Skip to content

Commit ac824c1

Browse files
posquit0posquit0
authored
Improve eks-iam-access module using eks-access-entry module (#54)
1 parent 3f08a47 commit ac824c1

File tree

4 files changed

+67
-41
lines changed

4 files changed

+67
-41
lines changed

‎modules/eks-iam-access/README.md‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -15,22 +15,19 @@ This module creates following resources.
1515

1616
## Providers
1717

18-
| Name | Version |
19-
|------|---------|
20-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.50.0 |
18+
No providers.
2119

2220
## Modules
2321

2422
| Name | Source | Version |
2523
|------|--------|---------|
24+
| <a name="module_node"></a> [node](#module\_node) | ../eks-access-entry | n/a |
2625
| <a name="module_resource_group"></a> [resource\_group](#module\_resource\_group) | tedilabs/misc/aws//modules/resource-group | ~> 0.10.0 |
26+
| <a name="module_user"></a> [user](#module\_user) | ../eks-access-entry | n/a |
2727

2828
## Resources
2929

30-
| Name | Type |
31-
|------|------|
32-
| [aws_eks_access_entry.node](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_access_entry) | resource |
33-
| [aws_eks_access_entry.user](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_access_entry) | resource |
30+
No resources.
3431

3532
## Inputs
3633

@@ -44,7 +41,7 @@ This module creates following resources.
4441
| <a name="input_resource_group_name"></a> [resource\_group\_name](#input\_resource\_group\_name) | (Optional) The name of Resource Group. A Resource Group name can have a maximum of 127 characters, including letters, numbers, hyphens, dots, and underscores. The name cannot start with `AWS` or `aws`. | `string` | `""` | no |
4542
| <a name="input_tags"></a> [tags](#input\_tags) | (Optional) A map of tags to add to all resources. | `map(string)` | `{}` | no |
4643
| <a name="input_timeouts"></a> [timeouts](#input\_timeouts) | (Optional) How long to wait for the EKS Cluster to be created/updated/deleted. | <pre>object({<br> create = optional(string, "30m")<br> update = optional(string, "60m")<br> delete = optional(string, "15m")<br> })</pre> | `{}` | no |
47-
| <a name="input_user_access_entries"></a> [user\_access\_entries](#input\_user\_access\_entries) | (Optional) A list of configurations for EKS access entries for users (IAM roles, users) that are allowed to access the EKS cluster. Each item of `user_access_entries` block as defined below.<br> (Required) `name` - A unique name for the access entry. This value is only used internally within Terraform code.<br> (Required) `principal` - The ARN of one, and only one, existing IAM principal to grant access to Kubernetes objects on the cluster. An IAM principal can't be included in more than one access entry.<br> (Optional) `username` - The username to authenticate to Kubernetes with. We recommend not specifying a username and letting Amazon EKS specify it for you. Defaults to the IAM principal ARN.<br> (Optional) `groups` - A set of groups within the Kubernetes cluster. | <pre>list(object({<br> name = string<br> principal = string<br> username = optional(string)<br> groups = optional(set(string), [])<br> }))</pre> | `[]` | no |
44+
| <a name="input_user_access_entries"></a> [user\_access\_entries](#input\_user\_access\_entries) | (Optional) A list of configurations for EKS access entries for users (IAM roles, users) that are allowed to access the EKS cluster. Each item of `user_access_entries` block as defined below.<br> (Required) `name` - A unique name for the access entry. This value is only used internally within Terraform code.<br> (Required) `principal` - The ARN of one, and only one, existing IAM principal to grant access to Kubernetes objects on the cluster. An IAM principal can't be included in more than one access entry.<br> (Optional) `kubernetes_username` - The username to authenticate to Kubernetes with. We recommend not specifying a username and letting Amazon EKS specify it for you. Defaults to the IAM principal ARN.<br> (Optional) `kubernetes_groups` - A set of groups within the Kubernetes cluster.<br> (Optional) `kubernetes_permissions` - A list of permissions for EKS access entry to the EKS cluster. Each item of `kubernetes_permissions` block as defined below.<br> (Required) `policy` - The ARN of the access policy that you're associating.<br> (Optional) `scope` - The type of access scope that you're associating. Valid values are `NAMESPACE`, `CLUSTER`. Defaults to `CLUSTER`.<br> (Optional) `namespaces` - A set of namespaces to which the access scope applies. You can enter plain text namespaces, or wildcard namespaces such as `dev-*`. | <pre>list(object({<br> name = string<br> principal = string<br> kubernetes_username = optional(string)<br> kubernetes_groups = optional(set(string), [])<br> kubernetes_permissions = optional(list(object({<br> policy = string<br> scope = optional(string, "CLUSTER")<br> namespaces = optional(set(string), [])<br> })), [])<br> }))</pre> | `[]` | no |
4845

4946
## Outputs
5047

‎modules/eks-iam-access/main.tf‎

Lines changed: 30 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -20,17 +20,23 @@ locals {
2020
###################################################
2121

2222
# INFO: Not supported attributes
23-
# - `user_name`
23+
# - `kubernetes_username`
2424
# - `kubernetes_groups`
25-
resource "aws_eks_access_entry" "node" {
25+
module "node" {
2626
for_each = {
2727
for entry in var.node_access_entries :
2828
entry.name => entry
2929
}
3030

31-
cluster_name = var.cluster_name
32-
type = each.value.type
33-
principal_arn = each.value.principal
31+
source = "../eks-access-entry"
32+
33+
name = each.key
34+
cluster_name = var.cluster_name
35+
type = each.value.type
36+
principal = each.value.principal
37+
38+
resource_group_enabled = false
39+
module_tags_enabled = false
3440

3541
tags = merge(
3642
{
@@ -46,18 +52,31 @@ resource "aws_eks_access_entry" "node" {
4652
# User Access Entries
4753
###################################################
4854

49-
resource "aws_eks_access_entry" "user" {
55+
module "user" {
5056
for_each = {
5157
for entry in var.user_access_entries :
5258
entry.name => entry
5359
}
5460

55-
cluster_name = var.cluster_name
56-
type = "STANDARD"
57-
principal_arn = each.value.principal
61+
source = "../eks-access-entry"
62+
63+
name = each.key
64+
cluster_name = var.cluster_name
65+
type = "STANDARD"
66+
principal = each.value.principal
67+
68+
kubernetes_username = each.value.kubernetes_username
69+
kubernetes_groups = each.value.kubernetes_groups
70+
kubernetes_permissions = [
71+
for permission in each.value.kubernetes_permissions : {
72+
policy = permission.policy
73+
scope = permission.scope
74+
namespaces = permission.namespaces
75+
}
76+
]
5877

59-
user_name = each.value.username
60-
kubernetes_groups = each.value.groups
78+
resource_group_enabled = false
79+
module_tags_enabled = false
6180

6281
tags = merge(
6382
{

‎modules/eks-iam-access/outputs.tf‎

Lines changed: 17 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -8,15 +8,15 @@ output "node_access_entries" {
88
The list of configurations for EKS access entries for nodes (EC2 instances, Fargate).
99
EOF
1010
value = {
11-
for name, entry in aws_eks_access_entry.node :
11+
for name, entry in module.node :
1212
name => {
13-
arn = entry.access_entry_arn
14-
type = entry.type
15-
principal = entry.principal_arn
16-
username = entry.user_name
17-
groups = entry.kubernetes_groups
18-
created_at = entry.created_at
19-
updated_at = entry.modified_at
13+
arn = entry.arn
14+
type = entry.type
15+
principal = entry.principal
16+
kubernetes_username = entry.kubernetes_username
17+
kubernetes_groups = entry.kubernetes_groups
18+
created_at = entry.created_at
19+
updated_at = entry.updated_at
2020
}
2121
}
2222
}
@@ -26,15 +26,16 @@ output "user_access_entries" {
2626
The list of configurations for EKS access entries for users (IAM roles, users).
2727
EOF
2828
value = {
29-
for name, entry in aws_eks_access_entry.user :
29+
for name, entry in module.user :
3030
name => {
31-
arn = entry.access_entry_arn
32-
type = entry.type
33-
principal = entry.principal_arn
34-
username = entry.user_name
35-
groups = entry.kubernetes_groups
36-
created_at = entry.created_at
37-
updated_at = entry.modified_at
31+
arn = entry.arn
32+
type = entry.type
33+
principal = entry.principal
34+
kubernetes_username = entry.kubernetes_username
35+
kubernetes_groups = entry.kubernetes_groups
36+
kubernetes_permissions = entry.kubernetes_permissions
37+
created_at = entry.created_at
38+
updated_at = entry.updated_at
3839
}
3940
}
4041
}

‎modules/eks-iam-access/variables.tf‎

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -33,14 +33,23 @@ variable "user_access_entries" {
3333
(Optional) A list of configurations for EKS access entries for users (IAM roles, users) that are allowed to access the EKS cluster. Each item of `user_access_entries` block as defined below.
3434
(Required) `name` - A unique name for the access entry. This value is only used internally within Terraform code.
3535
(Required) `principal` - The ARN of one, and only one, existing IAM principal to grant access to Kubernetes objects on the cluster. An IAM principal can't be included in more than one access entry.
36-
(Optional) `username` - The username to authenticate to Kubernetes with. We recommend not specifying a username and letting Amazon EKS specify it for you. Defaults to the IAM principal ARN.
37-
(Optional) `groups` - A set of groups within the Kubernetes cluster.
36+
(Optional) `kubernetes_username` - The username to authenticate to Kubernetes with. We recommend not specifying a username and letting Amazon EKS specify it for you. Defaults to the IAM principal ARN.
37+
(Optional) `kubernetes_groups` - A set of groups within the Kubernetes cluster.
38+
(Optional) `kubernetes_permissions` - A list of permissions for EKS access entry to the EKS cluster. Each item of `kubernetes_permissions` block as defined below.
39+
(Required) `policy` - The ARN of the access policy that you're associating.
40+
(Optional) `scope` - The type of access scope that you're associating. Valid values are `NAMESPACE`, `CLUSTER`. Defaults to `CLUSTER`.
41+
(Optional) `namespaces` - A set of namespaces to which the access scope applies. You can enter plain text namespaces, or wildcard namespaces such as `dev-*`.
3842
EOF
3943
type = list(object({
40-
name = string
41-
principal = string
42-
username = optional(string)
43-
groups = optional(set(string), [])
44+
name = string
45+
principal = string
46+
kubernetes_username = optional(string)
47+
kubernetes_groups = optional(set(string), [])
48+
kubernetes_permissions = optional(list(object({
49+
policy = string
50+
scope = optional(string, "CLUSTER")
51+
namespaces = optional(set(string), [])
52+
})), [])
4453
}))
4554
default = []
4655
nullable = false

0 commit comments

Comments
 (0)