Skip to content

Commit da2c78b

Browse files
nauxliumax-rocket-internet
nauxliu
authored and
max-rocket-internet
committed
Upgrade to terraform 0.12 (#394)
* run terraform upgrade tool * fix post upgrade TODOs * use strict typing for variables * upgrade examples, point them at VPC module tf 0.12 PR * remove unnecessary `coalesce()` calls coalesce(lookup(map, key, ""), default) -> lookup(map, key, default) * Fix autoscaling_enabled broken (#1) * always set a value for tags, fix coalescelist calls * always set a value for these tags * fix tag value * fix tag value * default element available * added default value * added a general default without this default - TF is throwing an error when running a destroy * Fix CI * Change vpc module back to `terraform-aws-modules/vpc/aws` in example * Update CHANGELOG.md * Change type of variable `cluster_log_retention_in_days` to number * Remove `xx_count` variables * Actual lists instead of strings with commas * Remove `xx_count` variable from docs * Replace element with list indexing * Change variable `worker_group_tags` to a attribute of worker_group * Fix workers_launch_template_mixed tags * Change override_instance_type_x variables to list. * Update CHANGELOG.md
1 parent 3f06015 commit da2c78b

24 files changed

+1275
-636
lines changed

‎.travis.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ install:
2323
- bundle install
2424

2525
before_script:
26-
- export TERRAFORM_VERSION=0.11.14
26+
- export TERRAFORM_VERSION=0.12.2
2727
- curl --silent --output terraform.zip "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_linux_amd64.zip"
2828
- unzip terraform.zip ; rm -f terraform.zip; chmod +x terraform
2929
- mkdir -p ${HOME}/bin ; export PATH=${PATH}:${HOME}/bin; mv terraform ${HOME}/bin/

‎CHANGELOG.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ project adheres to [Semantic Versioning](http://semver.org/).
77

88
## Next release
99

10-
## [[v4.?.?](https://github.com/terraform-aws-modules/terraform-aws-eks/compare/v4.0.0...HEAD)] - 2019-06-??]
10+
## [[v5.0.0](https://github.com/terraform-aws-modules/terraform-aws-eks/compare/v4.0.2...HEAD)] - 2019-06-??]
1111

1212
### Added
1313

@@ -18,6 +18,11 @@ project adheres to [Semantic Versioning](http://semver.org/).
1818

1919
### Changed
2020

21+
- Finally, Terraform 0.12 support, [Upgrade Guide](https://github.com/terraform-aws-modules/terraform-aws-eks/pull/394) (by @alex-goncharov @nauxliu @timboven)
22+
- All the xx_count variables have been removed (by @nauxliu on behalf of RightCapital)
23+
- Use actual lists in the workers group maps instead of strings with commas (by @nauxliu on behalf of RightCapital)
24+
- Move variable `worker_group_tags` to workers group's attribute `tags` (by @nauxliu on behalf of RightCapital)
25+
- Change override instance_types to list (by @nauxliu on behalf of RightCapital)
2126
- Fix toggle for IAM instance profile creation for mixed launch templates (by @jnozo)
2227

2328
# History

‎README.md‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,11 @@ module "my-cluster" {
3232
{
3333
instance_type = "m4.large"
3434
asg_max_size = 5
35+
tags = {
36+
key = "foo"
37+
value = "bar"
38+
propagate_at_launch = true
39+
}
3540
}
3641
]
3742
@@ -130,29 +135,21 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a
130135
| manage\_cluster\_iam\_resources | Whether to let the module manage cluster IAM resources. If set to false, cluster_iam_role_name must be specified. | string | `"true"` | no |
131136
| manage\_worker\_iam\_resources | Whether to let the module manage worker IAM resources. If set to false, iam_instance_profile_name must be specified for workers. | string | `"true"` | no |
132137
| map\_accounts | Additional AWS account numbers to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | list | `[]` | no |
133-
| map\_accounts\_count | The count of accounts in the map_accounts list. | string | `"0"` | no |
134138
| map\_roles | Additional IAM roles to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | list | `[]` | no |
135-
| map\_roles\_count | The count of roles in the map_roles list. | string | `"0"` | no |
136139
| map\_users | Additional IAM users to add to the aws-auth configmap. See examples/basic/variables.tf for example format. | list | `[]` | no |
137-
| map\_users\_count | The count of roles in the map_users list. | string | `"0"` | no |
138140
| permissions\_boundary | If provided, all IAM roles will be created with this permissions boundary attached. | string | `""` | no |
139141
| subnets | A list of subnets to place the EKS cluster and workers within. | list | n/a | yes |
140142
| tags | A map of tags to add to all resources. | map | `{}` | no |
141143
| vpc\_id | VPC where the cluster and workers will be deployed. | string | n/a | yes |
142144
| worker\_additional\_security\_group\_ids | A list of additional security group ids to attach to worker instances | list | `[]` | no |
143145
| worker\_ami\_name\_filter | Additional name filter for AWS EKS worker AMI. Default behaviour will get latest for the cluster_version but could be set to a release from amazon-eks-ami, e.g. "v20190220" | string | `"v*"` | no |
144146
| worker\_create\_security\_group | Whether to create a security group for the workers or attach the workers to `worker_security_group_id`. | string | `"true"` | no |
145-
| worker\_group\_count | The number of maps contained within the worker_groups list. | string | `"1"` | no |
146-
| worker\_group\_launch\_template\_count | The number of maps contained within the worker_groups_launch_template list. | string | `"0"` | no |
147-
| worker\_group\_launch\_template\_mixed\_count | The number of maps contained within the worker_groups_launch_template_mixed list. | string | `"0"` | no |
148-
| worker\_group\_tags | A map defining extra tags to be applied to the worker group ASG. | map | `{ "default": [] }` | no |
149147
| worker\_groups | A list of maps defining worker group configurations to be defined using AWS Launch Configurations. See workers_group_defaults for valid keys. | list | `[ { "name": "default" } ]` | no |
150148
| worker\_groups\_launch\_template | A list of maps defining worker group configurations to be defined using AWS Launch Templates. See workers_group_defaults for valid keys. | list | `[ { "name": "default" } ]` | no |
151149
| worker\_groups\_launch\_template\_mixed | A list of maps defining worker group configurations to be defined using AWS Launch Templates. See workers_group_defaults for valid keys. | list | `[ { "name": "default" } ]` | no |
152150
| worker\_security\_group\_id | If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingres/egress to work with the EKS cluster. | string | `""` | no |
153151
| worker\_sg\_ingress\_from\_port | Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443). | string | `"1025"` | no |
154152
| workers\_additional\_policies | Additional policies to be added to workers | list | `[]` | no |
155-
| workers\_additional\_policies\_count | | string | `"0"` | no |
156153
| workers\_group\_defaults | Override default values for target groups. See workers_group_defaults_defaults in local.tf for valid keys. | map | `{}` | no |
157154
| write\_aws\_auth\_config | Whether to write the aws-auth configmap file. | string | `"true"` | no |
158155
| write\_kubeconfig | Whether to write a Kubectl config file containing the cluster configuration. Saved to `config_output_path`. | string | `"true"` | no |

‎aws_auth.tf‎

Lines changed: 90 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -1,103 +1,140 @@
11
resource "local_file" "config_map_aws_auth" {
2-
count = "${var.write_aws_auth_config ? 1 : 0}"
3-
content = "${data.template_file.config_map_aws_auth.rendered}"
2+
count = var.write_aws_auth_config ? 1 : 0
3+
content = data.template_file.config_map_aws_auth.rendered
44
filename = "${var.config_output_path}config-map-aws-auth_${var.cluster_name}.yaml"
55
}
66

77
resource "null_resource" "update_config_map_aws_auth" {
8-
count = "${var.manage_aws_auth ? 1 : 0}"
9-
depends_on = ["aws_eks_cluster.this"]
8+
count = var.manage_aws_auth ? 1 : 0
9+
depends_on = [aws_eks_cluster.this]
1010

1111
provisioner "local-exec" {
12-
working_dir = "${path.module}"
12+
working_dir = path.module
1313

1414
command = <<EOS
1515
for i in `seq 1 10`; do \
16-
echo "${null_resource.update_config_map_aws_auth.triggers.kube_config_map_rendered}" > kube_config.yaml & \
17-
echo "${null_resource.update_config_map_aws_auth.triggers.config_map_rendered}" > aws_auth_configmap.yaml & \
16+
echo "${null_resource.update_config_map_aws_auth[0].triggers.kube_config_map_rendered}" > kube_config.yaml & \
17+
echo "${null_resource.update_config_map_aws_auth[0].triggers.config_map_rendered}" > aws_auth_configmap.yaml & \
1818
kubectl apply -f aws_auth_configmap.yaml --kubeconfig kube_config.yaml && break || \
1919
sleep 10; \
2020
done; \
2121
rm aws_auth_configmap.yaml kube_config.yaml;
2222
EOS
2323

24-
interpreter = ["${var.local_exec_interpreter}"]
24+
25+
interpreter = var.local_exec_interpreter
2526
}
2627

27-
triggers {
28-
kube_config_map_rendered = "${data.template_file.kubeconfig.rendered}"
29-
config_map_rendered = "${data.template_file.config_map_aws_auth.rendered}"
30-
endpoint = "${aws_eks_cluster.this.endpoint}"
28+
triggers = {
29+
kube_config_map_rendered = data.template_file.kubeconfig.rendered
30+
config_map_rendered = data.template_file.config_map_aws_auth.rendered
31+
endpoint = aws_eks_cluster.this.endpoint
3132
}
3233
}
3334

34-
data "aws_caller_identity" "current" {}
35+
data "aws_caller_identity" "current" {
36+
}
3537

3638
data "template_file" "launch_template_mixed_worker_role_arns" {
37-
count = "${var.worker_group_launch_template_mixed_count}"
38-
template = "${file("${path.module}/templates/worker-role.tpl")}"
39-
40-
vars {
41-
worker_role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${element(coalescelist(aws_iam_instance_profile.workers_launch_template_mixed.*.role, data.aws_iam_instance_profile.custom_worker_group_launch_template_mixed_iam_instance_profile.*.role_name), count.index)}"
39+
count = local.worker_group_launch_template_mixed_count
40+
template = file("${path.module}/templates/worker-role.tpl")
41+
42+
vars = {
43+
worker_role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${element(
44+
coalescelist(
45+
aws_iam_instance_profile.workers_launch_template_mixed.*.role,
46+
data.aws_iam_instance_profile.custom_worker_group_launch_template_mixed_iam_instance_profile.*.role_name,
47+
),
48+
count.index,
49+
)}"
4250
}
4351
}
4452

4553
data "template_file" "launch_template_worker_role_arns" {
46-
count = "${var.worker_group_launch_template_count}"
47-
template = "${file("${path.module}/templates/worker-role.tpl")}"
48-
49-
vars {
50-
worker_role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${element(coalescelist(aws_iam_instance_profile.workers_launch_template.*.role, data.aws_iam_instance_profile.custom_worker_group_launch_template_iam_instance_profile.*.role_name), count.index)}"
54+
count = local.worker_group_launch_template_count
55+
template = file("${path.module}/templates/worker-role.tpl")
56+
57+
vars = {
58+
worker_role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${element(
59+
coalescelist(
60+
aws_iam_instance_profile.workers_launch_template.*.role,
61+
data.aws_iam_instance_profile.custom_worker_group_launch_template_iam_instance_profile.*.role_name,
62+
),
63+
count.index,
64+
)}"
5165
}
5266
}
5367

5468
data "template_file" "worker_role_arns" {
55-
count = "${var.worker_group_count}"
56-
template = "${file("${path.module}/templates/worker-role.tpl")}"
57-
58-
vars {
59-
worker_role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${element(coalescelist(aws_iam_instance_profile.workers.*.role, data.aws_iam_instance_profile.custom_worker_group_iam_instance_profile.*.role_name), count.index)}"
69+
count = local.worker_group_count
70+
template = file("${path.module}/templates/worker-role.tpl")
71+
72+
vars = {
73+
worker_role_arn = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${element(
74+
coalescelist(
75+
aws_iam_instance_profile.workers.*.role,
76+
data.aws_iam_instance_profile.custom_worker_group_iam_instance_profile.*.role_name,
77+
[""]
78+
),
79+
count.index,
80+
)}"
6081
}
6182
}
6283

6384
data "template_file" "config_map_aws_auth" {
64-
template = "${file("${path.module}/templates/config-map-aws-auth.yaml.tpl")}"
65-
66-
vars {
67-
worker_role_arn = "${join("", distinct(concat(data.template_file.launch_template_worker_role_arns.*.rendered, data.template_file.worker_role_arns.*.rendered, data.template_file.launch_template_mixed_worker_role_arns.*.rendered)))}"
68-
map_users = "${join("", data.template_file.map_users.*.rendered)}"
69-
map_roles = "${join("", data.template_file.map_roles.*.rendered)}"
70-
map_accounts = "${join("", data.template_file.map_accounts.*.rendered)}"
85+
template = file("${path.module}/templates/config-map-aws-auth.yaml.tpl")
86+
87+
vars = {
88+
worker_role_arn = join(
89+
"",
90+
distinct(
91+
concat(
92+
data.template_file.launch_template_worker_role_arns.*.rendered,
93+
data.template_file.worker_role_arns.*.rendered,
94+
data.template_file.launch_template_mixed_worker_role_arns.*.rendered,
95+
),
96+
),
97+
)
98+
map_users = join("", data.template_file.map_users.*.rendered)
99+
map_roles = join("", data.template_file.map_roles.*.rendered)
100+
map_accounts = join("", data.template_file.map_accounts.*.rendered)
71101
}
72102
}
73103

74104
data "template_file" "map_users" {
75-
count = "${var.map_users_count}"
76-
template = "${file("${path.module}/templates/config-map-aws-auth-map_users.yaml.tpl")}"
77-
78-
vars {
79-
user_arn = "${lookup(var.map_users[count.index], "user_arn")}"
80-
username = "${lookup(var.map_users[count.index], "username")}"
81-
group = "${lookup(var.map_users[count.index], "group")}"
105+
count = length(var.map_users)
106+
template = file(
107+
"${path.module}/templates/config-map-aws-auth-map_users.yaml.tpl",
108+
)
109+
110+
vars = {
111+
user_arn = var.map_users[count.index]["user_arn"]
112+
username = var.map_users[count.index]["username"]
113+
group = var.map_users[count.index]["group"]
82114
}
83115
}
84116

85117
data "template_file" "map_roles" {
86-
count = "${var.map_roles_count}"
87-
template = "${file("${path.module}/templates/config-map-aws-auth-map_roles.yaml.tpl")}"
88-
89-
vars {
90-
role_arn = "${lookup(var.map_roles[count.index], "role_arn")}"
91-
username = "${lookup(var.map_roles[count.index], "username")}"
92-
group = "${lookup(var.map_roles[count.index], "group")}"
118+
count = length(var.map_roles)
119+
template = file(
120+
"${path.module}/templates/config-map-aws-auth-map_roles.yaml.tpl",
121+
)
122+
123+
vars = {
124+
role_arn = var.map_roles[count.index]["role_arn"]
125+
username = var.map_roles[count.index]["username"]
126+
group = var.map_roles[count.index]["group"]
93127
}
94128
}
95129

96130
data "template_file" "map_accounts" {
97-
count = "${var.map_accounts_count}"
98-
template = "${file("${path.module}/templates/config-map-aws-auth-map_accounts.yaml.tpl")}"
131+
count = length(var.map_accounts)
132+
template = file(
133+
"${path.module}/templates/config-map-aws-auth-map_accounts.yaml.tpl",
134+
)
99135

100-
vars {
101-
account_number = "${element(var.map_accounts, count.index)}"
136+
vars = {
137+
account_number = var.map_accounts[count.index]
102138
}
103139
}
140+

‎cluster.tf‎

Lines changed: 40 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,83 +1,89 @@
11
resource "aws_cloudwatch_log_group" "this" {
22
name = "/aws/eks/${var.cluster_name}/cluster"
3-
retention_in_days = "${var.cluster_log_retention_in_days}"
3+
retention_in_days = var.cluster_log_retention_in_days
44

5-
count = "${length(var.cluster_enabled_log_types) > 0 ? 1 : 0}"
5+
count = length(var.cluster_enabled_log_types) > 0 ? 1 : 0
66
}
77

88
resource "aws_eks_cluster" "this" {
9-
name = "${var.cluster_name}"
10-
enabled_cluster_log_types = "${var.cluster_enabled_log_types}"
11-
role_arn = "${local.cluster_iam_role_arn}"
12-
version = "${var.cluster_version}"
9+
name = var.cluster_name
10+
enabled_cluster_log_types = var.cluster_enabled_log_types
11+
role_arn = local.cluster_iam_role_arn
12+
version = var.cluster_version
1313

1414
vpc_config {
15-
security_group_ids = ["${local.cluster_security_group_id}"]
16-
subnet_ids = ["${var.subnets}"]
17-
endpoint_private_access = "${var.cluster_endpoint_private_access}"
18-
endpoint_public_access = "${var.cluster_endpoint_public_access}"
15+
security_group_ids = [local.cluster_security_group_id]
16+
subnet_ids = var.subnets
17+
endpoint_private_access = var.cluster_endpoint_private_access
18+
endpoint_public_access = var.cluster_endpoint_public_access
1919
}
2020

2121
timeouts {
22-
create = "${var.cluster_create_timeout}"
23-
delete = "${var.cluster_delete_timeout}"
22+
create = var.cluster_create_timeout
23+
delete = var.cluster_delete_timeout
2424
}
2525

2626
depends_on = [
27-
"aws_iam_role_policy_attachment.cluster_AmazonEKSClusterPolicy",
28-
"aws_iam_role_policy_attachment.cluster_AmazonEKSServicePolicy",
29-
"aws_cloudwatch_log_group.this",
27+
aws_iam_role_policy_attachment.cluster_AmazonEKSClusterPolicy,
28+
aws_iam_role_policy_attachment.cluster_AmazonEKSServicePolicy,
29+
aws_cloudwatch_log_group.this
3030
]
3131
}
3232

3333
resource "aws_security_group" "cluster" {
34-
count = "${var.cluster_create_security_group ? 1 : 0}"
35-
name_prefix = "${var.cluster_name}"
34+
count = var.cluster_create_security_group ? 1 : 0
35+
name_prefix = var.cluster_name
3636
description = "EKS cluster security group."
37-
vpc_id = "${var.vpc_id}"
38-
tags = "${merge(var.tags, map("Name", "${var.cluster_name}-eks_cluster_sg"))}"
37+
vpc_id = var.vpc_id
38+
tags = merge(
39+
var.tags,
40+
{
41+
"Name" = "${var.cluster_name}-eks_cluster_sg"
42+
},
43+
)
3944
}
4045

4146
resource "aws_security_group_rule" "cluster_egress_internet" {
42-
count = "${var.cluster_create_security_group ? 1 : 0}"
47+
count = var.cluster_create_security_group ? 1 : 0
4348
description = "Allow cluster egress access to the Internet."
4449
protocol = "-1"
45-
security_group_id = "${aws_security_group.cluster.id}"
50+
security_group_id = aws_security_group.cluster[0].id
4651
cidr_blocks = ["0.0.0.0/0"]
4752
from_port = 0
4853
to_port = 0
4954
type = "egress"
5055
}
5156

5257
resource "aws_security_group_rule" "cluster_https_worker_ingress" {
53-
count = "${var.cluster_create_security_group ? 1 : 0}"
58+
count = var.cluster_create_security_group ? 1 : 0
5459
description = "Allow pods to communicate with the EKS cluster API."
5560
protocol = "tcp"
56-
security_group_id = "${aws_security_group.cluster.id}"
57-
source_security_group_id = "${local.worker_security_group_id}"
61+
security_group_id = aws_security_group.cluster[0].id
62+
source_security_group_id = local.worker_security_group_id
5863
from_port = 443
5964
to_port = 443
6065
type = "ingress"
6166
}
6267

6368
resource "aws_iam_role" "cluster" {
64-
count = "${var.manage_cluster_iam_resources ? 1 : 0}"
65-
name_prefix = "${var.cluster_name}"
66-
assume_role_policy = "${data.aws_iam_policy_document.cluster_assume_role_policy.json}"
67-
permissions_boundary = "${var.permissions_boundary}"
68-
path = "${var.iam_path}"
69+
count = var.manage_cluster_iam_resources ? 1 : 0
70+
name_prefix = var.cluster_name
71+
assume_role_policy = data.aws_iam_policy_document.cluster_assume_role_policy.json
72+
permissions_boundary = var.permissions_boundary
73+
path = var.iam_path
6974
force_detach_policies = true
70-
tags = "${var.tags}"
75+
tags = var.tags
7176
}
7277

7378
resource "aws_iam_role_policy_attachment" "cluster_AmazonEKSClusterPolicy" {
74-
count = "${var.manage_cluster_iam_resources ? 1 : 0}"
79+
count = var.manage_cluster_iam_resources ? 1 : 0
7580
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
76-
role = "${aws_iam_role.cluster.name}"
81+
role = aws_iam_role.cluster[0].name
7782
}
7883

7984
resource "aws_iam_role_policy_attachment" "cluster_AmazonEKSServicePolicy" {
80-
count = "${var.manage_cluster_iam_resources ? 1 : 0}"
85+
count = var.manage_cluster_iam_resources ? 1 : 0
8186
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSServicePolicy"
82-
role = "${aws_iam_role.cluster.name}"
87+
role = aws_iam_role.cluster[0].name
8388
}
89+

0 commit comments

Comments
 (0)