From f881745f0062ad6b425500321b7c31465c6afbad Mon Sep 17 00:00:00 2001 From: Max Williams Date: Mon, 9 Jul 2018 10:40:25 +0200 Subject: [PATCH 1/3] formatting and minor cosmetic fixes --- README.md | 10 +++++----- cluster.tf | 2 +- data.tf | 16 ++++++++-------- outputs.tf | 10 +++++----- workers.tf | 16 ++++++++-------- 5 files changed, 27 insertions(+), 27 deletions(-) diff --git a/README.md b/README.md index 38fac852f1..4ca0414df7 100644 --- a/README.md +++ b/README.md @@ -98,18 +98,18 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | cluster_security_group_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the workers and provide API access to your current IP/32. | string | `` | no | | cluster_version | Kubernetes version to use for the EKS cluster. | string | `1.10` | no | | config_output_path | Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. | string | `./` | no | -| configure_kubectl_session | Configure the current session's kubectl to use the instantiated EKS cluster. | string | `true` | no | -| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | string | `` | no | +| configure_kubectl_session | Configure the current session's kubectl to use the instantiated EKS cluster. | boolean | `true` | no | +| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | list | `` | no | | kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | string | `heptio-authenticator-aws` | no | | kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | string | `` | no | | kubeconfig_name | Override the default name used for items kubeconfig. | string | `` | no | | subnets | A list of subnets to place the EKS cluster and workers within. | list | - | yes | -| tags | A map of tags to add to all resources. | string | `` | no | +| tags | A map of tags to add to all resources. | map | `` | no | | vpc_id | VPC where the cluster and workers will be deployed. | string | - | yes | -| worker_groups | A list of maps defining worker group configurations. See workers_group_defaults for valid keys. | list | `` | no | +| worker_groups | A list of maps defining worker group configurations. See workers_group_defaults for valid keys. | list | `` | no | | worker_security_group_id | If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the EKS cluster. | string | `` | no | | worker_sg_ingress_from_port | Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443). | string | `1025` | no | -| workers_group_defaults | Default values for target groups as defined by the list of maps. | map | `` | no | +| workers_group_defaults | Default values for target groups as defined by the list of maps. | map | `` | no | | workstation_cidr | Override the default ingress rule that allows communication with the EKS cluster API. If not given, will use current IP/32. | string | `` | no | ## Outputs diff --git a/cluster.tf b/cluster.tf index 87ad721328..3abe7742b8 100644 --- a/cluster.tf +++ b/cluster.tf @@ -1,4 +1,4 @@ -resource "aws_eks_cluster" "this" { +resource "aws_eks_cluster" "cluster" { name = "${var.cluster_name}" role_arn = "${aws_iam_role.cluster.arn}" version = "${var.cluster_version}" diff --git a/data.tf b/data.tf index 9d54f87799..1a4742008b 100644 --- a/data.tf +++ b/data.tf @@ -48,11 +48,11 @@ data "template_file" "kubeconfig" { template = "${file("${path.module}/templates/kubeconfig.tpl")}" vars { - cluster_name = "${var.cluster_name}" + cluster_name = "${aws_eks_cluster.cluster.name}" + endpoint = "${aws_eks_cluster.cluster.endpoint}" kubeconfig_name = "${local.kubeconfig_name}" - endpoint = "${aws_eks_cluster.this.endpoint}" region = "${data.aws_region.current.name}" - cluster_auth_base64 = "${aws_eks_cluster.this.certificate_authority.0.data}" + cluster_auth_base64 = "${aws_eks_cluster.cluster.certificate_authority.0.data}" aws_authenticator_command = "${var.kubeconfig_aws_authenticator_command}" aws_authenticator_additional_args = "${length(var.kubeconfig_aws_authenticator_additional_args) > 0 ? " - ${join("\n - ", var.kubeconfig_aws_authenticator_additional_args)}" : "" }" aws_authenticator_env_variables = "${length(var.kubeconfig_aws_authenticator_env_variables) > 0 ? " env:\n${join("\n", data.template_file.aws_authenticator_env_variables.*.rendered)}" : ""}" @@ -73,7 +73,7 @@ EOF } } -data template_file config_map_aws_auth { +data "template_file" "config_map_aws_auth" { template = "${file("${path.module}/templates/config-map-aws-auth.yaml.tpl")}" vars { @@ -81,15 +81,15 @@ data template_file config_map_aws_auth { } } -data template_file userdata { +data "template_file" "userdata" { template = "${file("${path.module}/templates/userdata.sh.tpl")}" count = "${length(var.worker_groups)}" vars { region = "${data.aws_region.current.name}" - cluster_name = "${var.cluster_name}" - endpoint = "${aws_eks_cluster.this.endpoint}" - cluster_auth_base64 = "${aws_eks_cluster.this.certificate_authority.0.data}" + cluster_name = "${aws_eks_cluster.cluster.name}" + endpoint = "${aws_eks_cluster.cluster.endpoint}" + cluster_auth_base64 = "${aws_eks_cluster.cluster.certificate_authority.0.data}" max_pod_count = "${lookup(local.max_pod_per_node, lookup(var.worker_groups[count.index], "instance_type", lookup(var.workers_group_defaults, "instance_type")))}" pre_userdata = "${lookup(var.worker_groups[count.index], "pre_userdata",lookup(var.workers_group_defaults, "pre_userdata"))}" additional_userdata = "${lookup(var.worker_groups[count.index], "additional_userdata",lookup(var.workers_group_defaults, "additional_userdata"))}" diff --git a/outputs.tf b/outputs.tf index 9f5a16ff4c..f893792d4f 100644 --- a/outputs.tf +++ b/outputs.tf @@ -1,27 +1,27 @@ output "cluster_id" { description = "The name/id of the EKS cluster." - value = "${aws_eks_cluster.this.id}" + value = "${aws_eks_cluster.cluster.id}" } # Though documented, not yet supported # output "cluster_arn" { # description = "The Amazon Resource Name (ARN) of the cluster." -# value = "${aws_eks_cluster.this.arn}" +# value = "${aws_eks_cluster.cluster.arn}" # } output "cluster_certificate_authority_data" { description = "Nested attribute containing certificate-authority-data for your cluster. This is the base64 encoded certificate data required to communicate with your cluster." - value = "${aws_eks_cluster.this.certificate_authority.0.data}" + value = "${aws_eks_cluster.cluster.certificate_authority.0.data}" } output "cluster_endpoint" { description = "The endpoint for your EKS Kubernetes API." - value = "${aws_eks_cluster.this.endpoint}" + value = "${aws_eks_cluster.cluster.endpoint}" } output "cluster_version" { description = "The Kubernetes server version for the EKS cluster." - value = "${aws_eks_cluster.this.version}" + value = "${aws_eks_cluster.cluster.version}" } output "cluster_security_group_id" { diff --git a/workers.tf b/workers.tf index e83412f96f..18b3ddaf7d 100644 --- a/workers.tf +++ b/workers.tf @@ -1,5 +1,5 @@ resource "aws_autoscaling_group" "workers" { - name_prefix = "${var.cluster_name}-${lookup(var.worker_groups[count.index], "name", count.index)}" + name_prefix = "${aws_eks_cluster.cluster.name}-${lookup(var.worker_groups[count.index], "name", count.index)}" desired_capacity = "${lookup(var.worker_groups[count.index], "asg_desired_capacity", lookup(var.workers_group_defaults, "asg_desired_capacity"))}" max_size = "${lookup(var.worker_groups[count.index], "asg_max_size",lookup(var.workers_group_defaults, "asg_max_size"))}" min_size = "${lookup(var.worker_groups[count.index], "asg_min_size",lookup(var.workers_group_defaults, "asg_min_size"))}" @@ -9,8 +9,8 @@ resource "aws_autoscaling_group" "workers" { tags = ["${concat( list( - map("key", "Name", "value", "${var.cluster_name}-${lookup(var.worker_groups[count.index], "name", count.index)}-eks_asg", "propagate_at_launch", true), - map("key", "kubernetes.io/cluster/${var.cluster_name}", "value", "owned", "propagate_at_launch", true), + map("key", "Name", "value", "${aws_eks_cluster.cluster.name}-${lookup(var.worker_groups[count.index], "name", count.index)}-eks_asg", "propagate_at_launch", true), + map("key", "kubernetes.io/cluster/${aws_eks_cluster.cluster.name}", "value", "owned", "propagate_at_launch", true), ), local.asg_tags) }"] @@ -21,7 +21,7 @@ resource "aws_autoscaling_group" "workers" { } resource "aws_launch_configuration" "workers" { - name_prefix = "${var.cluster_name}-${lookup(var.worker_groups[count.index], "name", count.index)}" + name_prefix = "${aws_eks_cluster.cluster.name}-${lookup(var.worker_groups[count.index], "name", count.index)}" associate_public_ip_address = "${lookup(var.worker_groups[count.index], "public_ip", lookup(var.workers_group_defaults, "public_ip"))}" security_groups = ["${local.worker_security_group_id}"] iam_instance_profile = "${aws_iam_instance_profile.workers.id}" @@ -42,11 +42,11 @@ resource "aws_launch_configuration" "workers" { } resource "aws_security_group" "workers" { - name_prefix = "${var.cluster_name}" + name_prefix = "${aws_eks_cluster.cluster.name}" description = "Security group for all nodes in the cluster." vpc_id = "${var.vpc_id}" count = "${var.worker_security_group_id == "" ? 1 : 0}" - tags = "${merge(var.tags, map("Name", "${var.cluster_name}-eks_worker_sg", "kubernetes.io/cluster/${var.cluster_name}", "owned" + tags = "${merge(var.tags, map("Name", "${aws_eks_cluster.cluster.name}-eks_worker_sg", "kubernetes.io/cluster/${aws_eks_cluster.cluster.name}", "owned" ))}" } @@ -84,12 +84,12 @@ resource "aws_security_group_rule" "workers_ingress_cluster" { } resource "aws_iam_role" "workers" { - name_prefix = "${var.cluster_name}" + name_prefix = "${aws_eks_cluster.cluster.name}" assume_role_policy = "${data.aws_iam_policy_document.workers_assume_role_policy.json}" } resource "aws_iam_instance_profile" "workers" { - name_prefix = "${var.cluster_name}" + name_prefix = "${aws_eks_cluster.cluster.name}" role = "${aws_iam_role.workers.name}" } From 11cd282ec19974375d1f84356818b7c7abd18ce3 Mon Sep 17 00:00:00 2001 From: Max Williams Date: Tue, 10 Jul 2018 10:15:08 +0200 Subject: [PATCH 2/3] reverting some changes after feedback --- README.md | 12 ++++++------ cluster.tf | 2 +- data.tf | 12 ++++++------ outputs.tf | 10 +++++----- workers.tf | 16 ++++++++-------- 5 files changed, 26 insertions(+), 26 deletions(-) diff --git a/README.md b/README.md index 4ca0414df7..e9d81c5d97 100644 --- a/README.md +++ b/README.md @@ -98,18 +98,18 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | cluster_security_group_id | If provided, the EKS cluster will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the workers and provide API access to your current IP/32. | string | `` | no | | cluster_version | Kubernetes version to use for the EKS cluster. | string | `1.10` | no | | config_output_path | Determines where config files are placed if using configure_kubectl_session and you want config files to land outside the current working directory. | string | `./` | no | -| configure_kubectl_session | Configure the current session's kubectl to use the instantiated EKS cluster. | boolean | `true` | no | -| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | list | `` | no | +| configure_kubectl_session | Configure the current session's kubectl to use the instantiated EKS cluster. | string | `true` | no | +| kubeconfig_aws_authenticator_additional_args | Any additional arguments to pass to the authenticator such as the role to assume ["-r", "MyEksRole"] | list | `` | no | | kubeconfig_aws_authenticator_command | Command to use to to fetch AWS EKS credentials | string | `heptio-authenticator-aws` | no | -| kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | string | `` | no | +| kubeconfig_aws_authenticator_env_variables | Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = "eks"} | map | `` | no | | kubeconfig_name | Override the default name used for items kubeconfig. | string | `` | no | | subnets | A list of subnets to place the EKS cluster and workers within. | list | - | yes | -| tags | A map of tags to add to all resources. | map | `` | no | +| tags | A map of tags to add to all resources. | map | `` | no | | vpc_id | VPC where the cluster and workers will be deployed. | string | - | yes | -| worker_groups | A list of maps defining worker group configurations. See workers_group_defaults for valid keys. | list | `` | no | +| worker_groups | A list of maps defining worker group configurations. See workers_group_defaults for valid keys. | list | `` | no | | worker_security_group_id | If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the EKS cluster. | string | `` | no | | worker_sg_ingress_from_port | Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443). | string | `1025` | no | -| workers_group_defaults | Default values for target groups as defined by the list of maps. | map | `` | no | +| workers_group_defaults | Default values for target groups as defined by the list of maps. | map | `` | no | | workstation_cidr | Override the default ingress rule that allows communication with the EKS cluster API. If not given, will use current IP/32. | string | `` | no | ## Outputs diff --git a/cluster.tf b/cluster.tf index 3abe7742b8..87ad721328 100644 --- a/cluster.tf +++ b/cluster.tf @@ -1,4 +1,4 @@ -resource "aws_eks_cluster" "cluster" { +resource "aws_eks_cluster" "this" { name = "${var.cluster_name}" role_arn = "${aws_iam_role.cluster.arn}" version = "${var.cluster_version}" diff --git a/data.tf b/data.tf index 1a4742008b..76a7eb6b91 100644 --- a/data.tf +++ b/data.tf @@ -48,11 +48,11 @@ data "template_file" "kubeconfig" { template = "${file("${path.module}/templates/kubeconfig.tpl")}" vars { - cluster_name = "${aws_eks_cluster.cluster.name}" - endpoint = "${aws_eks_cluster.cluster.endpoint}" + cluster_name = "${aws_eks_cluster.this.name}" kubeconfig_name = "${local.kubeconfig_name}" + endpoint = "${aws_eks_cluster.this.endpoint}" region = "${data.aws_region.current.name}" - cluster_auth_base64 = "${aws_eks_cluster.cluster.certificate_authority.0.data}" + cluster_auth_base64 = "${aws_eks_cluster.this.certificate_authority.0.data}" aws_authenticator_command = "${var.kubeconfig_aws_authenticator_command}" aws_authenticator_additional_args = "${length(var.kubeconfig_aws_authenticator_additional_args) > 0 ? " - ${join("\n - ", var.kubeconfig_aws_authenticator_additional_args)}" : "" }" aws_authenticator_env_variables = "${length(var.kubeconfig_aws_authenticator_env_variables) > 0 ? " env:\n${join("\n", data.template_file.aws_authenticator_env_variables.*.rendered)}" : ""}" @@ -87,9 +87,9 @@ data "template_file" "userdata" { vars { region = "${data.aws_region.current.name}" - cluster_name = "${aws_eks_cluster.cluster.name}" - endpoint = "${aws_eks_cluster.cluster.endpoint}" - cluster_auth_base64 = "${aws_eks_cluster.cluster.certificate_authority.0.data}" + cluster_name = "${aws_eks_cluster.this.name}" + endpoint = "${aws_eks_cluster.this.endpoint}" + cluster_auth_base64 = "${aws_eks_cluster.this.certificate_authority.0.data}" max_pod_count = "${lookup(local.max_pod_per_node, lookup(var.worker_groups[count.index], "instance_type", lookup(var.workers_group_defaults, "instance_type")))}" pre_userdata = "${lookup(var.worker_groups[count.index], "pre_userdata",lookup(var.workers_group_defaults, "pre_userdata"))}" additional_userdata = "${lookup(var.worker_groups[count.index], "additional_userdata",lookup(var.workers_group_defaults, "additional_userdata"))}" diff --git a/outputs.tf b/outputs.tf index f893792d4f..9f5a16ff4c 100644 --- a/outputs.tf +++ b/outputs.tf @@ -1,27 +1,27 @@ output "cluster_id" { description = "The name/id of the EKS cluster." - value = "${aws_eks_cluster.cluster.id}" + value = "${aws_eks_cluster.this.id}" } # Though documented, not yet supported # output "cluster_arn" { # description = "The Amazon Resource Name (ARN) of the cluster." -# value = "${aws_eks_cluster.cluster.arn}" +# value = "${aws_eks_cluster.this.arn}" # } output "cluster_certificate_authority_data" { description = "Nested attribute containing certificate-authority-data for your cluster. This is the base64 encoded certificate data required to communicate with your cluster." - value = "${aws_eks_cluster.cluster.certificate_authority.0.data}" + value = "${aws_eks_cluster.this.certificate_authority.0.data}" } output "cluster_endpoint" { description = "The endpoint for your EKS Kubernetes API." - value = "${aws_eks_cluster.cluster.endpoint}" + value = "${aws_eks_cluster.this.endpoint}" } output "cluster_version" { description = "The Kubernetes server version for the EKS cluster." - value = "${aws_eks_cluster.cluster.version}" + value = "${aws_eks_cluster.this.version}" } output "cluster_security_group_id" { diff --git a/workers.tf b/workers.tf index 18b3ddaf7d..ac0b1570bb 100644 --- a/workers.tf +++ b/workers.tf @@ -1,5 +1,5 @@ resource "aws_autoscaling_group" "workers" { - name_prefix = "${aws_eks_cluster.cluster.name}-${lookup(var.worker_groups[count.index], "name", count.index)}" + name_prefix = "${aws_eks_cluster.this.name}-${lookup(var.worker_groups[count.index], "name", count.index)}" desired_capacity = "${lookup(var.worker_groups[count.index], "asg_desired_capacity", lookup(var.workers_group_defaults, "asg_desired_capacity"))}" max_size = "${lookup(var.worker_groups[count.index], "asg_max_size",lookup(var.workers_group_defaults, "asg_max_size"))}" min_size = "${lookup(var.worker_groups[count.index], "asg_min_size",lookup(var.workers_group_defaults, "asg_min_size"))}" @@ -9,8 +9,8 @@ resource "aws_autoscaling_group" "workers" { tags = ["${concat( list( - map("key", "Name", "value", "${aws_eks_cluster.cluster.name}-${lookup(var.worker_groups[count.index], "name", count.index)}-eks_asg", "propagate_at_launch", true), - map("key", "kubernetes.io/cluster/${aws_eks_cluster.cluster.name}", "value", "owned", "propagate_at_launch", true), + map("key", "Name", "value", "${aws_eks_cluster.this.name}-${lookup(var.worker_groups[count.index], "name", count.index)}-eks_asg", "propagate_at_launch", true), + map("key", "kubernetes.io/cluster/${aws_eks_cluster.this.name}", "value", "owned", "propagate_at_launch", true), ), local.asg_tags) }"] @@ -21,7 +21,7 @@ resource "aws_autoscaling_group" "workers" { } resource "aws_launch_configuration" "workers" { - name_prefix = "${aws_eks_cluster.cluster.name}-${lookup(var.worker_groups[count.index], "name", count.index)}" + name_prefix = "${aws_eks_cluster.this.name}-${lookup(var.worker_groups[count.index], "name", count.index)}" associate_public_ip_address = "${lookup(var.worker_groups[count.index], "public_ip", lookup(var.workers_group_defaults, "public_ip"))}" security_groups = ["${local.worker_security_group_id}"] iam_instance_profile = "${aws_iam_instance_profile.workers.id}" @@ -42,11 +42,11 @@ resource "aws_launch_configuration" "workers" { } resource "aws_security_group" "workers" { - name_prefix = "${aws_eks_cluster.cluster.name}" + name_prefix = "${aws_eks_cluster.this.name}" description = "Security group for all nodes in the cluster." vpc_id = "${var.vpc_id}" count = "${var.worker_security_group_id == "" ? 1 : 0}" - tags = "${merge(var.tags, map("Name", "${aws_eks_cluster.cluster.name}-eks_worker_sg", "kubernetes.io/cluster/${aws_eks_cluster.cluster.name}", "owned" + tags = "${merge(var.tags, map("Name", "${aws_eks_cluster.this.name}-eks_worker_sg", "kubernetes.io/cluster/${aws_eks_cluster.this.name}", "owned" ))}" } @@ -84,12 +84,12 @@ resource "aws_security_group_rule" "workers_ingress_cluster" { } resource "aws_iam_role" "workers" { - name_prefix = "${aws_eks_cluster.cluster.name}" + name_prefix = "${aws_eks_cluster.this.name}" assume_role_policy = "${data.aws_iam_policy_document.workers_assume_role_policy.json}" } resource "aws_iam_instance_profile" "workers" { - name_prefix = "${aws_eks_cluster.cluster.name}" + name_prefix = "${aws_eks_cluster.this.name}" role = "${aws_iam_role.workers.name}" } From f238e43c014b38acb5144db41c641271b38ab950 Mon Sep 17 00:00:00 2001 From: Max Williams Date: Tue, 10 Jul 2018 12:55:38 +0200 Subject: [PATCH 3/3] adding types to fix the output of terraform-docs command --- README.md | 1 + variables.tf | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index e9d81c5d97..fb0b265f55 100644 --- a/README.md +++ b/README.md @@ -126,3 +126,4 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | worker_iam_role_name | IAM role name attached to EKS workers | | worker_security_group_id | Security group ID attached to the EKS workers. | | workers_asg_arns | IDs of the autoscaling groups containing workers. | + diff --git a/variables.tf b/variables.tf index 1302a48b82..63c09b767b 100644 --- a/variables.tf +++ b/variables.tf @@ -34,6 +34,7 @@ variable "subnets" { variable "tags" { description = "A map of tags to add to all resources." + type = "map" default = {} } @@ -87,15 +88,17 @@ variable "kubeconfig_aws_authenticator_command" { variable "kubeconfig_aws_authenticator_additional_args" { description = "Any additional arguments to pass to the authenticator such as the role to assume [\"-r\", \"MyEksRole\"]" + type = "list" default = [] } variable "kubeconfig_aws_authenticator_env_variables" { description = "Environment variables that should be used when executing the authenticator i.e. { AWS_PROFILE = \"eks\"}" + type = "map" default = {} } variable "kubeconfig_name" { - description = "Override the default name used for items kubeconfig" + description = "Override the default name used for items kubeconfig." default = "" }