Skip to content

Commit

Permalink
feat: Replace the use of toset() with static keys for node IAM role…
Browse files Browse the repository at this point in the history
… policy attachment (#2962)
  • Loading branch information
bryantbiggs authored Mar 10, 2024
1 parent bed26ac commit 57f5130
Show file tree
Hide file tree
Showing 6 changed files with 80 additions and 15 deletions.
11 changes: 6 additions & 5 deletions modules/eks-managed-node-group/main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -504,11 +504,12 @@ resource "aws_iam_role" "this" {

# Policies attached ref https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_node_group
resource "aws_iam_role_policy_attachment" "this" {
for_each = { for k, v in toset(compact([
"${local.iam_role_policy_prefix}/AmazonEKSWorkerNodePolicy",
"${local.iam_role_policy_prefix}/AmazonEC2ContainerRegistryReadOnly",
var.iam_role_attach_cni_policy ? local.cni_policy : "",
])) : k => v if var.create && var.create_iam_role }
for_each = { for k, v in {
AmazonEKSWorkerNodePolicy = "${local.iam_role_policy_prefix}/AmazonEKSWorkerNodePolicy"
AmazonEC2ContainerRegistryReadOnly = "${local.iam_role_policy_prefix}/AmazonEC2ContainerRegistryReadOnly"
AmazonEKS_CNI_IPv6_Policy = var.iam_role_attach_cni_policy && var.cluster_ip_family == "ipv6" ? local.cni_policy : ""
AmazonEKS_CNI_Policy = var.iam_role_attach_cni_policy && var.cluster_ip_family == "ipv4" ? local.cni_policy : ""
} : k => v if var.create && var.create_iam_role && v != "" }

policy_arn = each.value
role = aws_iam_role.this[0].name
Expand Down
20 changes: 20 additions & 0 deletions modules/eks-managed-node-group/migrations.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
################################################################################
# Migrations: v20.7 -> v20.8
################################################################################

# Node IAM role policy attachment
# Commercial partition only - `moved` does now allow multiple moves to same target
moved {
from = aws_iam_role_policy_attachment.this["arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"]
to = aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"]
}

moved {
from = aws_iam_role_policy_attachment.this["arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"]
to = aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"]
}

moved {
from = aws_iam_role_policy_attachment.this["arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"]
to = aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"]
}
11 changes: 6 additions & 5 deletions modules/karpenter/main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -565,11 +565,12 @@ resource "aws_iam_role" "node" {

# Policies attached ref https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_node_group
resource "aws_iam_role_policy_attachment" "node" {
for_each = { for k, v in toset(compact([
"${local.node_iam_role_policy_prefix}/AmazonEKSWorkerNodePolicy",
"${local.node_iam_role_policy_prefix}/AmazonEC2ContainerRegistryReadOnly",
var.node_iam_role_attach_cni_policy ? local.cni_policy : "",
])) : k => v if local.create_node_iam_role }
for_each = { for k, v in {
AmazonEKSWorkerNodePolicy = "${local.node_iam_role_policy_prefix}/AmazonEKSWorkerNodePolicy"
AmazonEC2ContainerRegistryReadOnly = "${local.node_iam_role_policy_prefix}/AmazonEC2ContainerRegistryReadOnly"
AmazonEKS_CNI_IPv6_Policy = var.node_iam_role_attach_cni_policy && var.cluster_ip_family == "ipv6" ? local.cni_policy : ""
AmazonEKS_CNI_Policy = var.node_iam_role_attach_cni_policy && var.cluster_ip_family == "ipv4" ? local.cni_policy : ""
} : k => v if var.create && var.create_iam_role && v != "" }

policy_arn = each.value
role = aws_iam_role.node[0].name
Expand Down
21 changes: 21 additions & 0 deletions modules/karpenter/migrations.tf
Original file line number Diff line number Diff line change
Expand Up @@ -54,3 +54,24 @@ moved {
from = aws_cloudwatch_event_rule.this["spot_interupt"]
to = aws_cloudwatch_event_rule.this["spot_interrupt"]
}

################################################################################
# Migrations: v20.7 -> v20.8
################################################################################

# Node IAM role policy attachment
# Commercial partition only - `moved` does now allow multiple moves to same target
moved {
from = aws_iam_role_policy_attachment.node["arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"]
to = aws_iam_role_policy_attachment.node["AmazonEKSWorkerNodePolicy"]
}

moved {
from = aws_iam_role_policy_attachment.node["arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"]
to = aws_iam_role_policy_attachment.node["AmazonEC2ContainerRegistryReadOnly"]
}

moved {
from = aws_iam_role_policy_attachment.node["arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"]
to = aws_iam_role_policy_attachment.node["AmazonEKS_CNI_Policy"]
}
12 changes: 7 additions & 5 deletions modules/self-managed-node-group/main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -768,12 +768,14 @@ resource "aws_iam_role" "this" {
tags = merge(var.tags, var.iam_role_tags)
}

# Policies attached ref https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_node_group
resource "aws_iam_role_policy_attachment" "this" {
for_each = { for k, v in toset(compact([
"${local.iam_role_policy_prefix}/AmazonEKSWorkerNodePolicy",
"${local.iam_role_policy_prefix}/AmazonEC2ContainerRegistryReadOnly",
var.iam_role_attach_cni_policy ? local.cni_policy : "",
])) : k => v if var.create && var.create_iam_instance_profile }
for_each = { for k, v in {
AmazonEKSWorkerNodePolicy = "${local.iam_role_policy_prefix}/AmazonEKSWorkerNodePolicy"
AmazonEC2ContainerRegistryReadOnly = "${local.iam_role_policy_prefix}/AmazonEC2ContainerRegistryReadOnly"
AmazonEKS_CNI_IPv6_Policy = var.iam_role_attach_cni_policy && var.cluster_ip_family == "ipv6" ? local.cni_policy : ""
AmazonEKS_CNI_Policy = var.iam_role_attach_cni_policy && var.cluster_ip_family == "ipv4" ? local.cni_policy : ""
} : k => v if var.create && var.create_iam_instance_profile && v != "" }

policy_arn = each.value
role = aws_iam_role.this[0].name
Expand Down
20 changes: 20 additions & 0 deletions modules/self-managed-node-group/migrations.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
################################################################################
# Migrations: v20.7 -> v20.8
################################################################################

# Node IAM role policy attachment
# Commercial partition only - `moved` does now allow multiple moves to same target
moved {
from = aws_iam_role_policy_attachment.this["arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy"]
to = aws_iam_role_policy_attachment.this["AmazonEKSWorkerNodePolicy"]
}

moved {
from = aws_iam_role_policy_attachment.this["arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly"]
to = aws_iam_role_policy_attachment.this["AmazonEC2ContainerRegistryReadOnly"]
}

moved {
from = aws_iam_role_policy_attachment.this["arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy"]
to = aws_iam_role_policy_attachment.this["AmazonEKS_CNI_Policy"]
}

0 comments on commit 57f5130

Please sign in to comment.