6265
description: "This issue or pull request is related to eks-max-pods module."
6366
name: ":floppy_disk: eks-max-pods"

‎README.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ Terraform module which creates resources for container services on AWS.
1212
- [eks-aws-auth](./modules/eks-aws-auth)
1313
- [eks-cluster](./modules/eks-cluster)
1414
- [eks-fargate-profile](./modules/eks-fargate-profile)
15+
- [eks-iam-access](./modules/eks-iam-access)
1516
- [eks-max-pods](./modules/eks-max-pods)
1617

1718

@@ -31,6 +32,7 @@ Terraform Modules from [this package](https://github.com/tedilabs/terraform-aws-
3132
- Add-on
3233
- Self-Managed Node Group (with ASG)
3334
- Fargate Profile
35+
- Access Entry & Access Policy
3436

3537

3638
## Self Promotion
@@ -42,4 +44,4 @@ Like this project? Follow the repository on [GitHub](https://github.com/tedilabs
4244

4345
Provided under the terms of the [Apache License](LICENSE).
4446

45-
Copyright © 2021-2023, [Byungjin Park](https://www.posquit0.com).
47+
Copyright © 2021-2024, [Byungjin Park](https://www.posquit0.com).

‎modules/eks-iam-access/README.md

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
# eks-iam-access
2+
3+
This module creates following resources.
4+
5+
- `aws_eks_access_entry` (optional)
6+
- `aws_eks_access_policy_association` (optional)
7+
8+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
9+
## Requirements
10+
11+
| Name | Version |
12+
|------|---------|
13+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.6 |
14+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.42 |
15+
16+
## Providers
17+
18+
| Name | Version |
19+
|------|---------|
20+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.50.0 |
21+
22+
## Modules
23+
24+
| Name | Source | Version |
25+
|------|--------|---------|
26+
| <a name="module_resource_group"></a> [resource\_group](#module\_resource\_group) | tedilabs/misc/aws//modules/resource-group | ~> 0.10.0 |
27+
28+
## Resources
29+
30+
| Name | Type |
31+
|------|------|
32+
| [aws_eks_access_entry.node](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_access_entry) | resource |
33+
| [aws_eks_access_entry.user](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_access_entry) | resource |
34+
35+
## Inputs
36+
37+
| Name | Description | Type | Default | Required |
38+
|------|-------------|------|---------|:--------:|
39+
| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | (Required) The name of the Amazon EKS cluster to create IAM access entries. | `string` | n/a | yes |
40+
| <a name="input_module_tags_enabled"></a> [module\_tags\_enabled](#input\_module\_tags\_enabled) | (Optional) Whether to create AWS Resource Tags for the module informations. | `bool` | `true` | no |
41+
| <a name="input_node_access_entries"></a> [node\_access\_entries](#input\_node\_access\_entries) | (Optional) A list of configurations for EKS access entries for nodes (EC2 instances, Fargate) that are allowed to access the EKS cluster. Each item of `node_access_entries` block as defined below.<br> (Required) `name` - A unique name for the access entry. This value is only used internally within Terraform code.<br> (Required) `type` - The type of the access entry. Valid values are `EC2_LINUX`, `EC2_WINDOWS`, `FARGATE_LINUX`.<br> (Required) `principal` - The ARN of one, and only one, existing IAM principal to grant access to Kubernetes objects on the cluster. An IAM principal can't be included in more than one access entry. | <pre>list(object({<br> name = string<br> type = string<br> principal = string<br> }))</pre> | `[]` | no |
42+
| <a name="input_resource_group_description"></a> [resource\_group\_description](#input\_resource\_group\_description) | (Optional) The description of Resource Group. | `string` | `"Managed by Terraform."` | no |
43+
| <a name="input_resource_group_enabled"></a> [resource\_group\_enabled](#input\_resource\_group\_enabled) | (Optional) Whether to create Resource Group to find and group AWS resources which are created by this module. | `bool` | `true` | no |
44+
| <a name="input_resource_group_name"></a> [resource\_group\_name](#input\_resource\_group\_name) | (Optional) The name of Resource Group. A Resource Group name can have a maximum of 127 characters, including letters, numbers, hyphens, dots, and underscores. The name cannot start with `AWS` or `aws`. | `string` | `""` | no |
45+
| <a name="input_tags"></a> [tags](#input\_tags) | (Optional) A map of tags to add to all resources. | `map(string)` | `{}` | no |
46+
| <a name="input_timeouts"></a> [timeouts](#input\_timeouts) | (Optional) How long to wait for the EKS Cluster to be created/updated/deleted. | <pre>object({<br> create = optional(string, "30m")<br> update = optional(string, "60m")<br> delete = optional(string, "15m")<br> })</pre> | `{}` | no |
47+
| <a name="input_user_access_entries"></a> [user\_access\_entries](#input\_user\_access\_entries) | (Optional) A list of configurations for EKS access entries for users (IAM roles, users) that are allowed to access the EKS cluster. Each item of `user_access_entries` block as defined below.<br> (Required) `name` - A unique name for the access entry. This value is only used internally within Terraform code.<br> (Required) `principal` - The ARN of one, and only one, existing IAM principal to grant access to Kubernetes objects on the cluster. An IAM principal can't be included in more than one access entry.<br> (Optional) `username` - The username to authenticate to Kubernetes with. We recommend not specifying a username and letting Amazon EKS specify it for you. Defaults to the IAM principal ARN.<br> (Optional) `groups` - A set of groups within the Kubernetes cluster. | <pre>list(object({<br> name = string<br> principal = string<br> username = optional(string)<br> groups = optional(set(string), [])<br> }))</pre> | `[]` | no |
48+
49+
## Outputs
50+
51+
| Name | Description |
52+
|------|-------------|
53+
| <a name="output_cluster_name"></a> [cluster\_name](#output\_cluster\_name) | The name of the EKS cluster. |
54+
| <a name="output_node_access_entries"></a> [node\_access\_entries](#output\_node\_access\_entries) | The list of configurations for EKS access entries for nodes (EC2 instances, Fargate). |
55+
| <a name="output_user_access_entries"></a> [user\_access\_entries](#output\_user\_access\_entries) | The list of configurations for EKS access entries for users (IAM roles, users). |
56+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎modules/eks-iam-access/main.tf

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
locals {
2+
metadata = {
3+
package = "terraform-aws-container"
4+
version = trimspace(file("${path.module}/../../VERSION"))
5+
module = basename(path.module)
6+
name = "eks/${var.cluster_name}/iam-access"
7+
}
8+
module_tags = var.module_tags_enabled ? {
9+
"module.terraform.io/package" = local.metadata.package
10+
"module.terraform.io/version" = local.metadata.version
11+
"module.terraform.io/name" = local.metadata.module
12+
"module.terraform.io/full-name" = "${local.metadata.package}/${local.metadata.module}"
13+
"module.terraform.io/instance" = local.metadata.name
14+
} : {}
15+
}
16+
17+
18+
###################################################
19+
# Node Access Entries
20+
###################################################
21+
22+
# INFO: Not supported attributes
23+
# - `user_name`
24+
# - `kubernetes_groups`
25+
resource "aws_eks_access_entry" "node" {
26+
for_each = {
27+
for entry in var.node_access_entries :
28+
entry.name => entry
29+
}
30+
31+
cluster_name = var.cluster_name
32+
type = each.value.type
33+
principal_arn = each.value.principal
34+
35+
tags = merge(
36+
{
37+
"Name" = each.key
38+
},
39+
local.module_tags,
40+
var.tags,
41+
)
42+
}
43+
44+
45+
###################################################
46+
# User Access Entries
47+
###################################################
48+
49+
resource "aws_eks_access_entry" "user" {
50+
for_each = {
51+
for entry in var.user_access_entries :
52+
entry.name => entry
53+
}
54+
55+
cluster_name = var.cluster_name
56+
type = "STANDARD"
57+
principal_arn = each.value.principal
58+
59+
user_name = each.value.username
60+
kubernetes_groups = each.value.groups
61+
62+
tags = merge(
63+
{
64+
"Name" = each.key
65+
},
66+
local.module_tags,
67+
var.tags,
68+
)
69+
}

‎modules/eks-iam-access/outputs.tf

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
output "cluster_name" {
2+
description = "The name of the EKS cluster."
3+
value = var.cluster_name
4+
}
5+
6+
output "node_access_entries" {
7+
description = <<EOF
8+
The list of configurations for EKS access entries for nodes (EC2 instances, Fargate).
9+
EOF
10+
value = {
11+
for name, entry in aws_eks_access_entry.node :
12+
name => {
13+
arn = entry.access_entry_arn
14+
type = entry.type
15+
principal = entry.principal_arn
16+
username = entry.user_name
17+
groups = entry.kubernetes_groups
18+
created_at = entry.created_at
19+
updated_at = entry.modified_at
20+
}
21+
}
22+
}
23+
24+
output "user_access_entries" {
25+
description = <<EOF
26+
The list of configurations for EKS access entries for users (IAM roles, users).
27+
EOF
28+
value = {
29+
for name, entry in aws_eks_access_entry.user :
30+
name => {
31+
arn = entry.access_entry_arn
32+
type = entry.type
33+
principal = entry.principal_arn
34+
username = entry.user_name
35+
groups = entry.kubernetes_groups
36+
created_at = entry.created_at
37+
updated_at = entry.modified_at
38+
}
39+
}
40+
}

‎modules/eks-iam-access/resource-group.tf

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
locals {
2+
resource_group_name = (var.resource_group_name != ""
3+
? var.resource_group_name
4+
: join(".", [
5+
local.metadata.package,
6+
local.metadata.module,
7+
replace(local.metadata.name, "/[^a-zA-Z0-9_\\.-]/", "-"),
8+
])
9+
)
10+
}
11+
12+
13+
module "resource_group" {
14+
source = "tedilabs/misc/aws//modules/resource-group"
15+
version = "~> 0.10.0"
16+
17+
count = (var.resource_group_enabled && var.module_tags_enabled) ? 1 : 0
18+
19+
name = local.resource_group_name
20+
description = var.resource_group_description
21+
22+
query = {
23+
resource_tags = local.module_tags
24+
}
25+
26+
module_tags_enabled = false
27+
tags = merge(
28+
local.module_tags,
29+
var.tags,
30+
)
31+
}

‎modules/eks-iam-access/variables.tf

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
variable "cluster_name" {
2+
description = "(Required) The name of the Amazon EKS cluster to create IAM access entries."
3+
type = string
4+
nullable = false
5+
}
6+
7+
variable "node_access_entries" {
8+
description = <<EOF
9+
(Optional) A list of configurations for EKS access entries for nodes (EC2 instances, Fargate) that are allowed to access the EKS cluster. Each item of `node_access_entries` block as defined below.
10+
(Required) `name` - A unique name for the access entry. This value is only used internally within Terraform code.
11+
(Required) `type` - The type of the access entry. Valid values are `EC2_LINUX`, `EC2_WINDOWS`, `FARGATE_LINUX`.
12+
(Required) `principal` - The ARN of one, and only one, existing IAM principal to grant access to Kubernetes objects on the cluster. An IAM principal can't be included in more than one access entry.
13+
EOF
14+
type = list(object({
15+
name = string
16+
type = string
17+
principal = string
18+
}))
19+
default = []
20+
nullable = false
21+
22+
validation {
23+
condition = alltrue([
24+
for entry in var.node_access_entries :
25+
contains(["EC2_LINUX", "EC2_WINDOWS", "FARGATE_LINUX"], entry.type)
26+
])
27+
error_message = "Valid values for `type` are `EC2_LINUX`, `EC2_WINDOWS`, `FARGATE_LINUX`."
28+
}
29+
}
30+
31+
variable "user_access_entries" {
32+
description = <<EOF
33+
(Optional) A list of configurations for EKS access entries for users (IAM roles, users) that are allowed to access the EKS cluster. Each item of `user_access_entries` block as defined below.
34+
(Required) `name` - A unique name for the access entry. This value is only used internally within Terraform code.
35+
(Required) `principal` - The ARN of one, and only one, existing IAM principal to grant access to Kubernetes objects on the cluster. An IAM principal can't be included in more than one access entry.
36+
(Optional) `username` - The username to authenticate to Kubernetes with. We recommend not specifying a username and letting Amazon EKS specify it for you. Defaults to the IAM principal ARN.
37+
(Optional) `groups` - A set of groups within the Kubernetes cluster.
38+
EOF
39+
type = list(object({
40+
name = string
41+
principal = string
42+
username = optional(string)
43+
groups = optional(set(string), [])
44+
}))
45+
default = []
46+
nullable = false
47+
}
48+
49+
variable "timeouts" {
50+
description = "(Optional) How long to wait for the EKS Cluster to be created/updated/deleted."
51+
type = object({
52+
create = optional(string, "30m")
53+
update = optional(string, "60m")
54+
delete = optional(string, "15m")
55+
})
56+
default = {}
57+
nullable = false
58+
}
59+
60+
variable "tags" {
61+
description = "(Optional) A map of tags to add to all resources."
62+
type = map(string)
63+
default = {}
64+
nullable = false
65+
}
66+
67+
variable "module_tags_enabled" {
68+
description = "(Optional) Whether to create AWS Resource Tags for the module informations."
69+
type = bool
70+
default = true
71+
nullable = false
72+
}
73+
74+
75+
###################################################
76+
# Resource Group
77+
###################################################
78+
79+
variable "resource_group_enabled" {
80+
description = "(Optional) Whether to create Resource Group to find and group AWS resources which are created by this module."
81+
type = bool
82+
default = true
83+
nullable = false
84+
}
85+
86+
variable "resource_group_name" {
87+
description = "(Optional) The name of Resource Group. A Resource Group name can have a maximum of 127 characters, including letters, numbers, hyphens, dots, and underscores. The name cannot start with `AWS` or `aws`."
88+
type = string
89+
default = ""
90+
nullable = false
91+
}
92+
93+
variable "resource_group_description" {
94+
description = "(Optional) The description of Resource Group."
95+
type = string
96+
default = "Managed by Terraform."
97+
nullable = false
98+
}

‎modules/eks-iam-access/versions.tf

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_version = ">= 1.6"
3+
4+
required_providers {
5+
aws = {
6+
source = "hashicorp/aws"
7+
version = ">= 5.42"
8+
}
9+
}
10+
}

0 commit comments

Comments
 (0)