diff --git a/README.md b/README.md
index bacbc61..c0160ec 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@ Terraform module which deploys AWS Load Balancer Controller
## Examples
-- [Standard](https://github.com/bailey84j/terraform-kubernetes-cloudwatch-agent/tree/master/examples/standard): Deploying AWS Load Balancer Controller using the default settings
+- [Standard](https://github.com/bailey84j/terraform-kubernetes-cloudwatch-agent/tree/master/examples/standard): Deploying AWS Cloud Watch Agent using the default settings
- [Custom](https://github.com/bailey84j/terraform-kubernetes-cloudwatch-agent/tree/master/examples/custom): Customising the deployment to use a different name and namespace
## Contributing
@@ -24,6 +24,7 @@ Full contributing [guidelines are covered here](https://github.com/bailey84j/ter
| [terraform](#requirement\_terraform) | >= 0.14.8 |
| [aws](#requirement\_aws) | >= 3.63 |
| [kubernetes](#requirement\_kubernetes) | >= 2.0 |
+| [template](#requirement\_template) | >= 2.2.0 |
## Providers
@@ -31,7 +32,7 @@ Full contributing [guidelines are covered here](https://github.com/bailey84j/ter
|------|---------|
| [aws](#provider\_aws) | >= 3.63 |
| [kubernetes](#provider\_kubernetes) | >= 2.0 |
-| [template](#provider\_template) | n/a |
+| [template](#provider\_template) | >= 2.2.0 |
## Modules
@@ -50,7 +51,6 @@ No modules.
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
| [aws_eks_cluster.target](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source |
| [aws_iam_policy_document.assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
-| [aws_iam_policy_document.eks_oidc_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
| [template_file.this](https://registry.terraform.io/providers/hashicorp/template/latest/docs/data-sources/file) | data source |
@@ -61,7 +61,6 @@ No modules.
|------|-------------|------|---------|:--------:|
| [create\_iam\_role](#input\_create\_iam\_role) | Determines whether a an IAM role is created or to use an existing IAM role for the cloudwatch agent | `bool` | `true` | no |
| [eks\_cluster\_name](#input\_eks\_cluster\_name) | The name of the target Kubernetes Cluster | `string` | n/a | yes |
-| [iam\_role\_additional\_policies](#input\_iam\_role\_additional\_policies) | Additional policies to be added to the IAM role | `list(string)` | `[]` | no |
| [iam\_role\_arn](#input\_iam\_role\_arn) | Existing IAM role ARN for the cloudwatch agent. Required if `create_iam_role` is set to `false` | `string` | `null` | no |
| [iam\_role\_description](#input\_iam\_role\_description) | Description of the role | `string` | `"Permissions required by the Kubernetes Cloudwatch to do it's job."` | no |
| [iam\_role\_name](#input\_iam\_role\_name) | Name to use on IAM role created | `string` | `null` | no |
diff --git a/data.tf b/data.tf
index 7572d07..e191d16 100644
--- a/data.tf
+++ b/data.tf
@@ -1,32 +1,11 @@
-// region AWS Data Resources
+# region AWS Data Resources
data "aws_region" "current" {}
-// region EKS Data Resources
+# region EKS Data Resources
data "aws_eks_cluster" "target" {
name = var.eks_cluster_name
}
data "aws_partition" "current" {}
-
-data "aws_iam_policy_document" "eks_oidc_assume_role" {
- statement {
- actions = ["sts:AssumeRoleWithWebIdentity"]
- effect = "Allow"
- condition {
- test = "StringEquals"
- variable = "${replace(data.aws_eks_cluster.target.identity[0].oidc[0].issuer, "https://", "")}:sub"
- values = [
- "system:serviceaccount:${var.namespace}:${var.name}"
- ]
- }
- principals {
- identifiers = [
- "arn:aws:iam::${data.aws_caller_identity.current.account_id}:oidc-provider/${replace(data.aws_eks_cluster.target.identity[0].oidc[0].issuer, "https://", "")}"
- ]
- type = "Federated"
- }
- }
-}
-
-data "aws_caller_identity" "current" {}
\ No newline at end of file
+data "aws_caller_identity" "current" {}
diff --git a/examples/custom/main.tf b/examples/custom/main.tf
index 1b705b6..46ec54c 100644
--- a/examples/custom/main.tf
+++ b/examples/custom/main.tf
@@ -26,6 +26,8 @@ provider "kubernetes" {
module "k8s_cloudwatch_agent" {
source = "../../"
+ eks_cluster_name = local.k8s_cluster_name
+
name = "different-app-name"
namespace = "different-namespace"
diff --git a/examples/standard/main.tf b/examples/standard/main.tf
index c04ce7b..5a974c9 100644
--- a/examples/standard/main.tf
+++ b/examples/standard/main.tf
@@ -25,4 +25,6 @@ provider "kubernetes" {
module "k8s_cloudwatch_agent" {
source = "../../"
+
+ eks_cluster_name = local.k8s_cluster_name
}
diff --git a/main.tf b/main.tf
index f24374c..7844f8a 100644
--- a/main.tf
+++ b/main.tf
@@ -74,7 +74,7 @@ resource "kubernetes_cluster_role_binding" "this" {
}
data "template_file" "this" {
- template = file("${path.module}/cloudwatch/config.tpl")
+ template = file("${path.module}/templates/config.tpl")
vars = {
region_name = data.aws_region.current.name
cluster_name = data.aws_eks_cluster.target.name
@@ -270,8 +270,7 @@ resource "kubernetes_daemonset" "this" {
# region aws iam role
locals {
- iam_role_name = coalesce(var.iam_role_name, "${var.eks_cluster_name}-${var.name}")
- policy_arn_prefix = "arn:${data.aws_partition.current.partition}:iam::aws:policy"
+ iam_role_name = coalesce(var.iam_role_name, "${var.eks_cluster_name}-${var.name}")
}
# to be updated
data "aws_iam_policy_document" "assume_role_policy" {
@@ -313,24 +312,24 @@ resource "aws_iam_role" "this" {
name = "DescribeEC2TagsAndVolumes"
policy = jsonencode({
- "Version" : "2012-10-17",
- "Statement" : [
- {
- "Effect" : "Allow",
- "Action" : [
- "ec2:DescribeTags",
- "ec2:DescribeVolumes",
- ]
- "Resource" : "*"
- }
- ]
- })
+ "Version" : "2012-10-17",
+ "Statement" : [
+ {
+ "Effect" : "Allow",
+ "Action" : [
+ "ec2:DescribeTags",
+ "ec2:DescribeVolumes",
+ ]
+ "Resource" : "*"
+ }
+ ]
+ })
}
managed_policy_arns = ["arn:${data.aws_partition.current.partition}:iam::aws:policy/service-role/AWSAppSyncPushToCloudWatchLogs"]
tags = merge(var.tags, var.iam_role_tags)
-
+
}
# endregion aws iam role
diff --git a/templates/config.tpl b/templates/config.tpl
new file mode 100644
index 0000000..113f1e7
--- /dev/null
+++ b/templates/config.tpl
@@ -0,0 +1,14 @@
+{
+ "agent": {
+ "region": "${region_name}"
+ },
+ "logs": {
+ "metrics_collected": {
+ "kubernetes": {
+ "cluster_name": "${cluster_name}",
+ "metrics_collection_interval": 60
+ }
+ },
+ "force_flush_interval": 5
+ }
+}
diff --git a/variables.tf b/variables.tf
index a37cbfc..7aa455a 100644
--- a/variables.tf
+++ b/variables.tf
@@ -16,31 +16,31 @@ variable "prefix_separator" {
# Cloudwatch
################################################################################
variable "name" {
- description = "The name of the cloudwatch deployment"
+ description = "The name of the cloudwatch deployment"
type = string
- default = "cloudwatch"
-
+ default = "cloudwatch"
+
}
variable "namespace" {
- description = "The name of the cloudwatch deployment"
+ description = "The name of the cloudwatch deployment"
type = string
- default = "kube-system"
-
+ default = "kube-system"
+
}
variable "image_name" {
- description = "The name of the cloudwatch container image"
+ description = "The name of the cloudwatch container image"
type = string
- default = "cloudwatch-agent"
-
+ default = "cloudwatch-agent"
+
}
variable "image_version" {
- description = "The name of the cloudwatch container image version"
+ description = "The name of the cloudwatch container image version"
type = string
- default = "1.247349.0b251399"
-
+ default = "1.247349.0b251399"
+
}
################################################################################
@@ -88,13 +88,13 @@ variable "iam_role_permissions_boundary" {
type = string
default = null
}
-
+/*
variable "iam_role_additional_policies" {
description = "Additional policies to be added to the IAM role"
type = list(string)
default = []
}
-
+*/
variable "iam_role_tags" {
description = "A map of additional tags to add to the IAM role created"
type = map(string)
@@ -107,5 +107,5 @@ variable "iam_role_tags" {
variable "eks_cluster_name" {
description = "The name of the target Kubernetes Cluster"
- type = string
+ type = string
}
diff --git a/versions.tf b/versions.tf
index 078c38a..5aa9011 100644
--- a/versions.tf
+++ b/versions.tf
@@ -1,6 +1,6 @@
terraform {
required_version = ">= 0.14.8"
-
+
required_providers {
kubernetes = {
source = "hashicorp/kubernetes"
@@ -10,5 +10,9 @@ terraform {
source = "hashicorp/aws"
version = ">= 3.63"
}
+ template = {
+ source = "hashicorp/template"
+ version = ">= 2.2.0"
+ }
}
}