Skip to content

Commit

Permalink
fix(iam): Fix IAM permissions (#5)
Browse files Browse the repository at this point in the history
* fix(iam): Fix IAM permissions

* ci: Satisfy pre-commit

* ci: Satisfy pre-commit

* ci: Satisfy pre-commit
  • Loading branch information
Balsir authored Apr 18, 2024
1 parent d959e24 commit a47f634
Show file tree
Hide file tree
Showing 20 changed files with 168 additions and 83 deletions.
18 changes: 16 additions & 2 deletions .github/RELEASE_DRAFTER.yml
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,25 @@ categories:
- 'enhancement'
- title: 'Bug Fixes'
labels:
- 'fix'
- 'bugfix'
- 'bug'
- title: 'Documentation'
label: 'documentation'
- title: 'CI'
label: 'ci'
version-resolver:
major:
labels:
- 'major'
minor:
labels:
- 'feature'
- 'enhancement'
patch:
labels:
- 'ci'
- 'bug'
- 'documentation'
default: patch
change-template: '- $TITLE, by @$AUTHOR (#$NUMBER)'
template: |
# What's changed
Expand Down
65 changes: 37 additions & 28 deletions .github/workflows/pre-commit.yml
Original file line number Diff line number Diff line change
@@ -1,5 +1,8 @@
name: pre-commit

permissions:
contents: read

on:
workflow_dispatch:
pull_request:
Expand All @@ -8,36 +11,42 @@ on:
- master

env:
PYTHON_VERSION: "3.10"
TERRAFORM_DOCS_VERSION: "v0.16.0"
TFLINT_VERSION: "v0.36.2"
TFLINT_VERSION: "v0.48.0"

jobs:
pre-commit:
runs-on: ubuntu-20.04
runs-on: ubuntu-22.04
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
steps:
- uses: actions/checkout@v2
- uses: actions/setup-python@v2

- name: Install additional pre-commit hooks
shell: bash
run: |
echo "########### Install Checkov ####################"
pip install checkov
echo "########### Install Terraform-docs #############"
wget https://github.com/terraform-docs/terraform-docs/releases/download/${{ env.TERRAFORM_DOCS_VERSION }}/terraform-docs-${{ env.TERRAFORM_DOCS_VERSION }}-linux-amd64.tar.gz
tar xvzf terraform-docs-${{ env.TERRAFORM_DOCS_VERSION }}-linux-amd64.tar.gz
mkdir -p ~/terraform-docs/bin/
install terraform-docs ~/terraform-docs/bin/
echo '~/terraform-docs/bin/' >> $GITHUB_PATH
echo "########### Install Terraform-linters ##########"
wget https://github.com/terraform-linters/tflint/releases/download/${{ env.TFLINT_VERSION }}/tflint_linux_amd64.zip
unzip tflint_linux_amd64.zip
mkdir -p ~/tflint/bin/
echo '~/tflint/bin/' >> $GITHUB_PATH
install tflint ~/tflint/bin/
~/tflint/bin/tflint --init
- name: Run pre-commit
uses: pre-commit/[email protected]
- uses: actions/checkout@v3
- uses: actions/setup-python@v4
with:
python-version: ${{ env.PYTHON_VERSION }}
cache: pip

- name: Install Python dependencies
run: pip install -r requirements.txt

- name: Install terraform-docs
uses: jaxxstorm/[email protected]
with:
repo: terraform-docs/terraform-docs
tag: ${{ env.TERRAFORM_DOCS_VERSION }}
cache: enable

- name: TFLint cache
uses: actions/cache@v3
with:
path: ~/.tflint.d/plugins
key: ${{ runner.os }}-tflint-${{ hashFiles('.tflint.hcl') }}

- name: Install TFLint
uses: terraform-linters/setup-tflint@v2
with:
tflint_version: ${{ env.TFLINT_VERSION }}

- name: Run pre-commit
uses: pre-commit/[email protected]
2 changes: 1 addition & 1 deletion .github/workflows/release-drafter.yml
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ on:

jobs:
update_release_draft:
runs-on: ubuntu-latest
runs-on: ubuntu-22.04
steps:
- uses: release-drafter/release-drafter@v5
with:
Expand Down
11 changes: 7 additions & 4 deletions .github/workflows/validate.yaml
Original file line number Diff line number Diff line change
@@ -1,5 +1,8 @@
name: Terraform validate

permissions:
contents: read

on:
workflow_dispatch:
pull_request:
Expand All @@ -10,11 +13,11 @@ on:
jobs:
versionExtract:
name: Extract min/max Terraform versions
runs-on: ubuntu-20.04
runs-on: ubuntu-22.04

steps:
- name: Checkout
uses: actions/checkout@v2
uses: actions/checkout@v3

- name: Extract Terraform min/max versions
id: minMax
Expand All @@ -26,7 +29,7 @@ jobs:
maxVersion: ${{ steps.minMax.outputs.maxVersion }}

terraform-validate:
runs-on: ubuntu-20.04
runs-on: ubuntu-22.04
needs: versionExtract
strategy:
matrix:
Expand All @@ -35,7 +38,7 @@ jobs:
- ${{ needs.versionExtract.outputs.maxVersion }}

steps:
- uses: actions/checkout@v2
- uses: actions/checkout@v3
- uses: hashicorp/setup-terraform@v2
with:
terraform_version: ${{ matrix.tf_ver }}
Expand Down
17 changes: 8 additions & 9 deletions .pre-commit-config.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
repos:
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v4.2.0
rev: v4.4.0
hooks:
- id: trailing-whitespace
- id: check-merge-conflict
Expand All @@ -10,23 +10,22 @@ repos:
- id: end-of-file-fixer

- repo: https://github.com/antonbabenko/pre-commit-terraform
rev: v1.71.0
rev: v1.83.1
hooks:
- id: terraform_fmt
- id: terraform_tflint
args:
- --args=--config=__GIT_WORKING_DIR__/.tflint.hcl
- id: terraform_validate
- id: terraform_checkov
args:
- '--args=--quiet --skip-check CKV_TF_1' #CKV_TF_1: "Ensure Terraform module sources use a commit hash"
- id: terraform_docs
args:
- '--args=--hide providers --sort-by required'

- repo: https://github.com/pecigonzalo/pre-commit-terraform-vars
rev: v1.0.0
hooks:
- id: terraform-vars
- '--args=--config=.terraform-docs.yml'

- repo: https://github.com/Yelp/detect-secrets
rev: v1.3.0
rev: v1.4.0
hooks:
- id: detect-secrets
args: ['--baseline', '.secrets.baseline']
Expand Down
2 changes: 1 addition & 1 deletion .secrets.baseline
Original file line number Diff line number Diff line change
Expand Up @@ -109,5 +109,5 @@
}
],
"results": {},
"generated_at": "2022-07-28T10:50:47Z"
"generated_at": "2022-10-10T14:52:48Z"
}
15 changes: 15 additions & 0 deletions .terraform-docs.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
formatter: markdown table

output:
mode: inject
template: |-
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
{{ .Content }}
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
sections:
hide:
- providers

sort:
by: required
12 changes: 12 additions & 0 deletions .tflint.hcl
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
plugin "terraform" {
enabled = true
version = "0.4.0"
source = "github.com/terraform-linters/tflint-ruleset-terraform"
preset = "recommended"
}

plugin "aws" {
enabled = true
version = "0.26.0"
source = "github.com/terraform-linters/tflint-ruleset-aws"
}
18 changes: 9 additions & 9 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,13 +1,13 @@
# AWS EKS EBS CSI driver Terraform module

[![labyrinth labs logo](ll-logo.png)](https://lablabs.io/)
[<img src="https://lablabs.io/static/ll-logo.png" width=350px>](https://lablabs.io/)

We help companies build, run, deploy and scale software and infrastructure by embracing the right technologies and principles. Check out our website at <https://lablabs.io/>

---

[![Terraform validate](https://github.com/lablabs/terraform-aws-eks-ebs-csi-driver/actions/workflows/validate.yaml/badge.svg)](https://github.com/lablabs/terraform-aws-eks-ebs-csi-driver/actions/workflows/validate.yaml)
[![pre-commit](https://github.com/lablabs/terraform-aws-ebs-csi-driver/actions/workflows/pre-commit.yml/badge.svg)](https://github.com/lablabs/terraform-aws-eks-ebs-csi-driver/actions/workflows/pre-commit.yml)
[![pre-commit](https://github.com/lablabs/terraform-aws-eks-ebs-csi-driver/actions/workflows/pre-commit.yml/badge.svg)](https://github.com/lablabs/terraform-aws-eks-ebs-csi-driver/actions/workflows/pre-commit.yml)

## Description

Expand Down Expand Up @@ -80,9 +80,9 @@ See [Basic example](examples/basic/README.md) for further information.
| Name | Version |
|------|---------|
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.19.0 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.35.0 |
| <a name="requirement_helm"></a> [helm](#requirement\_helm) | >= 2.6.0 |
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.11.0 |
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.20.0 |
| <a name="requirement_utils"></a> [utils](#requirement\_utils) | >= 0.17.0 |

## Modules
Expand Down Expand Up @@ -116,16 +116,16 @@ No modules.
| <a name="input_argo_enabled"></a> [argo\_enabled](#input\_argo\_enabled) | If set to true, the module will be deployed as ArgoCD application, otherwise it will be deployed as a Helm release | `bool` | `false` | no |
| <a name="input_argo_helm_enabled"></a> [argo\_helm\_enabled](#input\_argo\_helm\_enabled) | If set to true, the ArgoCD Application manifest will be deployed using Kubernetes provider as a Helm release. Otherwise it'll be deployed as a Kubernetes manifest. See Readme for more info | `bool` | `false` | no |
| <a name="input_argo_helm_values"></a> [argo\_helm\_values](#input\_argo\_helm\_values) | Value overrides to use when deploying argo application object with helm | `string` | `""` | no |
| <a name="input_argo_info"></a> [argo\_info](#input\_argo\_info) | ArgoCD info manifest parameter | `list` | <pre>[<br> {<br> "name": "terraform",<br> "value": "true"<br> }<br>]</pre> | no |
| <a name="input_argo_info"></a> [argo\_info](#input\_argo\_info) | ArgoCD info manifest parameter | <pre>list(object({<br> name = string<br> value = string<br> }))</pre> | <pre>[<br> {<br> "name": "terraform",<br> "value": "true"<br> }<br>]</pre> | no |
| <a name="input_argo_kubernetes_manifest_computed_fields"></a> [argo\_kubernetes\_manifest\_computed\_fields](#input\_argo\_kubernetes\_manifest\_computed\_fields) | List of paths of fields to be handled as "computed". The user-configured value for the field will be overridden by any different value returned by the API after apply. | `list(string)` | <pre>[<br> "metadata.labels",<br> "metadata.annotations"<br>]</pre> | no |
| <a name="input_argo_kubernetes_manifest_field_manager_force_conflicts"></a> [argo\_kubernetes\_manifest\_field\_manager\_force\_conflicts](#input\_argo\_kubernetes\_manifest\_field\_manager\_force\_conflicts) | Forcibly override any field manager conflicts when applying the kubernetes manifest resource | `bool` | `false` | no |
| <a name="input_argo_kubernetes_manifest_field_manager_name"></a> [argo\_kubernetes\_manifest\_field\_manager\_name](#input\_argo\_kubernetes\_manifest\_field\_manager\_name) | The name of the field manager to use when applying the kubernetes manifest resource. Defaults to Terraform | `string` | `"Terraform"` | no |
| <a name="input_argo_kubernetes_manifest_wait_fields"></a> [argo\_kubernetes\_manifest\_wait\_fields](#input\_argo\_kubernetes\_manifest\_wait\_fields) | A map of fields and a corresponding regular expression with a pattern to wait for. The provider will wait until the field matches the regular expression. Use * for any value. | `map(string)` | `{}` | no |
| <a name="input_argo_metadata"></a> [argo\_metadata](#input\_argo\_metadata) | ArgoCD Application metadata configuration. Override or create additional metadata parameters | `map` | <pre>{<br> "finalizers": [<br> "resources-finalizer.argocd.argoproj.io"<br> ]<br>}</pre> | no |
| <a name="input_argo_metadata"></a> [argo\_metadata](#input\_argo\_metadata) | ArgoCD Application metadata configuration. Override or create additional metadata parameters | `any` | <pre>{<br> "finalizers": [<br> "resources-finalizer.argocd.argoproj.io"<br> ]<br>}</pre> | no |
| <a name="input_argo_namespace"></a> [argo\_namespace](#input\_argo\_namespace) | Namespace to deploy ArgoCD application CRD to | `string` | `"argo"` | no |
| <a name="input_argo_project"></a> [argo\_project](#input\_argo\_project) | ArgoCD Application project | `string` | `"default"` | no |
| <a name="input_argo_spec"></a> [argo\_spec](#input\_argo\_spec) | ArgoCD Application spec configuration. Override or create additional spec parameters | `map` | `{}` | no |
| <a name="input_argo_sync_policy"></a> [argo\_sync\_policy](#input\_argo\_sync\_policy) | ArgoCD syncPolicy manifest parameter | `map` | `{}` | no |
| <a name="input_argo_spec"></a> [argo\_spec](#input\_argo\_spec) | ArgoCD Application spec configuration. Override or create additional spec parameters | `any` | `{}` | no |
| <a name="input_argo_sync_policy"></a> [argo\_sync\_policy](#input\_argo\_sync\_policy) | ArgoCD syncPolicy manifest parameter | `any` | `{}` | no |
| <a name="input_enabled"></a> [enabled](#input\_enabled) | Variable indicating whether deployment is enabled | `bool` | `true` | no |
| <a name="input_helm_atomic"></a> [helm\_atomic](#input\_helm\_atomic) | If set, installation process purges chart on fail. The wait flag will be set automatically if atomic is used | `bool` | `false` | no |
| <a name="input_helm_chart_name"></a> [helm\_chart\_name](#input\_helm\_chart\_name) | Helm chart name to be installed | `string` | `"aws-ebs-csi-driver"` | no |
Expand Down Expand Up @@ -169,7 +169,7 @@ No modules.
| <a name="input_service_account_create"></a> [service\_account\_create](#input\_service\_account\_create) | Whether to create Service Account | `bool` | `true` | no |
| <a name="input_service_account_name"></a> [service\_account\_name](#input\_service\_account\_name) | The k8s EBS CSI driver service account name | `string` | `"aws-ebs-csi-driver"` | no |
| <a name="input_settings"></a> [settings](#input\_settings) | Additional helm sets which will be passed to the Helm chart values, see https://github.com/kubernetes-sigs/aws-ebs-csi-driver/tree/master/charts/aws-ebs-csi-driver | `map(any)` | `{}` | no |
| <a name="input_storage_classes"></a> [storage\_classes](#input\_storage\_classes) | List of the custom Storage Classes definitions | `list` | <pre>[<br> {<br> "allowVolumeExpansion": true,<br> "annotations": {<br> "storageclass.kubernetes.io/is-default-class": "true"<br> },<br> "name": "ebs-csi-gp3",<br> "parameters": {<br> "encrypted": "true",<br> "type": "gp3"<br> },<br> "reclaimPolicy": "Delete",<br> "volumeBindingMode": "WaitForFirstConsumer"<br> }<br>]</pre> | no |
| <a name="input_storage_classes"></a> [storage\_classes](#input\_storage\_classes) | List of the custom Storage Classes definitions | `list(any)` | <pre>[<br> {<br> "allowVolumeExpansion": true,<br> "annotations": {<br> "storageclass.kubernetes.io/is-default-class": "true"<br> },<br> "name": "ebs-csi-gp3",<br> "parameters": {<br> "encrypted": "true",<br> "type": "gp3"<br> },<br> "reclaimPolicy": "Delete",<br> "volumeBindingMode": "WaitForFirstConsumer"<br> }<br>]</pre> | no |
| <a name="input_storage_classes_create"></a> [storage\_classes\_create](#input\_storage\_classes\_create) | Whether to create Storage Classes | `bool` | `true` | no |
| <a name="input_values"></a> [values](#input\_values) | Additional yaml encoded values which will be passed to the Helm chart, see https://github.com/kubernetes-sigs/aws-ebs-csi-driver/tree/master/charts/aws-ebs-csi-driver | `string` | `""` | no |

Expand Down
17 changes: 10 additions & 7 deletions argo.tf
Original file line number Diff line number Diff line change
Expand Up @@ -10,11 +10,15 @@ locals {
"repoURL" : var.helm_repo_url
"chart" : var.helm_chart_name
"targetRevision" : var.helm_chart_version
"helm" : {
"releaseName" : var.helm_release_name
"parameters" : [for k, v in var.settings : tomap({ "forceString" : true, "name" : k, "value" : v })]
"values" : var.enabled ? data.utils_deep_merge_yaml.values[0].output : ""
}
"helm" : merge(
{
"releaseName" : var.helm_release_name
"values" : var.enabled ? data.utils_deep_merge_yaml.values[0].output : ""
},
length(var.settings) > 0 ? {
"parameters" : [for k, v in var.settings : tomap({ "forceString" : true, "name" : k, "value" : v })]
} : {}
)
}
"destination" : {
"server" : var.argo_destination_server
Expand Down Expand Up @@ -43,7 +47,6 @@ data "utils_deep_merge_yaml" "argo_helm_values" {
])
}


resource "helm_release" "argo_application" {
count = var.enabled && var.argo_enabled && var.argo_helm_enabled ? 1 : 0

Expand All @@ -57,9 +60,9 @@ resource "helm_release" "argo_application" {
]
}


resource "kubernetes_manifest" "this" {
count = var.enabled && var.argo_enabled && !var.argo_helm_enabled ? 1 : 0

manifest = {
"apiVersion" = var.argo_apiversion
"kind" = "Application"
Expand Down
9 changes: 7 additions & 2 deletions examples/basic/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,12 @@ The code in this example shows how to use the module with basic configuration an
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
## Requirements

No requirements.
| Name | Version |
|------|---------|
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 |
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.35.0 |
| <a name="requirement_helm"></a> [helm](#requirement\_helm) | >= 2.6.0 |
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.20.0 |

## Modules

Expand All @@ -19,7 +24,7 @@ No requirements.
| <a name="module_ebs_without_irsa_role"></a> [ebs\_without\_irsa\_role](#module\_ebs\_without\_irsa\_role) | ../../ | n/a |
| <a name="module_eks_cluster"></a> [eks\_cluster](#module\_eks\_cluster) | cloudposse/eks-cluster/aws | 2.3.0 |
| <a name="module_eks_node_group"></a> [eks\_node\_group](#module\_eks\_node\_group) | cloudposse/eks-node-group/aws | 2.4.0 |
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | 3.14.2 |
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | 4.0.0 |

## Resources

Expand Down
4 changes: 2 additions & 2 deletions examples/basic/base.tf
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
module "vpc" {
source = "terraform-aws-modules/vpc/aws"
version = "3.14.2"
version = "4.0.0"

name = "cluster-autoscaler-vpc"
name = "aws-ebs-csi-driver-vpc"
cidr = "10.0.0.0/16"
azs = ["eu-central-1a", "eu-central-1b"]
public_subnets = ["10.0.101.0/24", "10.0.102.0/24"]
Expand Down
8 changes: 7 additions & 1 deletion examples/basic/providers.tf
Original file line number Diff line number Diff line change
Expand Up @@ -10,10 +10,16 @@ data "aws_eks_cluster_auth" "this" {
name = module.eks_cluster.eks_cluster_id
}

provider "kubernetes" {
host = data.aws_eks_cluster.this.endpoint
token = data.aws_eks_cluster_auth.this.token
cluster_ca_certificate = base64decode(data.aws_eks_cluster.this.certificate_authority[0].data)
}

provider "helm" {
kubernetes {
host = data.aws_eks_cluster.this.endpoint
token = data.aws_eks_cluster_auth.this.token
cluster_ca_certificate = base64decode(data.aws_eks_cluster.this.certificate_authority.0.data)
cluster_ca_certificate = base64decode(data.aws_eks_cluster.this.certificate_authority[0].data)
}
}
Loading

0 comments on commit a47f634

Please sign in to comment.