This module deploys a Helm chart for the Bitbucket runner autoscaler and supports deploying Bitbucket runner groups, as well as the AWS IAM components needed for Bitbucket runners to authenticate against AWS resources.
Check out other Terraform Kubernetes addons.
We help companies build, run, deploy and scale software and infrastructure by embracing the right technologies and principles. Check out our website at https://lablabs.io/.
Deploy Helm chart via Helm resource (default method, set enabled = true)
Deploy Helm chart as ArgoCD Application via Kubernetes manifest resource (set enabled = true and argo_enabled = true)
Warning
When deploying with ArgoCD application, Kubernetes terraform provider requires access to Kubernetes cluster API during plan time. This introduces potential issue when you want to deploy the cluster with this addon at the same time, during the same Terraform run.
To overcome this issue, the module deploys the ArgoCD application object using the Helm provider, which does not require API access during plan. If you want to deploy the application using this workaround, you can set the
argo_helm_enabledvariable totrue.
Deploy Helm chart as ArgoCD Application via Helm resource (set enabled = true, argo_enabled = true and argo_helm_enabled = true)
See basic example for further information. Refer to the IAM example for guidance on creating an assume role policy for IAM roles with a more limited scope.
| Name | Version |
|---|---|
| terraform | >= 1.5.0 |
| aws | ~> 5 |
| helm | >= 2.6.0 |
| kubernetes | >= 2.20.0 |
| utils | >= 0.17.0 |
| Name | Source | Version |
|---|---|---|
| addon | git::https://github.com/lablabs/terraform-aws-eks-universal-addon.git//modules/addon | v0.0.6 |
| addon-oidc | git::https://github.com/lablabs/terraform-aws-eks-universal-addon.git//modules/addon-oidc | v0.0.7 |
| Name | Type |
|---|---|
| utils_deep_merge_yaml.values | data source |
Important
Variables defined in variables-addon.tf defaults to null to have them overridable by the addon configuration defined though the local.addon.* local variable with some default values defined in addon.tf.
| Name | Description | Type |
|---|---|---|
| argo_apiversion | ArgoCD Application apiVersion. Defaults to "argoproj.io/v1alpha1". |
string |
| argo_destination_server | Destination server for ArgoCD Application. Defaults to "https://kubernetes.default.svc". |
string |
| argo_enabled | If set to true, the module will be deployed as ArgoCD application, otherwise it will be deployed as a Helm release. Defaults to false. |
bool |
| argo_helm_enabled | If set to true, the ArgoCD Application manifest will be deployed using Kubernetes provider as a Helm release. Otherwise it'll be deployed as a Kubernetes manifest. See README for more info. Defaults to false. |
bool |
| argo_helm_values | Value overrides to use when deploying ArgoCD Application object with Helm. Defaults to "". |
string |
| argo_helm_wait_backoff_limit | Backoff limit for ArgoCD Application Helm release wait job. Defaults to 6. |
number |
| argo_helm_wait_node_selector | Node selector for ArgoCD Application Helm release wait job. Defaults to {}. |
map(string) |
| argo_helm_wait_timeout | Timeout for ArgoCD Application Helm release wait job. Defaults to "10m". |
string |
| argo_helm_wait_tolerations | Tolerations for ArgoCD Application Helm release wait job. Defaults to []. |
list(any) |
| argo_info | ArgoCD info manifest parameter. Defaults to [{name="terraform",value=true}]. |
list(object({ |
| argo_kubernetes_manifest_computed_fields | List of paths of fields to be handled as "computed". The user-configured value for the field will be overridden by any different value returned by the API after apply. Defaults to ["metadata.labels", "metadata.annotations", "metadata.finalizers"]. |
list(string) |
| argo_kubernetes_manifest_field_manager_force_conflicts | Forcibly override any field manager conflicts when applying the kubernetes manifest resource. Defaults to false. |
bool |
| argo_kubernetes_manifest_field_manager_name | The name of the field manager to use when applying the Kubernetes manifest resource. Defaults to "Terraform". |
string |
| argo_kubernetes_manifest_wait_fields | A map of fields and a corresponding regular expression with a pattern to wait for. The provider will wait until the field matches the regular expression. Use * for any value. Defaults to {}. |
map(string) |
| argo_metadata | ArgoCD Application metadata configuration. Override or create additional metadata parameters. Defaults to {finalizers=["resources-finalizer.argocd.argoproj.io"]}. |
any |
| argo_namespace | Namespace to deploy ArgoCD application CRD to. Defaults to "argo". |
string |
| argo_project | ArgoCD Application project. Defaults to default. |
string |
| argo_spec | ArgoCD Application spec configuration. Override or create additional spec parameters. Defaults to {}. |
any |
| argo_sync_policy | ArgoCD syncPolicy manifest parameter. Defaults to {}. |
any |
| bitbucket_workspace_name | Bitbucket workspace name | string |
| bitbucket_workspace_uuid | Bitbucket workspace UUID | string |
| enabled | Set to false to prevent the module from creating any resources. | bool |
| helm_atomic | If set, installation process purges chart on fail. The wait flag will be set automatically if atomic is used. Defaults to false. |
bool |
| helm_chart_name | Helm chart name to be installed. Defaults to local.addon.name (required). |
string |
| helm_chart_version | Version of the Helm chart. Defaults to local.addon.helm_chart_version (required). |
string |
| helm_cleanup_on_fail | Allow deletion of new resources created in this Helm upgrade when upgrade fails. Defaults to false. |
bool |
| helm_create_namespace | Create the namespace if it does not yet exist. Defaults to true. |
bool |
| helm_dependency_update | Runs Helm dependency update before installing the chart. Defaults to false. |
bool |
| helm_description | Set Helm release description attribute (visible in the history). Defaults to "". |
string |
| helm_devel | Use Helm chart development versions, too. Equivalent to version '>0.0.0-0'. If version is set, this is ignored. Defaults to false. |
bool |
| helm_disable_openapi_validation | If set, the installation process will not validate rendered Helm templates against the Kubernetes OpenAPI Schema. Defaults to false. |
bool |
| helm_disable_webhooks | Prevent Helm chart hooks from running. Defaults to false. |
bool |
| helm_force_update | Force Helm resource update through delete/recreate if needed. Defaults to false. |
bool |
| helm_keyring | Location of public keys used for verification. Used only if helm_package_verify is true. Defaults to "~/.gnupg/pubring.gpg". |
string |
| helm_lint | Run the Helm chart linter during the plan. Defaults to false. |
bool |
| helm_package_verify | Verify the package before installing it. Helm uses a provenance file to verify the integrity of the chart; this must be hosted alongside the chart. Defaults to false. |
bool |
| helm_postrender | Value block with a path to a binary file to run after Helm renders the manifest which can alter the manifest contents. Defaults to {}. |
map(any) |
| helm_recreate_pods | Perform pods restart during Helm upgrade/rollback. Defaults to false. |
bool |
| helm_release_max_history | Maximum number of release versions stored per release. Defaults to 0. |
number |
| helm_release_name | Helm release name. Defaults to local.addon.name (required). |
string |
| helm_render_subchart_notes | If set, render Helm subchart notes along with the parent. Defaults to true. |
bool |
| helm_replace | Re-use the given name of Helm release, only if that name is a deleted release which remains in the history. This is unsafe in production. Defaults to false. |
bool |
| helm_repo_ca_file | Helm repositories CA cert file. Defaults to "". |
string |
| helm_repo_cert_file | Helm repositories cert file. Defaults to "". |
string |
| helm_repo_key_file | Helm repositories cert key file. Defaults to "". |
string |
| helm_repo_password | Password for HTTP basic authentication against the Helm repository. Defaults to "". |
string |
| helm_repo_url | Helm repository. Defaults to local.addon.helm_repo_url (required). |
string |
| helm_repo_username | Username for HTTP basic authentication against the Helm repository. Defaults to "". |
string |
| helm_reset_values | When upgrading, reset the values to the ones built into the Helm chart. Defaults to false. |
bool |
| helm_reuse_values | When upgrading, reuse the last Helm release's values and merge in any overrides. If 'helm_reset_values' is specified, this is ignored. Defaults to false. |
bool |
| helm_set_sensitive | Value block with custom sensitive values to be merged with the values yaml that won't be exposed in the plan's diff. Defaults to {}. |
map(any) |
| helm_skip_crds | If set, no CRDs will be installed before Helm release. Defaults to false. |
bool |
| helm_timeout | Time in seconds to wait for any individual Kubernetes operation (like Jobs for hooks). Defaults to 300. |
number |
| helm_wait | Will wait until all Helm release resources are in a ready state before marking the release as successful. It will wait for as long as timeout. Defaults to false. |
bool |
| helm_wait_for_jobs | If wait is enabled, will wait until all Helm Jobs have been completed before marking the release as successful. It will wait for as long as timeout. Defaults to false. |
bool |
| namespace | The Kubernetes Namespace in which the Helm chart will be installed. Defaults to local.addon.name. |
string |
| oidc_additional_policies | Map of the additional policies to be attached to oidc role. Where key is arbitrary id and value is policy ARN. Defaults to {}. |
map(string) |
| oidc_assume_role_arns | List of ARNs assumable by the oidc role. Applied only if oidc_assume_role_enabled is true. |
list(string) |
| oidc_assume_role_enabled | Whether oidc is allowed to assume role defined by oidc_assume_role_arn. Mutually exclusive with oidc_policy_enabled. Defaults to false. |
bool |
| oidc_assume_role_policy_condition_test | Specifies the condition test to use for the assume role trust policy. Defaults to StringLike. |
string |
| oidc_assume_role_policy_condition_values | Specifies the values for the assume role trust policy condition. Defaults to []. |
list(string) |
| oidc_assume_role_policy_condition_variable | Specifies the variable to use for the assume role trust policy. Defaults to "". |
string |
| oidc_custom_provider_arn | Specifies a custom OIDC provider ARN. If provided, the module will not create a default OIDC provider. Defaults to "". |
string |
| oidc_openid_client_ids | List of client IDs that are allowed to authenticate. Defaults to []. |
list(string) |
| oidc_openid_provider_url | oidc provider url. Defaults to "". |
string |
| oidc_openid_thumbprints | List of thumbprints of the OIDC provider's server certificate. Defaults to []. |
list(string) |
| oidc_permissions_boundary | ARN of the policy that is used to set the permissions boundary for the oidc role. Defaults to "". |
string |
| oidc_policy | Policy to be attached to the oidc role. Applied only if oidc_policy_enabled is true. |
string |
| oidc_policy_enabled | Whether to create IAM policy specified by oidc_policy. Mutually exclusive with oidc_assume_role_enabled. Defaults to false. |
bool |
| oidc_role_create | Whether to create oidc role and annotate Service Account. Defaults to true. |
bool |
| oidc_role_name | oidc role name. The value is prefixed by var.oidc_role_name_prefix. Defaults to addon Helm chart name. |
string |
| oidc_role_name_prefix | oidc role name prefix. Defaults to addon oidc component name with oidc suffix. |
string |
| oidc_tags | oidc resources tags. Defaults to {}. |
map(string) |
| settings | Additional Helm sets which will be passed to the Helm chart values. Defaults to {}. |
map(any) |
| values | Additional yaml encoded values which will be passed to the Helm chart. Defaults to "". |
string |
| Name | Description |
|---|---|
| addon | The addon module outputs |
| addon_oidc | The addon oidc module outputs |
Feel free to create an issue in this repository if you have questions, suggestions or feature requests.
We want to provide high quality code and modules. For this reason we are using several pre-commit hooks and GitHub Actions workflows. A pull-request to the main branch will trigger these validations and lints automatically. Please check your code before you will create pull-requests. See pre-commit documentation and GitHub Actions documentation for further details.
See LICENSE for full details.
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
https://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.