Skip to content

Commit

Permalink
Revert #631. Add back manage security group flag (#722)
Browse files Browse the repository at this point in the history
* Revert #631

* fix README lint

* fix README lint for bool
  • Loading branch information
ryanooi authored Feb 27, 2020
1 parent 10ca272 commit f2cc9f5
Show file tree
Hide file tree
Showing 6 changed files with 26 additions and 11 deletions.
1 change: 1 addition & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ project adheres to [Semantic Versioning](http://semver.org/).
## Next release

## [[v8.?.?](https://github.com/terraform-aws-modules/terraform-aws-eks/compare/v8.2.0...HEAD)] - 2020-xx-xx]
- Revert #631. Add back manage security group flags. (by @ryanooi)

- Added instructions for how to add Windows nodes (by @ivanguravel)
- [CI] Switch `Validate` github action to use env vars (by @max-rocket-internet)
Expand Down
2 changes: 2 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -162,6 +162,7 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:-----:|
| attach\_worker\_cni\_policy | Whether to attach the Amazon managed `AmazonEKS_CNI_Policy` IAM policy to the default worker IAM role. WARNING: If set `false` the permissions must be assigned to the `aws-node` DaemonSet pods via another method or nodes will not be able to join the cluster. | `bool` | `true` | no |
| cluster\_create\_security\_group | Whether to create a security group for the cluster or attach the cluster to `cluster_security_group_id`. | `bool` | `true` | no |
| cluster\_create\_timeout | Timeout value when creating the EKS cluster. | `string` | `"15m"` | no |
| cluster\_delete\_timeout | Timeout value when deleting the EKS cluster. | `string` | `"15m"` | no |
| cluster\_enabled\_log\_types | A list of the desired control plane logging to enable. For more information, see Amazon EKS Control Plane Logging documentation (https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html) | `list(string)` | `[]` | no |
Expand Down Expand Up @@ -203,6 +204,7 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a
| worker\_ami\_owner\_id | The ID of the owner for the AMI to use for the AWS EKS workers. Valid values are an AWS account ID, 'self' (the current account), or an AWS owner alias (e.g. 'amazon', 'aws-marketplace', 'microsoft'). | `string` | `"602401143452"` | no |
| worker\_ami\_owner\_id\_windows | The ID of the owner for the AMI to use for the AWS EKS Windows workers. Valid values are an AWS account ID, 'self' (the current account), or an AWS owner alias (e.g. 'amazon', 'aws-marketplace', 'microsoft'). | `string` | `"801119661308"` | no |
| worker\_create\_initial\_lifecycle\_hooks | Whether to create initial lifecycle hooks provided in worker groups. | `bool` | `false` | no |
| worker\_create\_security\_group | Whether to create a security group for the workers or attach the workers to `worker_security_group_id`. | `bool` | `true` | no |
| worker\_groups | A list of maps defining worker group configurations to be defined using AWS Launch Configurations. See workers\_group\_defaults for valid keys. | `any` | `[]` | no |
| worker\_groups\_launch\_template | A list of maps defining worker group configurations to be defined using AWS Launch Templates. See workers\_group\_defaults for valid keys. | `any` | `[]` | no |
| worker\_security\_group\_id | If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the EKS cluster. | `string` | `""` | no |
Expand Down
6 changes: 3 additions & 3 deletions cluster.tf
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ resource "null_resource" "wait_for_cluster" {
}

resource "aws_security_group" "cluster" {
count = var.cluster_security_group_id == "" && var.create_eks ? 1 : 0
count = var.cluster_create_security_group && var.create_eks ? 1 : 0
name_prefix = var.cluster_name
description = "EKS cluster security group."
vpc_id = var.vpc_id
Expand All @@ -63,7 +63,7 @@ resource "aws_security_group" "cluster" {
}

resource "aws_security_group_rule" "cluster_egress_internet" {
count = var.cluster_security_group_id == "" && var.create_eks ? 1 : 0
count = var.cluster_create_security_group && var.create_eks ? 1 : 0
description = "Allow cluster egress access to the Internet."
protocol = "-1"
security_group_id = local.cluster_security_group_id
Expand All @@ -74,7 +74,7 @@ resource "aws_security_group_rule" "cluster_egress_internet" {
}

resource "aws_security_group_rule" "cluster_https_worker_ingress" {
count = var.worker_security_group_id == "" && var.create_eks ? 1 : 0
count = var.cluster_create_security_group && var.create_eks ? 1 : 0
description = "Allow pods to communicate with the EKS cluster API."
protocol = "tcp"
security_group_id = local.cluster_security_group_id
Expand Down
4 changes: 2 additions & 2 deletions local.tf
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,10 @@ locals {
)
]

cluster_security_group_id = var.cluster_security_group_id == "" ? join("", aws_security_group.cluster.*.id) : var.cluster_security_group_id
cluster_security_group_id = var.cluster_create_security_group ? join("", aws_security_group.cluster.*.id) : var.cluster_security_group_id
cluster_iam_role_name = var.manage_cluster_iam_resources ? join("", aws_iam_role.cluster.*.name) : var.cluster_iam_role_name
cluster_iam_role_arn = var.manage_cluster_iam_resources ? join("", aws_iam_role.cluster.*.arn) : join("", data.aws_iam_role.custom_cluster_iam_role.*.arn)
worker_security_group_id = var.worker_security_group_id == "" ? join("", aws_security_group.workers.*.id) : var.worker_security_group_id
worker_security_group_id = var.worker_create_security_group ? join("", aws_security_group.workers.*.id) : var.worker_security_group_id

default_iam_role_id = concat(aws_iam_role.workers.*.id, [""])[0]
kubeconfig_name = var.kubeconfig_name == "" ? "eks_${var.cluster_name}" : var.kubeconfig_name
Expand Down
12 changes: 12 additions & 0 deletions variables.tf
Original file line number Diff line number Diff line change
Expand Up @@ -204,6 +204,18 @@ variable "wait_for_cluster_cmd" {
default = "until curl -k -s $ENDPOINT/healthz >/dev/null; do sleep 4; done"
}

variable "cluster_create_security_group" {
description = "Whether to create a security group for the cluster or attach the cluster to `cluster_security_group_id`."
type = bool
default = true
}

variable "worker_create_security_group" {
description = "Whether to create a security group for the workers or attach the workers to `worker_security_group_id`."
type = bool
default = true
}

variable "worker_create_initial_lifecycle_hooks" {
description = "Whether to create initial lifecycle hooks provided in worker groups."
type = bool
Expand Down
12 changes: 6 additions & 6 deletions workers.tf
Original file line number Diff line number Diff line change
Expand Up @@ -220,7 +220,7 @@ resource "random_pet" "workers" {
}

resource "aws_security_group" "workers" {
count = var.worker_security_group_id == "" && var.create_eks ? 1 : 0
count = var.worker_create_security_group && var.create_eks ? 1 : 0
name_prefix = aws_eks_cluster.this[0].name
description = "Security group for all nodes in the cluster."
vpc_id = var.vpc_id
Expand All @@ -234,7 +234,7 @@ resource "aws_security_group" "workers" {
}

resource "aws_security_group_rule" "workers_egress_internet" {
count = var.worker_security_group_id == "" && var.create_eks ? 1 : 0
count = var.worker_create_security_group && var.create_eks ? 1 : 0
description = "Allow nodes all egress to the Internet."
protocol = "-1"
security_group_id = local.worker_security_group_id
Expand All @@ -245,7 +245,7 @@ resource "aws_security_group_rule" "workers_egress_internet" {
}

resource "aws_security_group_rule" "workers_ingress_self" {
count = var.worker_security_group_id == "" && var.create_eks ? 1 : 0
count = var.worker_create_security_group && var.create_eks ? 1 : 0
description = "Allow node to communicate with each other."
protocol = "-1"
security_group_id = local.worker_security_group_id
Expand All @@ -256,7 +256,7 @@ resource "aws_security_group_rule" "workers_ingress_self" {
}

resource "aws_security_group_rule" "workers_ingress_cluster" {
count = var.worker_security_group_id == "" && var.create_eks ? 1 : 0
count = var.worker_create_security_group && var.create_eks ? 1 : 0
description = "Allow workers pods to receive communication from the cluster control plane."
protocol = "tcp"
security_group_id = local.worker_security_group_id
Expand All @@ -267,7 +267,7 @@ resource "aws_security_group_rule" "workers_ingress_cluster" {
}

resource "aws_security_group_rule" "workers_ingress_cluster_kubelet" {
count = var.worker_security_group_id == "" && var.create_eks ? var.worker_sg_ingress_from_port > 10250 ? 1 : 0 : 0
count = var.worker_create_security_group && var.create_eks ? var.worker_sg_ingress_from_port > 10250 ? 1 : 0 : 0
description = "Allow workers Kubelets to receive communication from the cluster control plane."
protocol = "tcp"
security_group_id = local.worker_security_group_id
Expand All @@ -278,7 +278,7 @@ resource "aws_security_group_rule" "workers_ingress_cluster_kubelet" {
}

resource "aws_security_group_rule" "workers_ingress_cluster_https" {
count = var.worker_security_group_id == "" && var.create_eks ? 1 : 0
count = var.worker_create_security_group && var.create_eks ? 1 : 0
description = "Allow pods running extension API servers on port 443 to receive communication from cluster control plane."
protocol = "tcp"
security_group_id = local.worker_security_group_id
Expand Down

0 comments on commit f2cc9f5

Please sign in to comment.