Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: move karpenter ECR auth token and provider out of the module #2067

Merged
merged 31 commits into from
Jun 26, 2023
Merged

fix: move karpenter ECR auth token and provider out of the module #2067

merged 31 commits into from
Jun 26, 2023

Conversation

oleksiimorozenko
Copy link
Contributor

@oleksiimorozenko oleksiimorozenko commented Jun 5, 2023

[Pull request title](fix: move karpenter ECR auth token and provider out of the module)

Description

Defining provider and related resources (data source) in the module can break even plan if the user running Terraform is assuming role (i.e. doesn't have any permissions assigned to itself but assume role) even if Karpenter module is disabled

The plan fails with Error: getting ECR Public authorization token: AccessDeniedException: User: arn:aws:iam::<account-id>:user/username is not authorized to perform: ecr-public:GetAuthorizationToken on resource: * because no identity-based policy allows the ecr-public:GetAuthorizationToken action in this case

It's better instead to define the provider in the root module as the dependent module's example shows
This PR solves the problem when the provider block looks like this:

provider "aws" {
  region = var.aws_region
  assume_role {
    session_name = "terraform-role"
    role_arn     = "arn:aws:iam::<account-id>:role/rolename"
  }
}

Checklist

@oleksiimorozenko oleksiimorozenko requested a review from a team as a code owner June 5, 2023 06:05
@oleksiimorozenko oleksiimorozenko requested review from ArchiFleKs and rguichard and removed request for a team June 5, 2023 06:05
@oleksiimorozenko
Copy link
Contributor Author

@ArchiFleKs @rguichard any chance it will be approved?

ArchiFleKs and others added 25 commits June 15, 2023 16:11
It should not be needed anymore and can lead to issues. It was fixed in
projectcalico/calico#7216

Signed-off-by: Kevin Lefevre <[email protected]>
Signed-off-by: Oleksii Morozenko <[email protected]>
It should not be needed anymore and can lead to issues. It was fixed in
projectcalico/calico#7216

Signed-off-by: Kevin Lefevre <[email protected]>
Signed-off-by: Oleksii Morozenko <[email protected]>
Signed-off-by: Oleksii Morozenko <[email protected]>
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Oleksii Morozenko <[email protected]>
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Oleksii Morozenko <[email protected]>
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Oleksii Morozenko <[email protected]>
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Oleksii Morozenko <[email protected]>
…2073)

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Oleksii Morozenko <[email protected]>
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Oleksii Morozenko <[email protected]>
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Oleksii Morozenko <[email protected]>
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Oleksii Morozenko <[email protected]>
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Oleksii Morozenko <[email protected]>
…10.0 (#2078)

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Oleksii Morozenko <[email protected]>
…2077)

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Oleksii Morozenko <[email protected]>
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Oleksii Morozenko <[email protected]>
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Oleksii Morozenko <[email protected]>
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Oleksii Morozenko <[email protected]>
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Oleksii Morozenko <[email protected]>
…2081)

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Oleksii Morozenko <[email protected]>
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Oleksii Morozenko <[email protected]>
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Oleksii Morozenko <[email protected]>
Signed-off-by: Oleksii Morozenko <[email protected]>
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Oleksii Morozenko <[email protected]>
@rguichard
Copy link
Member

@ArchiFleKs @rguichard any chance it will be approved?

Don't worry we will review it! Thx a lot for your contribution!

modules/aws/.terraform-docs.yml Outdated Show resolved Hide resolved
@ArchiFleKs
Copy link
Member

@oleksiimorozenko could you rebase please

@mergify mergify bot merged commit 625c957 into particuleio:main Jun 26, 2023
@github-actions
Copy link

🎉 This PR is included in version 14.1.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants