[additional\_irsa\_configs](#input\_additional\_irsa\_configs) | Input for additional irsa configurations | list(object({
name = string
namespace = string
serviceaccount_name = string
policy = string #json
})) | `[]` | no |
| [eks\_info](#input\_eks\_info) | cluster = {
specs {
name = Cluster name.
account\_id = AWS account id where the cluster resides.
}
oidc = {
arn = OIDC provider ARN.
url = OIDC provider url.
cert = {
thumbprint\_list = OIDC cert thumbprints.
url = OIDC cert URL.
}
} | object({
nodes = object({
roles = list(object({
arn = string
name = string
}))
})
cluster = object({
specs = object({
name = string
account_id = string
})
oidc = object({
arn = string
url = string
cert = object({
thumbprint_list = list(string)
url = string
})
})
})
}) | n/a | yes |
-| [external\_deployments\_operator](#input\_external\_deployments\_operator) | Config to create IRSA role for the external deployments operator. | object({
enabled = optional(bool, false)
namespace = optional(string, "domino-compute")
service_account_name = optional(string, "pham-juno-operator")
}) | `{}` | no |
| [external\_dns](#input\_external\_dns) | Config to enable irsa for external-dns | object({
enabled = optional(bool, false)
hosted_zone_name = optional(string, null)
hosted_zone_private = optional(string, false)
namespace = optional(string, "domino-platform")
serviceaccount_name = optional(string, "external-dns")
rm_role_policy = optional(object({
remove = optional(bool, false)
detach_from_role = optional(bool, false)
policy_name = optional(string, "")
}), {})
}) | `{}` | no |
| [netapp\_trident\_operator](#input\_netapp\_trident\_operator) | Config to create IRSA role for the netapp-trident-operator. | object({
enabled = optional(bool, false)
namespace = optional(string, "trident")
serviceaccount_name = optional(string, "trident-controller")
region = optional(string)
}) | `{}` | no |
| [use\_cluster\_odc\_idp](#input\_use\_cluster\_odc\_idp) | Toogle to uset the oidc idp connector in the trust policy.
Set to `true` if the cluster and the hosted zone are in different aws accounts.
`rm_role_policy` used to facilitiate the cleanup if a node attached policy was used previously. | `bool` | `true` | no |
@@ -63,7 +61,6 @@ No modules.
| Name | Description |
|------|-------------|
-| [external\_deployments\_operator](#output\_external\_deployments\_operator) | External deployments operator role info |
| [external\_dns](#output\_external\_dns) | External\_dns info |
| [netapp\_trident\_operator](#output\_netapp\_trident\_operator) | NetApp Astra Trident NETAPP Operator role info |
| [roles](#output\_roles) | Roles mapping info |
diff --git a/modules/irsa/external-deployments-operator.tf b/modules/irsa/external-deployments-operator.tf
deleted file mode 100644
index 493e135a..00000000
--- a/modules/irsa/external-deployments-operator.tf
+++ /dev/null
@@ -1,23 +0,0 @@
-resource "aws_iam_role" "external_deployments_operator" {
- count = var.external_deployments_operator.enabled ? 1 : 0
-
- name = "${local.name_prefix}-external-deployments-operator"
- assume_role_policy = jsonencode({
- Version = "2012-10-17"
- Statement = [
- {
- Action = "sts:AssumeRoleWithWebIdentity"
- Effect = "Allow"
- Principal = {
- Federated = local.oidc_provider_arn
- }
- Condition : {
- StringEquals : {
- "${trimprefix(local.oidc_provider_url, "https://")}:aud" : "sts.amazonaws.com",
- "${trimprefix(local.oidc_provider_url, "https://")}:sub" : "system:serviceaccount:${var.external_deployments_operator.namespace}:${var.external_deployments_operator.service_account_name}"
- }
- }
- },
- ]
- })
-}
diff --git a/modules/irsa/outputs.tf b/modules/irsa/outputs.tf
index f3edc24e..d4954572 100644
--- a/modules/irsa/outputs.tf
+++ b/modules/irsa/outputs.tf
@@ -19,11 +19,3 @@ output "netapp_trident_operator" {
irsa_role = aws_iam_role.trident_operator[0].arn
} : null
}
-
-output "external_deployments_operator" {
- description = "External deployments operator role info"
- value = var.external_deployments_operator.enabled ? {
- irsa_role = aws_iam_role.external_deployments_operator[0].arn
- service_account_name = var.external_deployments_operator.service_account_name
- } : null
-}
diff --git a/modules/irsa/variables.tf b/modules/irsa/variables.tf
index d8852122..a0be1022 100644
--- a/modules/irsa/variables.tf
+++ b/modules/irsa/variables.tf
@@ -107,14 +107,3 @@ variable "netapp_trident_operator" {
default = {}
}
-variable "external_deployments_operator" {
- description = "Config to create IRSA role for the external deployments operator."
-
- type = object({
- enabled = optional(bool, false)
- namespace = optional(string, "domino-compute")
- service_account_name = optional(string, "pham-juno-operator")
- })
-
- default = {}
-}
diff --git a/tests/deploy/ci-deploy.sh b/tests/deploy/ci-deploy.sh
index 2b459327..887acc44 100755
--- a/tests/deploy/ci-deploy.sh
+++ b/tests/deploy/ci-deploy.sh
@@ -16,7 +16,7 @@ fi
# remote module vars
BASE_REMOTE_SRC="github.com/${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}.git"
BASE_REMOTE_MOD_SRC="${BASE_REMOTE_SRC}//modules"
-LATEST_REL_TAG="$(curl -sSfL -H "X-GitHub-Api-Version: 2022-11-28" -H "Accept: application/vnd.github+json" https://api.github.com/repos/${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}/releases/latest | jq -r '.tag_name')"
+LATEST_REL_TAG="$(curl -sSfL -H "X-GitHub-Api-Version: 2022-11-28" -H "Accept: application/vnd.github+json" "https://api.github.com/repos/${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}/releases/latest" | jq -r '.tag_name')"
deploy() {
component=${1:-all}
@@ -62,6 +62,10 @@ setup_modules_latest_rel() {
setup_module "$DEPLOY_DIR" "$LATEST_REL_TAG"
}
+setup_modules_upgrade() {
+ rsync -ra --exclude '.terraform*' ../../examples/deploy/ "$DEPLOY_DIR"
+}
+
install_helm() {
if [ -z "$HELM_VERSION" ]; then
echo "HELM_VERSION environment variable not set, exiting."
diff --git a/tests/deploy/cluster-ci.tfvars.tftpl b/tests/deploy/cluster-ci.tfvars.tftpl
index fc0e5ef4..ac42ffc2 100644
--- a/tests/deploy/cluster-ci.tfvars.tftpl
+++ b/tests/deploy/cluster-ci.tfvars.tftpl
@@ -3,7 +3,7 @@ irsa_external_dns = {
hosted_zone_name = "deploys-delta.domino.tech"
}
-irsa_external_deployments_operator = {
+external_deployments_operator = {
enabled = true
namespace = "domino-compute"
service_account_name = "test-operator-account"
diff --git a/tests/deploy/meta.sh b/tests/deploy/meta.sh
index e54a95e2..ff6caf98 100644
--- a/tests/deploy/meta.sh
+++ b/tests/deploy/meta.sh
@@ -12,13 +12,13 @@ NODES_VARS_TPL="${SH_DIR}/nodes-ci.tfvars.tftpl"
declare -A COMP_MODS
COMP_MODS["infra"]="infra"
-COMP_MODS["cluster"]="eks irsa_external_dns irsa_policies irsa_external_deployments_operator"
+COMP_MODS["cluster"]="eks irsa_external_dns irsa_policies external_deployments_operator"
COMP_MODS["nodes"]="nodes"
declare -A MOD_ADD
MOD_ADD["irsa_external_dns"]="irsa"
MOD_ADD["irsa_policies"]="irsa"
-MOD_ADD["irsa_external_deployments_operator"]="irsa"
+MOD_ADD["external_deployments_operator"]="external_deployments_operator"
export SH_DIR \
CI_DEPLOY \
diff --git a/tests/plan/terraform/README.md b/tests/plan/terraform/README.md
index c52c13cc..35531cd5 100644
--- a/tests/plan/terraform/README.md
+++ b/tests/plan/terraform/README.md
@@ -8,21 +8,21 @@
| Name | Version |
|------|---------|
| [terraform](#requirement\_terraform) | >= 1.4.0 |
-| [aws](#requirement\_aws) | ~> 5.0 |
+| [aws](#requirement\_aws) | <5.67.0 |
## Providers
| Name | Version |
|------|---------|
-| [aws](#provider\_aws) | ~> 5.0 |
+| [aws](#provider\_aws) | <5.67.0 |
## Modules
| Name | Source | Version |
|------|--------|---------|
| [eks](#module\_eks) | ./../../../modules/eks | n/a |
+| [external\_deployments\_operator](#module\_external\_deployments\_operator) | ./../../../modules/external-deployments | n/a |
| [infra](#module\_infra) | ./../../../modules/infra/ | n/a |
-| [irsa\_external\_deployments\_operator](#module\_irsa\_external\_deployments\_operator) | ./../../../modules/irsa | n/a |
| [irsa\_external\_dns](#module\_irsa\_external\_dns) | ./../../../modules/irsa | n/a |
| [irsa\_policies](#module\_irsa\_policies) | ./../../../modules/irsa | n/a |
| [nodes](#module\_nodes) | ./../../../modules/nodes | n/a |
@@ -45,8 +45,8 @@
| [domino\_cur](#input\_domino\_cur) | Determines whether to provision domino cost related infrastructures, ie, long term storage | object({
provision_cost_usage_report = optional(bool, false)
}) | `{}` | no |
| [eks](#input\_eks) | k8s\_version = EKS cluster k8s version.
nodes\_master Grants the nodes role system:master access. NOT recomended
kubeconfig = {
extra\_args = Optional extra args when generating kubeconfig.
path = Fully qualified path name to write the kubeconfig file.
}
public\_access = {
enabled = Enable EKS API public endpoint.
cidrs = List of CIDR ranges permitted for accessing the EKS public endpoint.
}
Custom role maps for aws auth configmap
custom\_role\_maps = {
rolearn = string
username = string
groups = list(string)
}
master\_role\_names = IAM role names to be added as masters in eks.
cluster\_addons = EKS cluster addons. vpc-cni is installed separately.
vpc\_cni = Configuration for AWS VPC CNI
ssm\_log\_group\_name = CloudWatch log group to send the SSM session logs to.
identity\_providers = Configuration for IDP(Identity Provider).
} | object({
k8s_version = optional(string, "1.27")
nodes_master = optional(bool, false)
kubeconfig = optional(object({
extra_args = optional(string, "")
path = optional(string, null)
}), {})
public_access = optional(object({
enabled = optional(bool, false)
cidrs = optional(list(string), [])
}), {})
custom_role_maps = optional(list(object({
rolearn = string
username = string
groups = list(string)
})), [])
master_role_names = optional(list(string), [])
cluster_addons = optional(list(string), ["kube-proxy", "coredns"])
ssm_log_group_name = optional(string, "session-manager")
vpc_cni = optional(object({
prefix_delegation = optional(bool)
annotate_pod_ip = optional(bool)
}))
identity_providers = optional(list(object({
client_id = string
groups_claim = optional(string, null)
groups_prefix = optional(string, null)
identity_provider_config_name = string
issuer_url = optional(string, null)
required_claims = optional(string, null)
username_claim = optional(string, null)
username_prefix = optional(string, null)
})), [])
}) | `{}` | no |
| [enable\_private\_link](#input\_enable\_private\_link) | Enable Private Link connections | `bool` | `false` | no |
+| [external\_deployments\_operator](#input\_external\_deployments\_operator) | Config to create IRSA role for the external deployments operator. | object({
enabled = optional(bool, false)
namespace = optional(string, "domino-compute")
operator_service_account_name = optional(string, "pham-juno-operator")
operator_role_suffix = optional(string, "external-deployments-operator")
repository_suffix = optional(string, "external-deployments")
bucket_suffix = optional(string, "external-deployments")
enable_assume_any_external_role = optional(bool, true)
enable_in_account_deployments = optional(bool, true)
}) | `{}` | no |
| [ignore\_tags](#input\_ignore\_tags) | Tag keys to be ignored by the aws provider. | `list(string)` | `[]` | no |
-| [irsa\_external\_deployments\_operator](#input\_irsa\_external\_deployments\_operator) | Config to create IRSA role for the external deployments operator. | object({
enabled = optional(bool, false)
namespace = optional(string, "domino-compute")
service_account_name = optional(string, "pham-juno-operator")
}) | `{}` | no |
| [kms](#input\_kms) | enabled = Toggle,if set use either the specified KMS key\_id or a Domino-generated one.
key\_id = optional(string, null)
additional\_policies = "Allows setting additional KMS key policies when using a Domino-generated key" | object({
enabled = optional(bool, true)
key_id = optional(string, null)
additional_policies = optional(list(string), [])
}) | `{}` | no |
| [network](#input\_network) | vpc = {
id = Existing vpc id, it will bypass creation by this module.
subnets = {
private = Existing private subnets.
public = Existing public subnets.
pod = Existing pod subnets.
}), {})
}), {})
network\_bits = {
public = Number of network bits to allocate to the public subnet. i.e /27 -> 32 IPs.
private = Number of network bits to allocate to the private subnet. i.e /19 -> 8,192 IPs.
pod = Number of network bits to allocate to the private subnet. i.e /19 -> 8,192 IPs.
}
cidrs = {
vpc = The IPv4 CIDR block for the VPC.
pod = The IPv4 CIDR block for the Pod subnets.
}
use\_pod\_cidr = Use additional pod CIDR range (ie 100.64.0.0/16) for pod networking. | object({
vpc = optional(object({
id = optional(string, null)
subnets = optional(object({
private = optional(list(string), [])
public = optional(list(string), [])
pod = optional(list(string), [])
}), {})
}), {})
network_bits = optional(object({
public = optional(number, 27)
private = optional(number, 19)
pod = optional(number, 19)
}
), {})
cidrs = optional(object({
vpc = optional(string, "10.0.0.0/16")
pod = optional(string, "100.64.0.0/16")
}), {})
use_pod_cidr = optional(bool, true)
}) | `{}` | no |
| [region](#input\_region) | AWS region for the deployment | `string` | n/a | yes |
diff --git a/tests/plan/terraform/main.tf b/tests/plan/terraform/main.tf
index 388fcc4e..e5092974 100644
--- a/tests/plan/terraform/main.tf
+++ b/tests/plan/terraform/main.tf
@@ -71,11 +71,14 @@ module "irsa_policies" {
use_fips_endpoint = var.use_fips_endpoint
}
-module "irsa_external_deployments_operator" {
- source = "./../../../modules/irsa"
- eks_info = module.eks.info
- external_deployments_operator = var.irsa_external_deployments_operator
- use_fips_endpoint = var.use_fips_endpoint
+module "external_deployments_operator" {
+ count = var.external_deployments_operator.enabled ? 1 : 0
+
+ source = "./../../../modules/external-deployments"
+ eks_info = module.eks.info
+ kms_info = module.infra.kms
+ region = module.infra.region
+ external_deployments = var.external_deployments_operator
}
module "nodes" {
diff --git a/tests/plan/terraform/variables.tf b/tests/plan/terraform/variables.tf
index 489ee938..cdec672c 100644
--- a/tests/plan/terraform/variables.tf
+++ b/tests/plan/terraform/variables.tf
@@ -483,13 +483,18 @@ variable "use_fips_endpoint" {
default = false
}
-variable "irsa_external_deployments_operator" {
+variable "external_deployments_operator" {
description = "Config to create IRSA role for the external deployments operator."
type = object({
- enabled = optional(bool, false)
- namespace = optional(string, "domino-compute")
- service_account_name = optional(string, "pham-juno-operator")
+ enabled = optional(bool, false)
+ namespace = optional(string, "domino-compute")
+ operator_service_account_name = optional(string, "pham-juno-operator")
+ operator_role_suffix = optional(string, "external-deployments-operator")
+ repository_suffix = optional(string, "external-deployments")
+ bucket_suffix = optional(string, "external-deployments")
+ enable_assume_any_external_role = optional(bool, true)
+ enable_in_account_deployments = optional(bool, true)
})
default = {}
diff --git a/tests/plan/terraform/versions.tf b/tests/plan/terraform/versions.tf
index df931ef0..3417fb61 100644
--- a/tests/plan/terraform/versions.tf
+++ b/tests/plan/terraform/versions.tf
@@ -11,8 +11,9 @@ terraform {
required_version = ">= 1.4.0"
required_providers {
aws = {
- source = "hashicorp/aws"
- version = "~> 5.0"
+ source = "hashicorp/aws"
+ # pinned until https://github.com/hashicorp/terraform-provider-aws/pull/39328 is released
+ version = "<5.67.0"
}
}
}