-
Notifications
You must be signed in to change notification settings - Fork 36
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: squash of capi working branch commits
- Loading branch information
Showing
36 changed files
with
2,857 additions
and
13 deletions.
There are no files selected for viewing
261 changes: 261 additions & 0 deletions
261
bootstrap/terraform/aws-bootstrap-cluster-api/aws-lb-controller.tf
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,261 @@ | ||
| module "assumable_role_alb" { | ||
| count = var.enable_aws_lb_controller ? 1 : 0 | ||
|
|
||
| source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc" | ||
| version = "3.14.0" | ||
| create_role = true | ||
| role_name = "${var.cluster_name}-alb" | ||
| provider_url = replace(local.cluster_oidc_issuer_url, "https://", "") | ||
| role_policy_arns = [aws_iam_policy.alb[0].arn] | ||
| oidc_fully_qualified_subjects = ["system:serviceaccount:${var.namespace}:${var.alb_serviceaccount}"] | ||
| } | ||
|
|
||
| resource "aws_iam_policy" "alb" { | ||
| count = var.enable_aws_lb_controller ? 1 : 0 | ||
|
|
||
| name_prefix = "alb-contrller" | ||
| description = "aws load balancer controller policy for cluster ${local.cluster_id}" | ||
| policy = <<-POLICY | ||
| { | ||
| "Version": "2012-10-17", | ||
| "Statement": [ | ||
| { | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "iam:CreateServiceLinkedRole" | ||
| ], | ||
| "Resource": "*", | ||
| "Condition": { | ||
| "StringEquals": { | ||
| "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" | ||
| } | ||
| } | ||
| }, | ||
| { | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "ec2:DescribeAccountAttributes", | ||
| "ec2:DescribeAddresses", | ||
| "ec2:DescribeAvailabilityZones", | ||
| "ec2:DescribeInternetGateways", | ||
| "ec2:DescribeVpcs", | ||
| "ec2:DescribeVpcPeeringConnections", | ||
| "ec2:DescribeSubnets", | ||
| "ec2:DescribeSecurityGroups", | ||
| "ec2:DescribeInstances", | ||
| "ec2:DescribeNetworkInterfaces", | ||
| "ec2:DescribeTags", | ||
| "ec2:GetCoipPoolUsage", | ||
| "ec2:DescribeCoipPools", | ||
| "elasticloadbalancing:DescribeLoadBalancers", | ||
| "elasticloadbalancing:DescribeLoadBalancerAttributes", | ||
| "elasticloadbalancing:DescribeListeners", | ||
| "elasticloadbalancing:DescribeListenerCertificates", | ||
| "elasticloadbalancing:DescribeSSLPolicies", | ||
| "elasticloadbalancing:DescribeRules", | ||
| "elasticloadbalancing:DescribeTargetGroups", | ||
| "elasticloadbalancing:DescribeTargetGroupAttributes", | ||
| "elasticloadbalancing:DescribeTargetHealth", | ||
| "elasticloadbalancing:DescribeTags" | ||
| ], | ||
| "Resource": "*" | ||
| }, | ||
| { | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "cognito-idp:DescribeUserPoolClient", | ||
| "acm:ListCertificates", | ||
| "acm:DescribeCertificate", | ||
| "iam:ListServerCertificates", | ||
| "iam:GetServerCertificate", | ||
| "waf-regional:GetWebACL", | ||
| "waf-regional:GetWebACLForResource", | ||
| "waf-regional:AssociateWebACL", | ||
| "waf-regional:DisassociateWebACL", | ||
| "wafv2:GetWebACL", | ||
| "wafv2:GetWebACLForResource", | ||
| "wafv2:AssociateWebACL", | ||
| "wafv2:DisassociateWebACL", | ||
| "shield:GetSubscriptionState", | ||
| "shield:DescribeProtection", | ||
| "shield:CreateProtection", | ||
| "shield:DeleteProtection" | ||
| ], | ||
| "Resource": "*" | ||
| }, | ||
| { | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "ec2:AuthorizeSecurityGroupIngress", | ||
| "ec2:RevokeSecurityGroupIngress" | ||
| ], | ||
| "Resource": "*" | ||
| }, | ||
| { | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "ec2:CreateSecurityGroup" | ||
| ], | ||
| "Resource": "*" | ||
| }, | ||
| { | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "ec2:CreateTags" | ||
| ], | ||
| "Resource": "arn:aws:ec2:*:*:security-group/*", | ||
| "Condition": { | ||
| "StringEquals": { | ||
| "ec2:CreateAction": "CreateSecurityGroup" | ||
| }, | ||
| "Null": { | ||
| "aws:RequestTag/elbv2.k8s.aws/cluster": "false" | ||
| } | ||
| } | ||
| }, | ||
| { | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "ec2:CreateTags", | ||
| "ec2:DeleteTags" | ||
| ], | ||
| "Resource": "arn:aws:ec2:*:*:security-group/*", | ||
| "Condition": { | ||
| "Null": { | ||
| "aws:RequestTag/elbv2.k8s.aws/cluster": "true", | ||
| "aws:ResourceTag/elbv2.k8s.aws/cluster": "false" | ||
| } | ||
| } | ||
| }, | ||
| { | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "ec2:AuthorizeSecurityGroupIngress", | ||
| "ec2:RevokeSecurityGroupIngress", | ||
| "ec2:DeleteSecurityGroup" | ||
| ], | ||
| "Resource": "*", | ||
| "Condition": { | ||
| "Null": { | ||
| "aws:ResourceTag/elbv2.k8s.aws/cluster": "false" | ||
| } | ||
| } | ||
| }, | ||
| { | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "elasticloadbalancing:CreateLoadBalancer", | ||
| "elasticloadbalancing:CreateTargetGroup" | ||
| ], | ||
| "Resource": "*", | ||
| "Condition": { | ||
| "Null": { | ||
| "aws:RequestTag/elbv2.k8s.aws/cluster": "false" | ||
| } | ||
| } | ||
| }, | ||
| { | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "elasticloadbalancing:CreateListener", | ||
| "elasticloadbalancing:DeleteListener", | ||
| "elasticloadbalancing:CreateRule", | ||
| "elasticloadbalancing:DeleteRule" | ||
| ], | ||
| "Resource": "*" | ||
| }, | ||
| { | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "elasticloadbalancing:AddTags", | ||
| "elasticloadbalancing:RemoveTags" | ||
| ], | ||
| "Resource": [ | ||
| "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*", | ||
| "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*", | ||
| "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*" | ||
| ], | ||
| "Condition": { | ||
| "Null": { | ||
| "aws:RequestTag/elbv2.k8s.aws/cluster": "true", | ||
| "aws:ResourceTag/elbv2.k8s.aws/cluster": "false" | ||
| } | ||
| } | ||
| }, | ||
| { | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "elasticloadbalancing:AddTags", | ||
| "elasticloadbalancing:RemoveTags" | ||
| ], | ||
| "Resource": [ | ||
| "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*", | ||
| "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*", | ||
| "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*", | ||
| "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*" | ||
| ] | ||
| }, | ||
| { | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "elasticloadbalancing:ModifyLoadBalancerAttributes", | ||
| "elasticloadbalancing:SetIpAddressType", | ||
| "elasticloadbalancing:SetSecurityGroups", | ||
| "elasticloadbalancing:SetSubnets", | ||
| "elasticloadbalancing:DeleteLoadBalancer", | ||
| "elasticloadbalancing:ModifyTargetGroup", | ||
| "elasticloadbalancing:ModifyTargetGroupAttributes", | ||
| "elasticloadbalancing:DeleteTargetGroup" | ||
| ], | ||
| "Resource": "*", | ||
| "Condition": { | ||
| "Null": { | ||
| "aws:ResourceTag/elbv2.k8s.aws/cluster": "false" | ||
| } | ||
| } | ||
| }, | ||
| { | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "elasticloadbalancing:AddTags" | ||
| ], | ||
| "Resource": [ | ||
| "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*", | ||
| "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*", | ||
| "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*" | ||
| ], | ||
| "Condition": { | ||
| "StringEquals": { | ||
| "elasticloadbalancing:CreateAction": [ | ||
| "CreateTargetGroup", | ||
| "CreateLoadBalancer" | ||
| ] | ||
| }, | ||
| "Null": { | ||
| "aws:RequestTag/elbv2.k8s.aws/cluster": "false" | ||
| } | ||
| } | ||
| }, | ||
| { | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "elasticloadbalancing:RegisterTargets", | ||
| "elasticloadbalancing:DeregisterTargets" | ||
| ], | ||
| "Resource": "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*" | ||
| }, | ||
| { | ||
| "Effect": "Allow", | ||
| "Action": [ | ||
| "elasticloadbalancing:SetWebAcl", | ||
| "elasticloadbalancing:ModifyListener", | ||
| "elasticloadbalancing:AddListenerCertificates", | ||
| "elasticloadbalancing:RemoveListenerCertificates", | ||
| "elasticloadbalancing:ModifyRule" | ||
| ], | ||
| "Resource": "*" | ||
| } | ||
| ] | ||
| } | ||
| POLICY | ||
| } |
Oops, something went wrong.