Skip to content

Commit 5d6e139

Browse files
a-hilalya-hilaly
authored
Merge pull request #204 from rushmash91/main
update ACK controllers to combine 7 controllers into a single resource
2 parents 2d1a2f8 + 4bada2b commit 5d6e139

21 files changed

+3602
-63
lines changed

‎examples/ack-controller/README.md‎

Lines changed: 69 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,75 @@
11
# Steps to deploy ack-controllers to cluster
22

33
## Deploying Controllers
4-
### Prerequisites
5-
Create IRSA for IAM controller
6-
See [ACK Docs] (https://aws-controllers-k8s.github.io/community/docs/user-docs/irsa/)
4+
Conbined ResourseGroup for ACK Controllers
5+
- IAM
6+
- EC2
7+
- EKS
8+
- ECR
9+
- ECR Public
10+
- SQS
11+
- S3
712

8-
### Deployment order:
9-
1. IAM
10-
2. EC2
11-
3. EKS
1213

1314
### Steps
14-
For these EKS and EC2 controllers we are using the IAM controller to create
15-
the necessary roles for the service account
16-
1. Deploy Controller CRD Group
17-
2. Deploy Controller ResourceGroup
18-
3. Deploy Controller Instance (don't forget to include required fields)
15+
The controllers are using the IAM controller to create the necessary roles for the service account
16+
1. Setup IRSA (IAM Roles for Service Accounts) for the IAM controller:
17+
See [ACK Docs] (https://aws-controllers-k8s.github.io/community/docs/user-docs/irsa/)
18+
19+
Run the `setup_iam_controller.sh` script to create the necessary IAM role and service account.
20+
`chmod +x setup_iam_controller.sh`
21+
22+
```bash
23+
./setup_iam_controller.sh
24+
```
25+
26+
You can customize the script execution with the following options:
27+
28+
```
29+
Usage: ./setup_iam_controller.sh [OPTIONS]
30+
Options:
31+
--cluster-name NAME Set EKS cluster name (default: curious-folk-badger)
32+
--region REGION Set AWS region (default: us-west-2)
33+
--namespace NAMESPACE Set Kubernetes namespace (default: kro)
34+
--service-account NAME Set service account name (default: ack-iam-controller-sa)
35+
--help Display this help message
36+
```
37+
38+
For example, to use a different cluster name and region:
39+
40+
```bash
41+
./setup_iam_controller.sh --cluster-name my-cluster --region us-east-1
42+
```
43+
44+
You can also set these values using environment variables:
45+
46+
```bash
47+
EKS_CLUSTER_NAME=my-cluster AWS_REGION=us-east-1 ./setup_iam_controller.sh
48+
```
49+
50+
2. Install the IAM controller:
51+
- Apply the CRD (Custom Resource Definition)
52+
- Deploy the controller
53+
- Create an instance of the controller
54+
55+
3. Install all the Resource Group CRDs:
56+
```
57+
kubectl apply -f crds/
58+
```
59+
60+
4. Install all the controllers:
61+
```
62+
kubectl apply -f controllers/
63+
```
64+
65+
5. Install the combined Resource Group controllers:
66+
```
67+
kubectl apply -f resourcegroup.yaml
68+
```
69+
6. Install the combined instance:
70+
71+
All contollers are enable by default.
72+
73+
```
74+
kubectl apply -f instance.yaml
75+
```

examples/ack-controller/ec2-controller/ec2-controller.yaml renamed to examples/ack-controller/controllers/ec2-controller.yaml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ apiVersion: kro.run/v1alpha1
22
kind: ResourceGroup
33
metadata:
44
name: ec2controller.kro.run
5+
namespace: kro
56
spec:
67
schema:
78
apiVersion: v1alpha1
@@ -522,4 +523,4 @@ spec:
522523
verbs:
523524
- get
524525
- patch
525-
- update
526+
- update

‎examples/ack-controller/controllers/ecr-controller.yaml‎

Lines changed: 261 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,261 @@
1+
apiVersion: kro.run/v1alpha1
2+
kind: ResourceGroup
3+
metadata:
4+
name: ecrcontrollers.kro.run
5+
namespace: kro
6+
spec:
7+
schema:
8+
apiVersion: v1alpha1
9+
kind: ECRController
10+
spec:
11+
name: string | default=ecr-controller
12+
namespace: string | default=default
13+
values:
14+
aws:
15+
accountID: string | required=true
16+
region: string | default=us-west-2
17+
deployment:
18+
containerPort: integer | default=8080
19+
replicas: integer | default=1
20+
iamRole:
21+
maxSessionDuration: integer | default=3600
22+
oidcProvider: string | required=true
23+
roleDescription: string | default=IRSA role for ACK ECR controller deployment on EKS cluster using kro Resource group
24+
iamPolicy:
25+
description: string | default="policy for ecr controller"
26+
image:
27+
deletePolicy: string | default=delete
28+
repository: string | default=public.ecr.aws/aws-controllers-k8s/ecr-controller
29+
tag: string | default=1.0.19
30+
resources:
31+
requests:
32+
memory: string | default=64Mi
33+
cpu: string | default=50m
34+
limits:
35+
memory: string | default=128Mi
36+
cpu: string | default=100m
37+
log:
38+
enabled: boolean | default=false
39+
level: string | default=info
40+
serviceAccount:
41+
name: string | default=ecr-controller-sa
42+
resources:
43+
- id: ecrCRDGroup
44+
template:
45+
apiVersion: kro.run/v1alpha1
46+
kind: ECRCRDGroup
47+
metadata:
48+
name: ${schema.spec.name}-crd-group
49+
spec:
50+
name: ${schema.spec.name}-crd-group
51+
- id: ecrControllerIamPolicy
52+
template:
53+
apiVersion: iam.services.k8s.aws/v1alpha1
54+
kind: Policy
55+
metadata:
56+
name: ${schema.spec.name}-iam-policy
57+
spec:
58+
name: ${schema.spec.name}-iam-policy
59+
description: ${schema.spec.values.iamPolicy.description}
60+
policyDocument: >
61+
{
62+
"Version": "2012-10-17",
63+
"Statement": [
64+
{
65+
"Effect": "Allow",
66+
"Action": [
67+
"ecr:*",
68+
"cloudtrail:LookupEvents"
69+
],
70+
"Resource": "*"
71+
},
72+
{
73+
"Effect": "Allow",
74+
"Action": [
75+
"iam:CreateServiceLinkedRole"
76+
],
77+
"Resource": "*",
78+
"Condition": {
79+
"StringEquals": {
80+
"iam:AWSServiceName": [
81+
"replication.ecr.amazonaws.com"
82+
]
83+
}
84+
}
85+
}
86+
]
87+
}
88+
- id: ecrControllerIamRole
89+
template:
90+
apiVersion: iam.services.k8s.aws/v1alpha1
91+
kind: Role
92+
metadata:
93+
name: ${schema.spec.name}-iam-role
94+
namespace: ${schema.spec.namespace}
95+
spec:
96+
name: ${schema.spec.name}-iam-role
97+
description: ${schema.spec.values.iamRole.roleDescription}
98+
maxSessionDuration: ${schema.spec.values.iamRole.maxSessionDuration}
99+
policies:
100+
- ${ecrControllerIamPolicy.status.ackResourceMetadata.arn}
101+
assumeRolePolicyDocument: >
102+
{
103+
"Version":"2012-10-17",
104+
"Statement": [{
105+
"Effect":"Allow",
106+
"Principal": {"Federated": "arn:aws:iam::${schema.spec.values.aws.accountID}:oidc-provider/${schema.spec.values.iamRole.oidcProvider}"},
107+
"Action": ["sts:AssumeRoleWithWebIdentity"],
108+
"Condition": {
109+
"StringEquals": {"${schema.spec.values.iamRole.oidcProvider}:sub": "system:serviceaccount:${schema.spec.namespace}:${schema.spec.values.serviceAccount.name}"}
110+
}
111+
}]
112+
}
113+
- id: serviceAccount
114+
template:
115+
apiVersion: v1
116+
kind: ServiceAccount
117+
metadata:
118+
name: ${schema.spec.values.serviceAccount.name}
119+
namespace: ${schema.spec.namespace}
120+
annotations:
121+
eks.amazonaws.com/role-arn : ${ecrControllerIamRole.status.ackResourceMetadata.arn}
122+
- id: deployment
123+
template:
124+
apiVersion: apps/v1
125+
kind: Deployment
126+
metadata:
127+
name: ${schema.spec.name}-deployment
128+
namespace: ${schema.spec.namespace}
129+
labels:
130+
app.kubernetes.io/name: ${schema.spec.name}-deployment
131+
app.kubernetes.io/instance: ${schema.spec.name}
132+
spec:
133+
replicas: ${schema.spec.values.deployment.replicas}
134+
selector:
135+
matchLabels:
136+
app.kubernetes.io/name: ${schema.spec.name}-deployment
137+
app.kubernetes.io/instance: ${schema.spec.name}
138+
template:
139+
metadata:
140+
labels:
141+
app.kubernetes.io/name: ${schema.spec.name}-deployment
142+
app.kubernetes.io/instance: ${schema.spec.name}
143+
spec:
144+
serviceAccountName: ${serviceAccount.metadata.name}
145+
containers:
146+
- command:
147+
- ./bin/controller
148+
args:
149+
- --aws-region
150+
- ${schema.spec.values.aws.region}
151+
- --enable-development-logging=${schema.spec.values.log.enabled}
152+
- --log-level
153+
- ${schema.spec.values.log.level}
154+
- --deletion-policy
155+
- ${schema.spec.values.image.deletePolicy}
156+
- --watch-namespace
157+
- ${schema.spec.namespace}
158+
image: ${schema.spec.values.image.repository}:${schema.spec.values.image.tag}
159+
name: controller
160+
ports:
161+
- name: http
162+
containerPort: ${schema.spec.values.deployment.containerPort}
163+
resources:
164+
requests:
165+
memory: ${schema.spec.values.image.resources.requests.memory}
166+
cpu: ${schema.spec.values.image.resources.requests.cpu}
167+
limits:
168+
memory: ${schema.spec.values.image.resources.limits.memory}
169+
cpu: ${schema.spec.values.image.resources.limits.cpu}
170+
env:
171+
- name: ACK_SYSTEM_NAMESPACE
172+
value: ${schema.spec.namespace}
173+
- name: AWS_REGION
174+
value: ${schema.spec.values.aws.region}
175+
- name: DELETE_POLICY
176+
value: ${schema.spec.values.image.deletePolicy}
177+
- name: ACK_LOG_LEVEL
178+
value: ${schema.spec.values.log.level}
179+
- id: clusterRoleBinding
180+
template:
181+
apiVersion: rbac.authorization.k8s.io/v1
182+
kind: ClusterRoleBinding
183+
metadata:
184+
name: ${schema.spec.name}-clusterrolebinding
185+
roleRef:
186+
kind: ClusterRole
187+
apiGroup: rbac.authorization.k8s.io
188+
name: ${clusterRole.metadata.name}
189+
subjects:
190+
- kind: ServiceAccount
191+
name: ${serviceAccount.metadata.name}
192+
namespace: ${serviceAccount.metadata.namespace}
193+
- id: clusterRole
194+
template:
195+
apiVersion: rbac.authorization.k8s.io/v1
196+
kind: ClusterRole
197+
metadata:
198+
name: ${schema.spec.name}-clusterrole
199+
rules:
200+
- apiGroups:
201+
- ""
202+
resources:
203+
- configmaps
204+
- secrets
205+
verbs:
206+
- get
207+
- list
208+
- patch
209+
- watch
210+
- apiGroups:
211+
- ""
212+
resources:
213+
- namespaces
214+
verbs:
215+
- get
216+
- list
217+
- watch
218+
- apiGroups:
219+
- ecr.services.k8s.aws
220+
resources:
221+
- pullthroughcacherules
222+
- repositories
223+
verbs:
224+
- create
225+
- delete
226+
- get
227+
- list
228+
- patch
229+
- update
230+
- watch
231+
- apiGroups:
232+
- ecr.services.k8s.aws
233+
resources:
234+
- pullthroughcacherules/status
235+
- repositories/status
236+
verbs:
237+
- get
238+
- patch
239+
- update
240+
- apiGroups:
241+
- services.k8s.aws
242+
resources:
243+
- adoptedresources
244+
- fieldexports
245+
verbs:
246+
- create
247+
- delete
248+
- get
249+
- list
250+
- patch
251+
- update
252+
- watch
253+
- apiGroups:
254+
- services.k8s.aws
255+
resources:
256+
- adoptedresources/status
257+
- fieldexports/status
258+
verbs:
259+
- get
260+
- patch
261+
- update

0 commit comments

Comments
 (0)