` format here if you are running Terraform on a system that the repository has been added to with `helm repo add` but this is not recommended. | `string` | `null` | no |
+| [chart\_description](#input\_chart\_description) | Set release description attribute (visible in the history). | `string` | `null` | no |
+| [chart\_repository](#input\_chart\_repository) | Repository URL where to locate the requested chart. | `string` | `null` | no |
+| [chart\_values](#input\_chart\_values) | Additional values to yamlencode as `helm_release` values. | `any` | `{}` | no |
| [chart\_version](#input\_chart\_version) | Specify the exact chart version to install. If this is not specified, the latest version is installed. | `string` | `null` | no |
| [cleanup\_on\_fail](#input\_cleanup\_on\_fail) | Allow deletion of new resources created in this upgrade when upgrade fails. | `bool` | `true` | no |
| [context](#input\_context) | Single object for setting entire context at once.
See description of individual variables for details.
Leave string and numeric variables as `null` to use default value.
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | {
"additional_tag_map": {},
"attributes": [],
"delimiter": null,
"descriptor_formats": {},
"enabled": true,
"environment": null,
"id_length_limit": null,
"label_key_case": null,
"label_order": [],
"label_value_case": null,
"labels_as_tags": [
"unset"
],
"name": null,
"namespace": null,
"regex_replace_chars": null,
"stage": null,
"tags": {},
"tenant": null
} | no |
-| [create\_namespace](#input\_create\_namespace) | Create the Kubernetes namespace if it does not yet exist | `bool` | `true` | no |
+| [create\_namespace](#input\_create\_namespace) | Create the Kubernetes namespace if it does not yet exist | `bool` | `null` | no |
| [delimiter](#input\_delimiter) | Delimiter to be used between ID elements.
Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no |
-| [description](#input\_description) | Set release description attribute (visible in the history). | `string` | `null` | no |
| [descriptor\_formats](#input\_descriptor\_formats) | Describe additional descriptors to be output in the `descriptors` output map.
Map of maps. Keys are names of descriptors. Values are maps of the form
`{
format = string
labels = list(string)
}`
(Type is `any` so the map values can later be enhanced to provide additional options.)
`format` is a Terraform format string to be passed to the `format()` function.
`labels` is a list of labels, in order, to pass to `format()` function.
Label values will be normalized before being passed to `format()` so they will be
identical to how they appear in `id`.
Default is `{}` (`descriptors` output will be empty). | `any` | `{}` | no |
| [eks\_component\_name](#input\_eks\_component\_name) | The name of the eks component | `string` | `"eks/cluster"` | no |
| [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no |
| [environment](#input\_environment) | ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT' | `string` | `null` | no |
-| [helm\_manifest\_experiment\_enabled](#input\_helm\_manifest\_experiment\_enabled) | Enable storing of the rendered manifest for helm\_release so the full diff of what is changing can been seen in the plan | `bool` | `true` | no |
+| [helm\_manifest\_experiment\_enabled](#input\_helm\_manifest\_experiment\_enabled) | Enable storing of the rendered manifest for helm\_release so the full diff of what is changing can been seen in the plan | `bool` | `false` | no |
| [id\_length\_limit](#input\_id\_length\_limit) | Limit `id` to this many characters (minimum 6).
Set to `0` for unlimited length.
Set to `null` for keep the existing setting, which defaults to `0`.
Does not affect `id_full`. | `number` | `null` | no |
| [import\_profile\_name](#input\_import\_profile\_name) | AWS Profile name to use when importing a resource | `string` | `null` | no |
| [import\_role\_arn](#input\_import\_role\_arn) | IAM Role ARN to use when importing a resource | `string` | `null` | no |
@@ -143,7 +166,6 @@ components:
| [rbac\_enabled](#input\_rbac\_enabled) | Service Account for pods. | `bool` | `true` | no |
| [regex\_replace\_chars](#input\_regex\_replace\_chars) | Terraform regular expression (regex) string.
Characters matching the regex will be removed from the ID elements.
If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no |
| [region](#input\_region) | AWS Region | `string` | n/a | yes |
-| [repository](#input\_repository) | Repository URL where to locate the requested chart. | `string` | `null` | no |
| [resources](#input\_resources) | The cpu and memory of the deployment's limits and requests. | object({
limits = object({
cpu = string
memory = string
})
requests = object({
cpu = string
memory = string
})
}) | n/a | yes |
| [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no |
| [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no |
diff --git a/modules/eks/external-secrets-operator/helm-variables.tf b/modules/eks/external-secrets-operator/helm-variables.tf
index ca1c6c7b2..4756e3f79 100644
--- a/modules/eks/external-secrets-operator/helm-variables.tf
+++ b/modules/eks/external-secrets-operator/helm-variables.tf
@@ -3,28 +3,40 @@ variable "kubernetes_namespace" {
description = "The namespace to install the release into."
}
-variable "description" {
+variable "chart_description" {
type = string
description = "Set release description attribute (visible in the history)."
default = null
}
-variable "repository" {
+variable "chart_repository" {
type = string
description = "Repository URL where to locate the requested chart."
default = null
}
+variable "chart" {
+ type = string
+ description = "Chart name to be installed. The chart name can be local path, a URL to a chart, or the name of the chart if `repository` is specified. It is also possible to use the `/` format here if you are running Terraform on a system that the repository has been added to with `helm repo add` but this is not recommended."
+ default = null
+}
+
variable "chart_version" {
type = string
description = "Specify the exact chart version to install. If this is not specified, the latest version is installed."
default = null
}
+variable "chart_values" {
+ type = any
+ description = "Additional values to yamlencode as `helm_release` values."
+ default = {}
+}
+
variable "create_namespace" {
type = bool
description = "Create the Kubernetes namespace if it does not yet exist"
- default = true
+ default = null
}
variable "verify" {
diff --git a/modules/eks/external-secrets-operator/main.tf b/modules/eks/external-secrets-operator/main.tf
index 6827768dd..7b8617243 100644
--- a/modules/eks/external-secrets-operator/main.tf
+++ b/modules/eks/external-secrets-operator/main.tf
@@ -18,14 +18,14 @@ resource "kubernetes_namespace" "default" {
# https://external-secrets.io/v0.5.9/guides-getting-started/
module "external_secrets_operator" {
source = "cloudposse/helm-release/aws"
- version = "0.5.0"
+ version = "0.8.1"
- name = "" # avoids hitting length restrictions on IAM Role names
- description = "External Secrets Operator is a Kubernetes operator that integrates external secret management systems including AWS SSM, Parameter Store, Hasicorp Vault, 1Password Secrets Automation, etc. It reads values from external vaults and injects values as a Kubernetes Secret"
+ name = "" # avoid redundant release name in IAM role: ...-ekc-cluster-external-secrets-operator-external-secrets-operator@secrets
+ description = var.chart_description
- repository = "https://charts.external-secrets.io"
- chart = "external-secrets"
- chart_version = "0.6.0-rc1" # using RC to address this bug https://github.com/external-secrets/external-secrets/issues/1511
+ repository = var.chart_repository
+ chart = var.chart
+ chart_version = var.chart_version
kubernetes_namespace = join("", kubernetes_namespace.default.*.id)
create_namespace = false
wait = var.wait
@@ -68,7 +68,9 @@ module "external_secrets_operator" {
rbac = {
create = var.rbac_enabled
}
- })
+ }),
+ # additional values
+ yamlencode(var.chart_values)
])
context = module.this.context
@@ -76,9 +78,9 @@ module "external_secrets_operator" {
module "external_ssm_secrets" {
source = "cloudposse/helm-release/aws"
- version = "0.5.0"
+ version = "0.8.1"
- name = "ssm" # avoids hitting length restrictions on IAM Role names
+ name = "ssm" # distinguish from external_secrets_operator
description = "This Chart uses creates a SecretStore and ExternalSecret to pull variables (under a given path) from AWS SSM Parameter Store into a Kubernetes secret."
chart = "${path.module}/charts/external-ssm-secrets"
diff --git a/modules/eks/external-secrets-operator/provider-helm.tf b/modules/eks/external-secrets-operator/provider-helm.tf
index 20e4d3837..21cecf145 100644
--- a/modules/eks/external-secrets-operator/provider-helm.tf
+++ b/modules/eks/external-secrets-operator/provider-helm.tf
@@ -79,7 +79,7 @@ variable "kubeconfig_exec_auth_api_version" {
variable "helm_manifest_experiment_enabled" {
type = bool
- default = true
+ default = false
description = "Enable storing of the rendered manifest for helm_release so the full diff of what is changing can been seen in the plan"
}
diff --git a/modules/eks/external-secrets-operator/versions.tf b/modules/eks/external-secrets-operator/versions.tf
index b7a1a1986..fb8857fab 100644
--- a/modules/eks/external-secrets-operator/versions.tf
+++ b/modules/eks/external-secrets-operator/versions.tf
@@ -12,7 +12,7 @@ terraform {
}
kubernetes = {
source = "hashicorp/kubernetes"
- version = ">= 2.7.1"
+ version = ">= 2.7.1, != 2.21.0"
}
}
}