Merge branch 'main' into main

.github/workflows/e2e-parallel-destroy.yml

@@ -56,7 +56,7 @@ jobs:
           role-session-name: GithubActions-Session
 
       - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v2
+        uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: 1.0.0
 

.github/workflows/e2e-parallel-full.yml

@@ -99,7 +99,7 @@ jobs:
           echo "iamlive_pid=$IAMLIVE_PID" >> $GITHUB_ENV
 
       - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v2
+        uses: hashicorp/setup-terraform@v3
         with:
           terraform_version: 1.0.0
 

.github/workflows/markdown-link-check.yml

@@ -26,7 +26,7 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: '16.x'
       - name: install markdown-link-check

.github/workflows/plan-examples.yml

@@ -1,10 +1,6 @@
 name: plan-examples
 
 on:
-  # Review https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ and better understand the risks of using pull_request_target before making major changes to this workflow.
-  pull_request_target:
-    branches:
-      - main
   workflow_dispatch:
 
 concurrency:
@@ -97,7 +93,7 @@ jobs:
           role-session-name: GithubActions-Session
 
       - name: Terraform Job
-        uses: hashicorp/setup-terraform@v2
+        uses: hashicorp/setup-terraform@v3
         if: steps.changes.outputs.src== 'true'
         with:
           terraform_version: 1.0.0

.github/workflows/scorecards.yml

@@ -41,7 +41,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@483ef80eb98fb506c348f7d62e28055e49fe2398 # v2.3.0
+        uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
         with:
           results_file: results.sarif
           results_format: sarif
@@ -71,6 +71,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@0116bc2df50751f9724a2e35ef1f24d22f90e4e1 # v2.22.3
+        uses: github/codeql-action/upload-sarif@74483a38d39275f33fcff5f35b679b5ca4a26a99 # v2.22.5
         with:
           sarif_file: results.sarif

.pre-commit-config.yaml

@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.4.0
+    rev: v4.5.0
     hooks:
       - id: trailing-whitespace
         args: ['--markdown-linebreak-ext=md']
@@ -10,7 +10,7 @@ repos:
       - id: detect-aws-credentials
         args: ['--allow-missing-credentials']
   - repo: https://github.com/antonbabenko/pre-commit-terraform
-    rev: v1.83.4
+    rev: v1.83.5
     hooks:
       - id: terraform_fmt
       - id: terraform_docs

patterns/aws-vpc-cni-network-policy/charts/demo-application/Chart.yaml

@@ -2,4 +2,4 @@ apiVersion: v2
 name: demo-application
 description: A Helm chart to deploy the demo-application
 type: application
-version: 1.0.0
+version: 1.0.0

patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/backend-deploy.yaml

@@ -1,7 +1,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: backend 
+  name: backend
   namespace: stars
 spec:
   replicas: 1
@@ -11,15 +11,15 @@ spec:
   template:
     metadata:
       labels:
-        role: backend 
+        role: backend
     spec:
       containers:
-      - name: backend 
+      - name: backend
         image: calico/star-probe:v0.1.0
         imagePullPolicy: Always
         command:
         - probe
         - --http-port=6379
         - --urls=http://frontend.stars:80/status,http://backend.stars:6379/status,http://client.client:9000/status
         ports:
-        - containerPort: 6379
+        - containerPort: 6379

patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/backend-svc.yaml

@@ -1,11 +1,11 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: backend 
+  name: backend
   namespace: stars
 spec:
   ports:
   - port: 6379
-    targetPort: 6379 
+    targetPort: 6379
   selector:
-    role: backend
+    role: backend

patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/client-deploy.yaml

@@ -1,7 +1,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: client 
+  name: client
   namespace: client
 spec:
   replicas: 1
@@ -11,14 +11,14 @@ spec:
   template:
     metadata:
       labels:
-        role: client 
+        role: client
     spec:
       containers:
-      - name: client 
+      - name: client
         image: calico/star-probe:v0.1.0
         imagePullPolicy: Always
         command:
         - probe
         - --urls=http://frontend.stars:80/status,http://backend.stars:6379/status
         ports:
-        - containerPort: 9000 
+        - containerPort: 9000

patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/client-ns.yaml

@@ -3,4 +3,4 @@ kind: Namespace
 metadata:
   name: client
   labels:
-    role: client
+    role: client

patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/client-svc.yaml

@@ -5,7 +5,7 @@ metadata:
   namespace: client
 spec:
   ports:
-  - port: 9000 
+  - port: 9000
     targetPort: 9000
   selector:
-    role: client
+    role: client

patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/frontend-deploy.yaml

@@ -1,7 +1,7 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: frontend 
+  name: frontend
   namespace: stars
 spec:
   replicas: 1
@@ -11,15 +11,15 @@ spec:
   template:
     metadata:
       labels:
-        role: frontend 
+        role: frontend
     spec:
       containers:
-      - name: frontend 
+      - name: frontend
         image: calico/star-probe:v0.1.0
         imagePullPolicy: Always
         command:
         - probe
         - --http-port=80
         - --urls=http://frontend.stars:80/status,http://backend.stars:6379/status,http://client.client:9000/status
         ports:
-        - containerPort: 80
+        - containerPort: 80

patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/frontend-svc.yaml

@@ -1,11 +1,11 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: frontend 
+  name: frontend
   namespace: stars
 spec:
   ports:
-  - port: 80 
-    targetPort: 80 
+  - port: 80
+    targetPort: 80
   selector:
-    role: frontend
+    role: frontend

patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/management-ui-deploy.yaml

@@ -1,8 +1,8 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: management-ui 
-  namespace: management-ui 
+  name: management-ui
+  namespace: management-ui
 spec:
   replicas: 1
   selector:
@@ -11,11 +11,11 @@ spec:
   template:
     metadata:
       labels:
-        role: management-ui 
+        role: management-ui
     spec:
       containers:
-      - name: management-ui 
+      - name: management-ui
         image: calico/star-collect:v0.1.0
         imagePullPolicy: Always
         ports:
-        - containerPort: 9001
+        - containerPort: 9001

patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/management-ui-ns.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: management-ui 
+  name: management-ui
   labels:
-    role: management-ui
+    role: management-ui

patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/management-ui-svc.yaml

@@ -1,12 +1,12 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: management-ui 
-  namespace: management-ui 
+  name: management-ui
+  namespace: management-ui
 spec:
   type: LoadBalancer
   ports:
-  - port: 80 
+  - port: 80
     targetPort: 9001
   selector:
-    role: management-ui
+    role: management-ui

patterns/aws-vpc-cni-network-policy/charts/demo-application/templates/stars-ns.yaml

@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: stars
+  name: stars

patterns/istio/README.md

@@ -14,7 +14,11 @@ concepts.
 
 ## Deploy
 
-See [here](https://aws-ia.github.io/terraform-aws-eks-blueprints/getting-started/#prerequisites) for the prerequisites and steps to deploy this pattern.
+See [here](https://aws-ia.github.io/terraform-aws-eks-blueprints/getting-started/#prerequisites) for the prerequisites and run the following command to deploy this pattern.
+
+```sh
+terraform apply --auto-approve
+```
 
 Once the resources have been provisioned, you will need to replace the `istio-ingress` pods due to a [`istiod` dependency issue](https://github.com/istio/istio/issues/35789). Use the following command to perform a rolling restart of the `istio-ingress` pods:
 

patterns/istio/main.tf

@@ -165,9 +165,10 @@ module "eks_blueprints_addons" {
             }
             service = {
               annotations = {
-                "service.beta.kubernetes.io/aws-load-balancer-type"       = "nlb"
-                "service.beta.kubernetes.io/aws-load-balancer-scheme"     = "internet-facing"
-                "service.beta.kubernetes.io/aws-load-balancer-attributes" = "load_balancing.cross_zone.enabled=true"
+                "service.beta.kubernetes.io/aws-load-balancer-type"            = "external"
+                "service.beta.kubernetes.io/aws-load-balancer-nlb-target-type" = "ip"
+                "service.beta.kubernetes.io/aws-load-balancer-scheme"          = "internet-facing"
+                "service.beta.kubernetes.io/aws-load-balancer-attributes"      = "load_balancing.cross_zone.enabled=true"
               }
             }
           }