Skip to content

Commit 57f5130

Browse files
bryantbiggsbryantbiggs
authored
feat: Replace the use of toset() with static keys for node IAM role policy attachment (#2962)
1 parent bed26ac commit 57f5130

File tree

6 files changed

+80
-15
lines changed

6 files changed

+80
-15
lines changed

‎modules/eks-managed-node-group/main.tf‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -504,11 +504,12 @@ resource "aws_iam_role" "this" {
504504

505505
# Policies attached ref https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_node_group
506506
resource "aws_iam_role_policy_attachment" "this" {
507-
for_each = { for k, v in toset(compact([
508-
"${local.iam_role_policy_prefix}/AmazonEKSWorkerNodePolicy",
509-
"${local.iam_role_policy_prefix}/AmazonEC2ContainerRegistryReadOnly",
510-
var.iam_role_attach_cni_policy ? local.cni_policy : "",
511-
])) : k => v if var.create && var.create_iam_role }
507+
for_each = { for k, v in {
508+
AmazonEKSWorkerNodePolicy = "${local.iam_role_policy_prefix}/AmazonEKSWorkerNodePolicy"
509+
AmazonEC2ContainerRegistryReadOnly = "${local.iam_role_policy_prefix}/AmazonEC2ContainerRegistryReadOnly"
510+
AmazonEKS_CNI_IPv6_Policy = var.iam_role_attach_cni_policy && var.cluster_ip_family == "ipv6" ? local.cni_policy : ""
511+
AmazonEKS_CNI_Policy = var.iam_role_attach_cni_policy && var.cluster_ip_family == "ipv4" ? local.cni_policy : ""
512+
} : k => v if var.create && var.create_iam_role && v != "" }
512513

513514
policy_arn = each.value
514515
role = aws_iam_role.this[0].name

‎modules/eks-managed-node-group/migrations.tf‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
################################################################################
2+
# Migrations: v20.7 -> v20.8
3+
################################################################################
4+
5+
# Node IAM role policy attachment
6+
# Commercial partition only - `moved` does now allow multiple moves to same target
7+
moved {
8+
from = aws_iam_role_policy_attachment.this["arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"]
9+
to = aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"]
10+
}
11+
12+
moved {
13+
from = aws_iam_role_policy_attachment.this["arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"]
14+
to = aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"]
15+
}
16+
17+
moved {
18+
from = aws_iam_role_policy_attachment.this["arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"]
19+
to = aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"]
20+
}

‎modules/karpenter/main.tf‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -565,11 +565,12 @@ resource "aws_iam_role" "node" {
565565

566566
# Policies attached ref https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_node_group
567567
resource "aws_iam_role_policy_attachment" "node" {
568-
for_each = { for k, v in toset(compact([
569-
"${local.node_iam_role_policy_prefix}/AmazonEKSWorkerNodePolicy",
570-
"${local.node_iam_role_policy_prefix}/AmazonEC2ContainerRegistryReadOnly",
571-
var.node_iam_role_attach_cni_policy ? local.cni_policy : "",
572-
])) : k => v if local.create_node_iam_role }
568+
for_each = { for k, v in {
569+
AmazonEKSWorkerNodePolicy = "${local.node_iam_role_policy_prefix}/AmazonEKSWorkerNodePolicy"
570+
AmazonEC2ContainerRegistryReadOnly = "${local.node_iam_role_policy_prefix}/AmazonEC2ContainerRegistryReadOnly"
571+
AmazonEKS_CNI_IPv6_Policy = var.node_iam_role_attach_cni_policy && var.cluster_ip_family == "ipv6" ? local.cni_policy : ""
572+
AmazonEKS_CNI_Policy = var.node_iam_role_attach_cni_policy && var.cluster_ip_family == "ipv4" ? local.cni_policy : ""
573+
} : k => v if var.create && var.create_iam_role && v != "" }
573574

574575
policy_arn = each.value
575576
role = aws_iam_role.node[0].name

‎modules/karpenter/migrations.tf‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,3 +54,24 @@ moved {
5454
from = aws_cloudwatch_event_rule.this["spot_interupt"]
5555
to = aws_cloudwatch_event_rule.this["spot_interrupt"]
5656
}
57+
58+
################################################################################
59+
# Migrations: v20.7 -> v20.8
60+
################################################################################
61+
62+
# Node IAM role policy attachment
63+
# Commercial partition only - `moved` does now allow multiple moves to same target
64+
moved {
65+
from = aws_iam_role_policy_attachment.node["arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"]
66+
to = aws_iam_role_policy_attachment.node["AmazonEKSWorkerNodePolicy"]
67+
}
68+
69+
moved {
70+
from = aws_iam_role_policy_attachment.node["arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"]
71+
to = aws_iam_role_policy_attachment.node["AmazonEC2ContainerRegistryReadOnly"]
72+
}
73+
74+
moved {
75+
from = aws_iam_role_policy_attachment.node["arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"]
76+
to = aws_iam_role_policy_attachment.node["AmazonEKS_CNI_Policy"]
77+
}

‎modules/self-managed-node-group/main.tf‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -768,12 +768,14 @@ resource "aws_iam_role" "this" {
768768
tags = merge(var.tags, var.iam_role_tags)
769769
}
770770

771+
# Policies attached ref https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_node_group
771772
resource "aws_iam_role_policy_attachment" "this" {
772-
for_each = { for k, v in toset(compact([
773-
"${local.iam_role_policy_prefix}/AmazonEKSWorkerNodePolicy",
774-
"${local.iam_role_policy_prefix}/AmazonEC2ContainerRegistryReadOnly",
775-
var.iam_role_attach_cni_policy ? local.cni_policy : "",
776-
])) : k => v if var.create && var.create_iam_instance_profile }
773+
for_each = { for k, v in {
774+
AmazonEKSWorkerNodePolicy = "${local.iam_role_policy_prefix}/AmazonEKSWorkerNodePolicy"
775+
AmazonEC2ContainerRegistryReadOnly = "${local.iam_role_policy_prefix}/AmazonEC2ContainerRegistryReadOnly"
776+
AmazonEKS_CNI_IPv6_Policy = var.iam_role_attach_cni_policy && var.cluster_ip_family == "ipv6" ? local.cni_policy : ""
777+
AmazonEKS_CNI_Policy = var.iam_role_attach_cni_policy && var.cluster_ip_family == "ipv4" ? local.cni_policy : ""
778+
} : k => v if var.create && var.create_iam_instance_profile && v != "" }
777779

778780
policy_arn = each.value
779781
role = aws_iam_role.this[0].name

‎modules/self-managed-node-group/migrations.tf‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
################################################################################
2+
# Migrations: v20.7 -> v20.8
3+
################################################################################
4+
5+
# Node IAM role policy attachment
6+
# Commercial partition only - `moved` does now allow multiple moves to same target
7+
moved {
8+
from = aws_iam_role_policy_attachment.this["arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"]
9+
to = aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"]
10+
}
11+
12+
moved {
13+
from = aws_iam_role_policy_attachment.this["arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"]
14+
to = aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"]
15+
}
16+
17+
moved {
18+
from = aws_iam_role_policy_attachment.this["arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"]
19+
to = aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"]
20+
}

0 commit comments

Comments
 (0)