Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow aws credentials to be passed into exec #124

Closed
wants to merge 1 commit into from
Closed

Allow aws credentials to be passed into exec #124

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -447,8 +447,12 @@ Available targets:
| <a name="input_environment"></a> [environment](#input\_environment) | Environment, e.g. 'uw2', 'us-west-2', OR 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no |
| <a name="input_id_length_limit"></a> [id\_length\_limit](#input\_id\_length\_limit) | Limit `id` to this many characters (minimum 6).<br>Set to `0` for unlimited length.<br>Set to `null` for default, which is `0`.<br>Does not affect `id_full`. | `number` | `null` | no |
| <a name="input_kube_data_auth_enabled"></a> [kube\_data\_auth\_enabled](#input\_kube\_data\_auth\_enabled) | If `true`, use an `aws_eks_cluster_auth` data source to authenticate to the EKS cluster.<br>Disabled by `kubeconfig_path_enabled` or `kube_exec_auth_enabled`. | `bool` | `true` | no |
| <a name="input_kube_exec_auth_aws_access_key_id"></a> [kube\_exec\_auth\_aws\_access\_key\_id](#input\_kube\_exec\_auth\_aws\_access\_key\_id) | The aws access key id for `aws eks get-token` to use | `string` | `null` | no |
| <a name="input_kube_exec_auth_aws_profile"></a> [kube\_exec\_auth\_aws\_profile](#input\_kube\_exec\_auth\_aws\_profile) | The AWS config profile for `aws eks get-token` to use | `string` | `""` | no |
| <a name="input_kube_exec_auth_aws_profile_enabled"></a> [kube\_exec\_auth\_aws\_profile\_enabled](#input\_kube\_exec\_auth\_aws\_profile\_enabled) | If `true`, pass `kube_exec_auth_aws_profile` as the `profile` to `aws eks get-token` | `bool` | `false` | no |
| <a name="input_kube_exec_auth_aws_secret_access_key"></a> [kube\_exec\_auth\_aws\_secret\_access\_key](#input\_kube\_exec\_auth\_aws\_secret\_access\_key) | The aws secret access key for `aws eks get-token` to use | `string` | `null` | no |
| <a name="input_kube_exec_auth_aws_session_token"></a> [kube\_exec\_auth\_aws\_session\_token](#input\_kube\_exec\_auth\_aws\_session\_token) | The aws session\_token for `aws eks get-token` to use | `string` | `null` | no |
| <a name="input_kube_exec_auth_credentials_enabled"></a> [kube\_exec\_auth\_credentials\_enabled](#input\_kube\_exec\_auth\_credentials\_enabled) | If `true`, pass `kube_exec_auth_aws_access_key_id`, `kube_exec_auth_aws_secret_access_key` and `kube_exec_auth_aws_session_token` as `envs` to `aws eks get-token` | `bool` | `false` | no |
| <a name="input_kube_exec_auth_enabled"></a> [kube\_exec\_auth\_enabled](#input\_kube\_exec\_auth\_enabled) | If `true`, use the Kubernetes provider `exec` feature to execute `aws eks get-token` to authenticate to the EKS cluster.<br>Disabled by `kubeconfig_path_enabled`, overrides `kube_data_auth_enabled`. | `bool` | `false` | no |
| <a name="input_kube_exec_auth_role_arn"></a> [kube\_exec\_auth\_role\_arn](#input\_kube\_exec\_auth\_role\_arn) | The role ARN for `aws eks get-token` to use | `string` | `""` | no |
| <a name="input_kube_exec_auth_role_arn_enabled"></a> [kube\_exec\_auth\_role\_arn\_enabled](#input\_kube\_exec\_auth\_role\_arn\_enabled) | If `true`, pass `kube_exec_auth_role_arn` as the role ARN to `aws eks get-token` | `bool` | `false` | no |
Expand Down
12 changes: 10 additions & 2 deletions auth.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,8 +35,11 @@ locals {
kube_exec_auth_enabled = local.kubeconfig_path_enabled ? false : local.need_kubernetes_provider && var.kube_exec_auth_enabled
kube_data_auth_enabled = local.kube_exec_auth_enabled ? false : local.need_kubernetes_provider && var.kube_data_auth_enabled

exec_profile = local.kube_exec_auth_enabled && var.kube_exec_auth_aws_profile_enabled ? ["--profile", var.kube_exec_auth_aws_profile] : []
exec_role = local.kube_exec_auth_enabled && var.kube_exec_auth_role_arn_enabled ? ["--role-arn", var.kube_exec_auth_role_arn] : []
exec_profile = local.kube_exec_auth_enabled && var.kube_exec_auth_aws_profile_enabled ? ["--profile", var.kube_exec_auth_aws_profile] : []
exec_role = local.kube_exec_auth_enabled && var.kube_exec_auth_role_arn_enabled ? ["--role-arn", var.kube_exec_auth_role_arn] : []
exec_access_key_id = local.kube_exec_auth_enabled && var.kube_exec_auth_credentials_enabled ? var.kube_exec_auth_aws_access_key_id : null
exec_secret_access_key = local.kube_exec_auth_enabled && var.kube_exec_auth_credentials_enabled ? var.kube_exec_auth_aws_secret_access_key : null
exec_session_token = local.kube_exec_auth_enabled && var.kube_exec_auth_credentials_enabled ? var.kube_exec_auth_aws_session_token : null

certificate_authority_data_list = coalescelist(aws_eks_cluster.default.*.certificate_authority, [[{ data : "" }]])
certificate_authority_data_list_internal = local.certificate_authority_data_list[0]
Expand Down Expand Up @@ -105,6 +108,11 @@ provider "kubernetes" {
api_version = "client.authentication.k8s.io/v1alpha1"
command = "aws"
args = concat(local.exec_profile, ["eks", "get-token", "--cluster-name", aws_eks_cluster.default[0].id], local.exec_role)
env = {
AWS_ACCESS_KEY_ID = local.exec_access_key_id
AWS_SECRET_ACCESS_KEY = local.exec_secret_access_key
AWS_SESSION_TOKEN = local.exec_session_token
}
}
}
}
Expand Down
4 changes: 4 additions & 0 deletions docs/terraform.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,8 +83,12 @@
| <a name="input_environment"></a> [environment](#input\_environment) | Environment, e.g. 'uw2', 'us-west-2', OR 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no |
| <a name="input_id_length_limit"></a> [id\_length\_limit](#input\_id\_length\_limit) | Limit `id` to this many characters (minimum 6).<br>Set to `0` for unlimited length.<br>Set to `null` for default, which is `0`.<br>Does not affect `id_full`. | `number` | `null` | no |
| <a name="input_kube_data_auth_enabled"></a> [kube\_data\_auth\_enabled](#input\_kube\_data\_auth\_enabled) | If `true`, use an `aws_eks_cluster_auth` data source to authenticate to the EKS cluster.<br>Disabled by `kubeconfig_path_enabled` or `kube_exec_auth_enabled`. | `bool` | `true` | no |
| <a name="input_kube_exec_auth_aws_access_key_id"></a> [kube\_exec\_auth\_aws\_access\_key\_id](#input\_kube\_exec\_auth\_aws\_access\_key\_id) | The aws access key id for `aws eks get-token` to use | `string` | `null` | no |
| <a name="input_kube_exec_auth_aws_profile"></a> [kube\_exec\_auth\_aws\_profile](#input\_kube\_exec\_auth\_aws\_profile) | The AWS config profile for `aws eks get-token` to use | `string` | `""` | no |
| <a name="input_kube_exec_auth_aws_profile_enabled"></a> [kube\_exec\_auth\_aws\_profile\_enabled](#input\_kube\_exec\_auth\_aws\_profile\_enabled) | If `true`, pass `kube_exec_auth_aws_profile` as the `profile` to `aws eks get-token` | `bool` | `false` | no |
| <a name="input_kube_exec_auth_aws_secret_access_key"></a> [kube\_exec\_auth\_aws\_secret\_access\_key](#input\_kube\_exec\_auth\_aws\_secret\_access\_key) | The aws secret access key for `aws eks get-token` to use | `string` | `null` | no |
| <a name="input_kube_exec_auth_aws_session_token"></a> [kube\_exec\_auth\_aws\_session\_token](#input\_kube\_exec\_auth\_aws\_session\_token) | The aws session\_token for `aws eks get-token` to use | `string` | `null` | no |
| <a name="input_kube_exec_auth_credentials_enabled"></a> [kube\_exec\_auth\_credentials\_enabled](#input\_kube\_exec\_auth\_credentials\_enabled) | If `true`, pass `kube_exec_auth_aws_access_key_id`, `kube_exec_auth_aws_secret_access_key` and `kube_exec_auth_aws_session_token` as `envs` to `aws eks get-token` | `bool` | `false` | no |
| <a name="input_kube_exec_auth_enabled"></a> [kube\_exec\_auth\_enabled](#input\_kube\_exec\_auth\_enabled) | If `true`, use the Kubernetes provider `exec` feature to execute `aws eks get-token` to authenticate to the EKS cluster.<br>Disabled by `kubeconfig_path_enabled`, overrides `kube_data_auth_enabled`. | `bool` | `false` | no |
| <a name="input_kube_exec_auth_role_arn"></a> [kube\_exec\_auth\_role\_arn](#input\_kube\_exec\_auth\_role\_arn) | The role ARN for `aws eks get-token` to use | `string` | `""` | no |
| <a name="input_kube_exec_auth_role_arn_enabled"></a> [kube\_exec\_auth\_role\_arn\_enabled](#input\_kube\_exec\_auth\_role\_arn\_enabled) | If `true`, pass `kube_exec_auth_role_arn` as the role ARN to `aws eks get-token` | `bool` | `false` | no |
Expand Down
23 changes: 23 additions & 0 deletions variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -247,6 +247,29 @@ variable "kube_exec_auth_role_arn_enabled" {
default = false
description = "If `true`, pass `kube_exec_auth_role_arn` as the role ARN to `aws eks get-token`"
}
variable "kube_exec_auth_credentials_enabled" {
type = bool
default = false
description = "If `true`, pass `kube_exec_auth_aws_access_key_id`, `kube_exec_auth_aws_secret_access_key` and `kube_exec_auth_aws_session_token` as `envs` to `aws eks get-token`"
}

variable "kube_exec_auth_aws_access_key_id" {
type = string
default = null
description = "The aws access key id for `aws eks get-token` to use"
}

variable "kube_exec_auth_aws_secret_access_key" {
type = string
default = null
description = "The aws secret access key for `aws eks get-token` to use"
}

variable "kube_exec_auth_aws_session_token" {
type = string
default = null
description = "The aws session_token for `aws eks get-token` to use"
}

variable "kube_exec_auth_aws_profile" {
type = string
Expand Down