diff --git a/.gitignore b/.gitignore index 627f068..b5748ae 100644 --- a/.gitignore +++ b/.gitignore @@ -30,3 +30,5 @@ override.tf.json # Ignore CLI configuration files .terraformrc terraform.rc + +**/examples/event-driven-pipeline/input/* diff --git a/README.md b/README.md index 500cb51..0885f87 100644 --- a/README.md +++ b/README.md @@ -18,7 +18,9 @@ module "eks_ack_addons" { enable_rds = true enable_amp = true enable_emrcontainers = true - + enable_sfn = true + enable_eb = true + tags = { Environment = "dev" } @@ -51,18 +53,21 @@ Examples codified under the [`examples`](https://github.com/aws-ia/terraform-aws | Name | Source | Version | |------|--------|---------| -| [amp](#module\_amp) | github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon | v4.12.2 | -| [api\_gatewayv2](#module\_api\_gatewayv2) | github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon | v4.12.2 | -| [dynamodb](#module\_dynamodb) | github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon | v4.12.2 | -| [emrcontainers](#module\_emrcontainers) | github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon | v4.18.0 | -| [rds](#module\_rds) | github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon | v4.12.2 | -| [s3](#module\_s3) | github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon | v4.12.2 | +| [amp](#module\_amp) | github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon | v4.24.0 | +| [api\_gatewayv2](#module\_api\_gatewayv2) | github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon | v4.24.0 | +| [dynamodb](#module\_dynamodb) | github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon | v4.24.0 | +| [emrcontainers](#module\_emrcontainers) | github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon | v4.24.0 | +| [eventbridge](#module\_eventbridge) | github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon | v4.24.0 | +| [rds](#module\_rds) | github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon | v4.24.0 | +| [s3](#module\_s3) | github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon | v4.24.0 | +| [sfn](#module\_sfn) | github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon | v4.24.0 | ## Resources | Name | Type | |------|------| | [aws_iam_policy.emrcontainers](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | +| [aws_iam_policy.sfnpasspolicy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | | [time_sleep.dataplane](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource | | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | | [aws_eks_cluster.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source | @@ -70,8 +75,10 @@ Examples codified under the [`examples`](https://github.com/aws-ia/terraform-aws | [aws_iam_policy.api_gatewayv2_admin](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source | | [aws_iam_policy.api_gatewayv2_invoke](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source | | [aws_iam_policy.dynamodb](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source | +| [aws_iam_policy.eb](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source | | [aws_iam_policy.rds](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source | | [aws_iam_policy.s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source | +| [aws_iam_policy.sfn](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy) | data source | | [aws_iam_policy_document.emrcontainers](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source | | [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | @@ -85,19 +92,23 @@ Examples codified under the [`examples`](https://github.com/aws-ia/terraform-aws | [cluster\_id](#input\_cluster\_id) | EKS Cluster Id | `string` | n/a | yes | | [data\_plane\_wait\_arn](#input\_data\_plane\_wait\_arn) | Addon deployment will not proceed until this value is known. Set to node group/Fargate profile ARN to wait for data plane to be ready before provisioning addons | `string` | `""` | no | | [dynamodb\_helm\_config](#input\_dynamodb\_helm\_config) | ACK dynamodb Helm Chart config | `any` | `{}` | no | +| [eb\_helm\_config](#input\_eb\_helm\_config) | ACK Event Bridge Helm Chart config | `any` | `{}` | no | | [ecrpublic\_token](#input\_ecrpublic\_token) | Password decoded from the authorization token for accessing public ECR | `string` | n/a | yes | | [ecrpublic\_username](#input\_ecrpublic\_username) | User name decoded from the authorization token for accessing public ECR | `string` | n/a | yes | | [emrcontainers\_helm\_config](#input\_emrcontainers\_helm\_config) | ACK EMR container Helm Chart config | `any` | `{}` | no | | [enable\_amp](#input\_enable\_amp) | Enable ACK amp add-on | `bool` | `false` | no | | [enable\_api\_gatewayv2](#input\_enable\_api\_gatewayv2) | Enable ACK API gateway v2 add-on | `bool` | `false` | no | | [enable\_dynamodb](#input\_enable\_dynamodb) | Enable ACK dynamodb add-on | `bool` | `false` | no | +| [enable\_eb](#input\_enable\_eb) | Enable ACK Event Bridge add-on | `bool` | `false` | no | | [enable\_emrcontainers](#input\_enable\_emrcontainers) | Enable ACK EMR container add-on | `bool` | `false` | no | | [enable\_rds](#input\_enable\_rds) | Enable ACK rds add-on | `bool` | `false` | no | | [enable\_s3](#input\_enable\_s3) | Enable ACK s3 add-on | `bool` | `false` | no | +| [enable\_sfn](#input\_enable\_sfn) | Enable ACK step functions add-on | `bool` | `false` | no | | [irsa\_iam\_permissions\_boundary](#input\_irsa\_iam\_permissions\_boundary) | IAM permissions boundary for IRSA roles | `string` | `""` | no | | [irsa\_iam\_role\_path](#input\_irsa\_iam\_role\_path) | IAM role path for IRSA roles | `string` | `"/"` | no | | [rds\_helm\_config](#input\_rds\_helm\_config) | ACK rds Helm Chart config | `any` | `{}` | no | | [s3\_helm\_config](#input\_s3\_helm\_config) | ACK s3 Helm Chart config | `any` | `{}` | no | +| [sfn\_helm\_config](#input\_sfn\_helm\_config) | ACK step functions Helm Chart config | `any` | `{}` | no | | [tags](#input\_tags) | Additional tags (e.g. `map('BusinessUnit`,`XYZ`) | `map(string)` | `{}` | no | ## Outputs diff --git a/examples/complete/main.tf b/examples/complete/main.tf index 9cbd5a1..c3d041d 100644 --- a/examples/complete/main.tf +++ b/examples/complete/main.tf @@ -52,7 +52,7 @@ locals { ################################################################################ module "eks_blueprints" { - source = "github.com/aws-ia/terraform-aws-eks-blueprints?ref=v4.12.2" + source = "github.com/aws-ia/terraform-aws-eks-blueprints?ref=v4.24.0" cluster_name = local.name cluster_version = "1.23" @@ -77,7 +77,7 @@ module "eks_blueprints" { ################################################################################ module "eks_blueprints_kubernetes_addons" { - source = "github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons?ref=v4.12.2" + source = "github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons?ref=v4.24.0" eks_cluster_id = module.eks_blueprints.eks_cluster_id eks_cluster_endpoint = module.eks_blueprints.eks_cluster_endpoint @@ -116,6 +116,8 @@ module "eks_ack_addons" { enable_rds = true enable_amp = true enable_emrcontainers = true + enable_sfn = true + enable_eb = true tags = local.tags } @@ -197,7 +199,7 @@ resource "aws_iam_policy" "dynamodb_access" { } module "irsa" { - source = "github.com/aws-ia/terraform-aws-eks-blueprints//modules/irsa?ref=v4.12.2" + source = "github.com/aws-ia/terraform-aws-eks-blueprints//modules/irsa?ref=v4.24.0" create_kubernetes_namespace = true kubernetes_namespace = "ack-demo" diff --git a/main.tf b/main.tf index 82d3c20..dd6bbb5 100644 --- a/main.tf +++ b/main.tf @@ -46,7 +46,7 @@ locals { } module "api_gatewayv2" { - source = "github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon?ref=v4.12.2" + source = "github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon?ref=v4.24.0" count = var.enable_api_gatewayv2 ? 1 : 0 @@ -122,7 +122,7 @@ locals { } module "dynamodb" { - source = "github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon?ref=v4.12.2" + source = "github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon?ref=v4.24.0" count = var.enable_dynamodb ? 1 : 0 @@ -189,7 +189,7 @@ locals { } module "s3" { - source = "github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon?ref=v4.12.2" + source = "github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon?ref=v4.24.0" count = var.enable_s3 ? 1 : 0 @@ -256,7 +256,7 @@ locals { } module "rds" { - source = "github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon?ref=v4.12.2" + source = "github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon?ref=v4.24.0" count = var.enable_rds ? 1 : 0 @@ -324,7 +324,7 @@ locals { } module "amp" { - source = "github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon?ref=v4.12.2" + source = "github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon?ref=v4.24.0" count = var.enable_amp ? 1 : 0 @@ -392,7 +392,7 @@ locals { } module "emrcontainers" { - source = "github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon?ref=v4.18.0" + source = "github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon?ref=v4.24.0" count = var.enable_emrcontainers ? 1 : 0 @@ -447,7 +447,7 @@ module "emrcontainers" { resource "aws_iam_policy" "emrcontainers" { count = var.enable_emrcontainers ? 1 : 0 - name = format("%s-%s", local.emr_name, "controller-iam-policies") + name_prefix = format("%s-%s", local.emr_name, "controller-iam-policies") description = "IAM policy for EMRcontainers controller" path = "/" policy = data.aws_iam_policy_document.emrcontainers.json @@ -526,3 +526,165 @@ data "aws_iam_policy_document" "emrcontainers" { } } + +################################################################################ +# Step Functions +################################################################################ + +locals { + sfn_name = "ack-sfn" +} + +module "sfn" { + source = "github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon?ref=v4.24.0" + + count = var.enable_sfn ? 1 : 0 + + helm_config = merge( + { + name = local.sfn_name + chart = "sfn-chart" + repository = "oci://public.ecr.aws/aws-controllers-k8s" + version = "v0.1.3" + namespace = local.sfn_name + repository_username = var.ecrpublic_username + repository_password = var.ecrpublic_token + create_namespace = true + description = "ACK SFN Controller v2 Helm chart deployment configuration" + values = [ + # shortens pod name from `ack-sfn-sfn-chart-xxxxxxxxxxxxx` to `ack-sfn-xxxxxxxxxxxxx` + <<-EOT + nameOverride: ack-sfn + EOT + ] + }, + var.sfn_helm_config + ) + + set_values = [ + { + name = "serviceAccount.name" + value = local.sfn_name + }, + { + name = "serviceAccount.create" + value = false + }, + { + name = "aws.region" + value = local.region + } + ] + + irsa_config = { + create_kubernetes_namespace = true + kubernetes_namespace = try(var.sfn_helm_config.namespace, local.sfn_name) + + create_kubernetes_service_account = true + kubernetes_service_account = local.sfn_name + + irsa_iam_policies = [data.aws_iam_policy.sfn[0].arn, aws_iam_policy.sfnpasspolicy[0].arn] + } + + addon_context = local.addon_context +} + +data "aws_iam_policy" "sfn" { + count = var.enable_sfn ? 1 : 0 + + name = "AWSStepFunctionsFullAccess" +} + + +resource "aws_iam_policy" "sfnpasspolicy" { + count = var.enable_sfn ? 1 : 0 + + name_prefix = format("%s-%s", local.sfn_name, "controller-iam-policies") + + path = "/" + description = "passrole policy" + + # Terraform's "jsonencode" function converts a + # Terraform expression result to valid JSON syntax. + policy = jsonencode({ + Version = "2012-10-17" + Statement = [ + { + Action = [ + "iam:PassRole", + ] + Effect = "Allow" + Resource = "*" + }, + ] + }) +} + + +################################################################################ +# Event Bridge +################################################################################ + +locals { + eb_name = "ack-eb" +} + +module "eventbridge" { + source = "github.com/aws-ia/terraform-aws-eks-blueprints//modules/kubernetes-addons/helm-addon?ref=v4.24.0" + + count = var.enable_eb ? 1 : 0 + + helm_config = merge( + { + name = local.eb_name + chart = "eb-ack-chart" + repository = "oci://public.ecr.aws/k4r0k1t7" + version = "v0.0.2" + namespace = local.eb_name + repository_username = var.ecrpublic_username + repository_password = var.ecrpublic_token + create_namespace = true + description = "ACK eventbridge Controller v2 Helm chart deployment configuration" + values = [ + # shortens pod name from `ack-eb-eb-chart-xxxxxxxxxxxxx` to `ack-eb-xxxxxxxxxxxxx` + <<-EOT + nameOverride: ack-eb + EOT + ] + }, + var.eb_helm_config + ) + + set_values = [ + { + name = "serviceAccount.name" + value = local.eb_name + }, + { + name = "serviceAccount.create" + value = false + }, + { + name = "aws.region" + value = local.region + } + ] + + irsa_config = { + create_kubernetes_namespace = true + kubernetes_namespace = try(var.eb_helm_config.namespace, local.eb_name) + + create_kubernetes_service_account = true + kubernetes_service_account = local.eb_name + + irsa_iam_policies = [data.aws_iam_policy.eb[0].arn] + } + + addon_context = local.addon_context +} + +data "aws_iam_policy" "eb" { + count = var.enable_eb ? 1 : 0 + + name = "AmazonEventBridgeFullAccess" +} diff --git a/variables.tf b/variables.tf index 3c92bcf..ae27c41 100644 --- a/variables.tf +++ b/variables.tf @@ -132,3 +132,35 @@ variable "amp_helm_config" { type = any default = {} } + +################################################################################ +# Step Functions +################################################################################ + +variable "enable_sfn" { + description = "Enable ACK step functions add-on" + type = bool + default = false +} + +variable "sfn_helm_config" { + description = "ACK step functions Helm Chart config" + type = any + default = {} +} + +################################################################################ +# Event Bridge +################################################################################ + +variable "enable_eb" { + description = "Enable ACK Event Bridge add-on" + type = bool + default = false +} + +variable "eb_helm_config" { + description = "ACK Event Bridge Helm Chart config" + type = any + default = {} +}