├── .devcontainer ├── .aliases ├── Dockerfile └── devcontainer.json ├── .github ├── ISSUE_TEMPLATE │ ├── bug_report.md │ └── feature_request.md ├── PULL_REQUEST_TEMPLATE.md └── workflows │ └── pre-commit.yaml ├── .gitignore ├── .pre-commit-config.yaml ├── .terraform-docs.yml ├── .terraform-version ├── LICENSE ├── Makefile ├── README.md ├── examples ├── basic │ ├── .terraform-docs.yml │ ├── README.md │ ├── data.tf │ ├── main.tf │ ├── outputs.tf │ ├── providers.tf │ ├── variables.tf │ ├── versions.tf │ └── vpc.tf └── complete │ ├── .terraform-docs.yml │ ├── README.md │ ├── complete.tf.docs │ ├── data.tf │ ├── main.tf │ ├── outputs.tf │ ├── providers.tf │ ├── variables.tf │ ├── versions.tf │ └── vpc.tf ├── main.tf ├── outputs.tf ├── templates └── aws_auth_cm.tpl ├── test ├── terraform_basic_test.go ├── terraform_basic_test.log ├── terraform_complete_test.go └── terraform_complete_test.log ├── variables.tf └── versions.tf /.devcontainer/.aliases: -------------------------------------------------------------------------------- 1 | # TERRAFORM 2 | alias tf='terraform' 3 | alias tfv='terrform validate' 4 | alias tfi='terraform init' 5 | alias tfifc='terraform init -force-copy' 6 | alias tfp='terraform plan' 7 | alias tfa='terraform apply' 8 | alias tfaa='terraform apply -auto-approve' 9 | alias tfs='terraform show' 10 | alias tfd='terraform destroy' 11 | alias tfda='terraform destroy -auto-approve' 12 | alias tfc='terraform console' 13 | alias tfo='terraform output' 14 | 15 | # KUBERNETES 16 | alias k='kubectl' 17 | alias kaf='kubectl apply -f' 18 | alias kdelf='kubectl delete -f' 19 | 20 | # GIT 21 | alias gi='git init' 22 | alias gs='git status' 23 | alias ga='git add -A' 24 | alias gr='git rm' 25 | alias gb='git branch' 26 | alias gc='git commit -m' 27 | alias gp='git push' 28 | alias gpom='git push origin main' 29 | alias gpl='git pull' 30 | alias gplom='git pull origin main' 31 | alias gd='git diff' 32 | alias gl='git log' 33 | alias gt='git tag' 34 | alias gta='git tag -a' 35 | alias gpt='git push --tag' 36 | alias gco='git checkout' 37 | alias ge='git commit --allow-empty -m "This is an empty commit. Likely to trigger a CI/CD pipeline that is stalled."' 38 | alias gpb='git push --set-upstream origin $(git_current_branch)' 39 | -------------------------------------------------------------------------------- /.devcontainer/Dockerfile: -------------------------------------------------------------------------------- 1 | FROM ubuntu:20.04 2 | 3 | ARG GO_VERSION="1.17.6" \ 4 | TERRAFORM_VERSION="latest" \ 5 | TERRAFORM_DOCS_VERSION="v0.16.0" \ 6 | TFLINT_VERSION="v0.34.1" \ 7 | TERRATEST_VERSION="v0.13.13" \ 8 | KUBERNETES_VERSION="1.21.2" 9 | 10 | ENV GOROOT=/usr/local/go \ 11 | GOPATH=/go \ 12 | PATH=/root/.tfenv/bin:${GOPATH}/bin:${GOROOT}/bin:${PATH} \ 13 | LANGUAGE="C" \ 14 | LC_ALL="C" 15 | 16 | # Common 17 | RUN apt-get update && apt-get install -y curl unzip git python3-pip 18 | 19 | # Golang 20 | RUN curl -sSL -o /tmp/go.tar.gz "https://golang.org/dl/go${GO_VERSION}.linux-amd64.tar.gz" \ 21 | && tar -xzf /tmp/go.tar.gz -C /usr/local \ 22 | && ${GOROOT}/bin/go install -v golang.org/x/tools/gopls@latest 23 | 24 | # Terraform 25 | RUN git clone https://github.com/tfutils/tfenv.git /root/.tfenv \ 26 | && tfenv install ${TERRAFORM_VERSION} \ 27 | && tfenv use $(ls /root/.tfenv/versions) 28 | 29 | # Terraform-Docs 30 | RUN curl -sSLo ./terraform-docs.tar.gz https://github.com/terraform-docs/terraform-docs/releases/download/${TERRAFORM_DOCS_VERSION}/terraform-docs-${TERRAFORM_DOCS_VERSION}-$(uname)-amd64.tar.gz \ 31 | && tar -xzf terraform-docs.tar.gz -C /usr/bin/ terraform-docs \ 32 | && rm terraform-docs.tar.gz 2> /dev/null 33 | 34 | # Tflint 35 | RUN curl -sSL "$(curl -s https://api.github.com/repos/terraform-linters/tflint/releases/latest | grep -o -E "https://.+?_linux_amd64.zip")" > tflint.zip \ 36 | && unzip -qq tflint.zip tflint -d /usr/bin/ \ 37 | && rm tflint.zip 2> /dev/null 38 | 39 | # Terratest 40 | RUN curl -sSL -o /usr/local/bin/terratest_log_parser "https://github.com/gruntwork-io/terratest/releases/download/${TERRATEST_VERSION}/terratest_log_parser_linux_amd64" \ 41 | && chmod +x /usr/local/bin/terratest_log_parser 42 | 43 | # Pre-Commit 44 | RUN pip3 install -q --no-cache-dir pre-commit 45 | 46 | # AWSCLI 47 | RUN curl -sSL -o /tmp/awscliv2.zip "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" \ 48 | && unzip /tmp/awscliv2.zip -d /tmp \ 49 | && ./tmp/aws/install 50 | 51 | # Kubectl 52 | RUN curl -sSL -o /usr/bin/kubectl https://amazon-eks.s3.us-west-2.amazonaws.com/${KUBERNETES_VERSION}/2021-07-05/bin/linux/amd64/kubectl \ 53 | && chmod +x /usr/bin/kubectl \ 54 | && curl -sS https://webinstall.dev/k9s | bash 55 | 56 | # Dotfiles 57 | COPY .aliases /root/.aliases 58 | RUN echo "source /root/.aliases" >> /root/.bashrc 59 | 60 | # Clean 61 | RUN rm -rf /tmp/* && rm -rf /var/lib/apt/lists/* 62 | -------------------------------------------------------------------------------- /.devcontainer/devcontainer.json: -------------------------------------------------------------------------------- 1 | { 2 | "build": { "dockerfile": "Dockerfile" }, 3 | "extensions": [ 4 | "hashicorp.terraform", 5 | "golang.Go" 6 | ], 7 | "mounts": [ 8 | "source=${localEnv:HOME}/.aws,target=/root/.aws,type=bind", 9 | "source=${localEnv:HOME}/.kube,target=/root/.kube,type=bind", 10 | "source=${localEnv:HOME}/.cache/pre-commit,target=/root/.cache/pre-commit,type=bind", 11 | "source=${localEnv:HOME}/.terraform.d/plugins,target=/root/.terraform.d/plugins,type=bind", 12 | ] 13 | } 14 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/bug_report.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Bug report 3 | about: Create a report to help us improve 4 | title: '' 5 | labels: bug 6 | assignees: '' 7 | 8 | --- 9 | 10 | **Describe the Bug** 11 | 12 | 13 | 14 | **Expected Behavior** 15 | 16 | 17 | 18 | **Actual Behavior** 19 | 20 | 21 | 22 | **Steps to Reproduce the Problem** 23 | 1. 24 | 2. 25 | 3. 26 | -------------------------------------------------------------------------------- /.github/ISSUE_TEMPLATE/feature_request.md: -------------------------------------------------------------------------------- 1 | --- 2 | name: Feature request 3 | about: Suggest an idea for this project 4 | title: '' 5 | labels: enhancement 6 | assignees: '' 7 | 8 | --- 9 | 10 | **Is your feature request related to a problem? Please describe.** 11 | 12 | 13 | 14 | **Describe the solution you'd like** 15 | 16 | 17 | 18 | **Describe alternatives you've considered** 19 | 20 | 21 | 22 | **Additional context** 23 | 24 | 25 | -------------------------------------------------------------------------------- /.github/PULL_REQUEST_TEMPLATE.md: -------------------------------------------------------------------------------- 1 | # Fixes 2 | 3 | ## Proposed Changes 4 | - 5 | -------------------------------------------------------------------------------- /.github/workflows/pre-commit.yaml: -------------------------------------------------------------------------------- 1 | name: Pre-Commit 2 | 3 | on: 4 | pull_request: 5 | branches: 6 | - main 7 | - master 8 | push: 9 | branches: 10 | - main 11 | - master 12 | workflow_dispatch: 13 | 14 | env: 15 | TERRAFORM_DOCS_VERSION: v0.16.0 16 | 17 | jobs: 18 | collectInputs: 19 | name: Collect workflow inputs 20 | runs-on: ubuntu-latest 21 | outputs: 22 | directories: ${{ steps.dirs.outputs.directories }} 23 | steps: 24 | - name: Checkout 25 | uses: actions/checkout@v2 26 | 27 | - name: Get root directories 28 | id: dirs 29 | uses: clowdhaus/terraform-composite-actions/directories@v1.3.0 30 | 31 | preCommitMinVersions: 32 | name: Min TF pre-commit 33 | needs: collectInputs 34 | runs-on: ubuntu-20.04 35 | strategy: 36 | matrix: 37 | directory: ${{ fromJson(needs.collectInputs.outputs.directories) }} 38 | steps: 39 | - name: Checkout 40 | uses: actions/checkout@v2 41 | 42 | # - name: Install tflint AWS Rules 43 | # run: tflint --init 44 | 45 | - name: Terraform min/max versions 46 | id: minMax 47 | uses: clowdhaus/terraform-min-max@v1.0.3 48 | with: 49 | directory: ${{ matrix.directory }} 50 | 51 | - name: Pre-commit Terraform ${{ steps.minMax.outputs.minVersion }} 52 | # Run only validate pre-commit check on min version supported 53 | if: ${{ matrix.directory != '.' }} 54 | uses: clowdhaus/terraform-composite-actions/pre-commit@v1.3.0 55 | with: 56 | terraform-version: ${{ steps.minMax.outputs.minVersion }} 57 | args: 'terraform_validate --color=always --show-diff-on-failure --files ${{ matrix.directory }}/*' 58 | 59 | - name: Pre-commit Terraform ${{ steps.minMax.outputs.minVersion }} 60 | # Run only validate pre-commit check on min version supported 61 | if: ${{ matrix.directory == '.' }} 62 | uses: clowdhaus/terraform-composite-actions/pre-commit@v1.3.0 63 | with: 64 | terraform-version: ${{ steps.minMax.outputs.minVersion }} 65 | args: 'terraform_validate --color=always --show-diff-on-failure --files $(ls *.tf)' 66 | 67 | preCommitMaxVersion: 68 | name: Max TF pre-commit 69 | runs-on: ubuntu-latest 70 | needs: collectInputs 71 | steps: 72 | - name: Checkout 73 | uses: actions/checkout@v2 74 | with: 75 | ref: ${{ github.event.pull_request.head.ref }} 76 | repository: ${{github.event.pull_request.head.repo.full_name}} 77 | 78 | - name: Terraform min/max versions 79 | id: minMax 80 | uses: clowdhaus/terraform-min-max@v1.0.3 81 | 82 | - name: Pre-commit Terraform ${{ steps.minMax.outputs.maxVersion }} 83 | uses: clowdhaus/terraform-composite-actions/pre-commit@v1.3.0 84 | with: 85 | terraform-version: ${{ steps.minMax.outputs.maxVersion }} 86 | terraform-docs-version: ${{ env.TERRAFORM_DOCS_VERSION }} 87 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | eks-admin-cluster-role-binding.yaml 2 | eks-admin-service-account.yaml 3 | config-map-aws-auth*.yaml 4 | kubeconfig_* 5 | .idea 6 | 7 | ################################################################# 8 | # Default .gitignore content for all terraform-aws-modules below 9 | ################################################################# 10 | 11 | .DS_Store 12 | 13 | # Local .terraform directories 14 | **/.terraform/* 15 | .terraform 16 | 17 | # Terraform lockfile 18 | *.terraform.lock.hcl 19 | # !examples/basic/.terraform.lock.hcl 20 | # !examples/complete/.terraform.lock.hcl 21 | # !examples/patch/.terraform.lock.hcl 22 | 23 | # .tfstate files 24 | *.tfstate 25 | *.tfstate.* 26 | *.tfplan 27 | 28 | # Crash log files 29 | crash.log 30 | 31 | # Exclude all .tfvars files, which are likely to contain sentitive data, such as 32 | # password, private keys, and other secrets. These should not be part of version 33 | # control as they are data points which are potentially sensitive and subject 34 | # to change depending on the environment. 35 | *.tfvars 36 | 37 | # Ignore override files as they are usually used to override resources locally and so 38 | # are not checked in 39 | override.tf 40 | override.tf.json 41 | *_override.tf 42 | *_override.tf.json 43 | 44 | # Ignore CLI configuration files 45 | .terraformrc 46 | terraform.rc 47 | 48 | # Terratest 49 | go.mod 50 | go.sum 51 | examples/scratch 52 | test/terraform_scratch_test.go 53 | -------------------------------------------------------------------------------- /.pre-commit-config.yaml: -------------------------------------------------------------------------------- 1 | repos: 2 | - repo: https://github.com/antonbabenko/pre-commit-terraform 3 | rev: v1.64.0 4 | hooks: 5 | - id: terraform_fmt 6 | - id: terraform_validate 7 | - id: terraform_docs 8 | args: 9 | - '--args=--lockfile=false' 10 | - id: terraform_tflint 11 | args: 12 | - '--args=--only=terraform_deprecated_interpolation' 13 | - '--args=--only=terraform_deprecated_index' 14 | - '--args=--only=terraform_unused_declarations' 15 | - '--args=--only=terraform_comment_syntax' 16 | - '--args=--only=terraform_documented_outputs' 17 | - '--args=--only=terraform_documented_variables' 18 | - '--args=--only=terraform_typed_variables' 19 | - '--args=--only=terraform_module_pinned_source' 20 | - '--args=--only=terraform_naming_convention' 21 | - '--args=--only=terraform_required_version' 22 | - '--args=--only=terraform_required_providers' 23 | - '--args=--only=terraform_standard_module_structure' 24 | - '--args=--only=terraform_workspace_remote' 25 | - repo: https://github.com/pre-commit/pre-commit-hooks 26 | rev: v4.1.0 27 | hooks: 28 | - id: end-of-file-fixer 29 | - id: trailing-whitespace 30 | - id: check-merge-conflict 31 | - id: detect-aws-credentials 32 | args: [--allow-missing-credentials] 33 | -------------------------------------------------------------------------------- /.terraform-docs.yml: -------------------------------------------------------------------------------- 1 | content: |- 2 | {{ .Header }} 3 | 4 | ## Usage 5 | 6 | Grant access to the AWS EKS cluster by adding `map_roles`, `map_user` or `map_accounts` to the `aws-auth` configmap. 7 | 8 | ```hcl 9 | {{ include "examples/complete/complete.tf.docs" }} 10 | ``` 11 | 12 | Please see the [complete example](examples/complete) for more information. 13 | 14 | {{ .Requirements }} 15 | 16 | {{ .Providers }} 17 | 18 | {{ .Modules }} 19 | 20 | {{ .Resources }} 21 | 22 | {{ .Inputs }} 23 | 24 | {{ .Outputs }} 25 | -------------------------------------------------------------------------------- /.terraform-version: -------------------------------------------------------------------------------- 1 | 1.1.7 2 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Apache License 2 | Version 2.0, January 2004 3 | http://www.apache.org/licenses/ 4 | 5 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 6 | 7 | 1. Definitions. 8 | 9 | "License" shall mean the terms and conditions for use, reproduction, 10 | and distribution as defined by Sections 1 through 9 of this document. 11 | 12 | "Licensor" shall mean the copyright owner or entity authorized by 13 | the copyright owner that is granting the License. 14 | 15 | "Legal Entity" shall mean the union of the acting entity and all 16 | other entities that control, are controlled by, or are under common 17 | control with that entity. For the purposes of this definition, 18 | "control" means (i) the power, direct or indirect, to cause the 19 | direction or management of such entity, whether by contract or 20 | otherwise, or (ii) ownership of fifty percent (50%) or more of the 21 | outstanding shares, or (iii) beneficial ownership of such entity. 22 | 23 | "You" (or "Your") shall mean an individual or Legal Entity 24 | exercising permissions granted by this License. 25 | 26 | "Source" form shall mean the preferred form for making modifications, 27 | including but not limited to software source code, documentation 28 | source, and configuration files. 29 | 30 | "Object" form shall mean any form resulting from mechanical 31 | transformation or translation of a Source form, including but 32 | not limited to compiled object code, generated documentation, 33 | and conversions to other media types. 34 | 35 | "Work" shall mean the work of authorship, whether in Source or 36 | Object form, made available under the License, as indicated by a 37 | copyright notice that is included in or attached to the work 38 | (an example is provided in the Appendix below). 39 | 40 | "Derivative Works" shall mean any work, whether in Source or Object 41 | form, that is based on (or derived from) the Work and for which the 42 | editorial revisions, annotations, elaborations, or other modifications 43 | represent, as a whole, an original work of authorship. For the purposes 44 | of this License, Derivative Works shall not include works that remain 45 | separable from, or merely link (or bind by name) to the interfaces of, 46 | the Work and Derivative Works thereof. 47 | 48 | "Contribution" shall mean any work of authorship, including 49 | the original version of the Work and any modifications or additions 50 | to that Work or Derivative Works thereof, that is intentionally 51 | submitted to Licensor for inclusion in the Work by the copyright owner 52 | or by an individual or Legal Entity authorized to submit on behalf of 53 | the copyright owner. For the purposes of this definition, "submitted" 54 | means any form of electronic, verbal, or written communication sent 55 | to the Licensor or its representatives, including but not limited to 56 | communication on electronic mailing lists, source code control systems, 57 | and issue tracking systems that are managed by, or on behalf of, the 58 | Licensor for the purpose of discussing and improving the Work, but 59 | excluding communication that is conspicuously marked or otherwise 60 | designated in writing by the copyright owner as "Not a Contribution." 61 | 62 | "Contributor" shall mean Licensor and any individual or Legal Entity 63 | on behalf of whom a Contribution has been received by Licensor and 64 | subsequently incorporated within the Work. 65 | 66 | 2. Grant of Copyright License. Subject to the terms and conditions of 67 | this License, each Contributor hereby grants to You a perpetual, 68 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 69 | copyright license to reproduce, prepare Derivative Works of, 70 | publicly display, publicly perform, sublicense, and distribute the 71 | Work and such Derivative Works in Source or Object form. 72 | 73 | 3. Grant of Patent License. Subject to the terms and conditions of 74 | this License, each Contributor hereby grants to You a perpetual, 75 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 76 | (except as stated in this section) patent license to make, have made, 77 | use, offer to sell, sell, import, and otherwise transfer the Work, 78 | where such license applies only to those patent claims licensable 79 | by such Contributor that are necessarily infringed by their 80 | Contribution(s) alone or by combination of their Contribution(s) 81 | with the Work to which such Contribution(s) was submitted. If You 82 | institute patent litigation against any entity (including a 83 | cross-claim or counterclaim in a lawsuit) alleging that the Work 84 | or a Contribution incorporated within the Work constitutes direct 85 | or contributory patent infringement, then any patent licenses 86 | granted to You under this License for that Work shall terminate 87 | as of the date such litigation is filed. 88 | 89 | 4. Redistribution. You may reproduce and distribute copies of the 90 | Work or Derivative Works thereof in any medium, with or without 91 | modifications, and in Source or Object form, provided that You 92 | meet the following conditions: 93 | 94 | (a) You must give any other recipients of the Work or 95 | Derivative Works a copy of this License; and 96 | 97 | (b) You must cause any modified files to carry prominent notices 98 | stating that You changed the files; and 99 | 100 | (c) You must retain, in the Source form of any Derivative Works 101 | that You distribute, all copyright, patent, trademark, and 102 | attribution notices from the Source form of the Work, 103 | excluding those notices that do not pertain to any part of 104 | the Derivative Works; and 105 | 106 | (d) If the Work includes a "NOTICE" text file as part of its 107 | distribution, then any Derivative Works that You distribute must 108 | include a readable copy of the attribution notices contained 109 | within such NOTICE file, excluding those notices that do not 110 | pertain to any part of the Derivative Works, in at least one 111 | of the following places: within a NOTICE text file distributed 112 | as part of the Derivative Works; within the Source form or 113 | documentation, if provided along with the Derivative Works; or, 114 | within a display generated by the Derivative Works, if and 115 | wherever such third-party notices normally appear. The contents 116 | of the NOTICE file are for informational purposes only and 117 | do not modify the License. You may add Your own attribution 118 | notices within Derivative Works that You distribute, alongside 119 | or as an addendum to the NOTICE text from the Work, provided 120 | that such additional attribution notices cannot be construed 121 | as modifying the License. 122 | 123 | You may add Your own copyright statement to Your modifications and 124 | may provide additional or different license terms and conditions 125 | for use, reproduction, or distribution of Your modifications, or 126 | for any such Derivative Works as a whole, provided Your use, 127 | reproduction, and distribution of the Work otherwise complies with 128 | the conditions stated in this License. 129 | 130 | 5. Submission of Contributions. Unless You explicitly state otherwise, 131 | any Contribution intentionally submitted for inclusion in the Work 132 | by You to the Licensor shall be under the terms and conditions of 133 | this License, without any additional terms or conditions. 134 | Notwithstanding the above, nothing herein shall supersede or modify 135 | the terms of any separate license agreement you may have executed 136 | with Licensor regarding such Contributions. 137 | 138 | 6. Trademarks. This License does not grant permission to use the trade 139 | names, trademarks, service marks, or product names of the Licensor, 140 | except as required for reasonable and customary use in describing the 141 | origin of the Work and reproducing the content of the NOTICE file. 142 | 143 | 7. Disclaimer of Warranty. Unless required by applicable law or 144 | agreed to in writing, Licensor provides the Work (and each 145 | Contributor provides its Contributions) on an "AS IS" BASIS, 146 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or 147 | implied, including, without limitation, any warranties or conditions 148 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A 149 | PARTICULAR PURPOSE. You are solely responsible for determining the 150 | appropriateness of using or redistributing the Work and assume any 151 | risks associated with Your exercise of permissions under this License. 152 | 153 | 8. Limitation of Liability. In no event and under no legal theory, 154 | whether in tort (including negligence), contract, or otherwise, 155 | unless required by applicable law (such as deliberate and grossly 156 | negligent acts) or agreed to in writing, shall any Contributor be 157 | liable to You for damages, including any direct, indirect, special, 158 | incidental, or consequential damages of any character arising as a 159 | result of this License or out of the use or inability to use the 160 | Work (including but not limited to damages for loss of goodwill, 161 | work stoppage, computer failure or malfunction, or any and all 162 | other commercial damages or losses), even if such Contributor 163 | has been advised of the possibility of such damages. 164 | 165 | 9. Accepting Warranty or Additional Liability. While redistributing 166 | the Work or Derivative Works thereof, You may choose to offer, 167 | and charge a fee for, acceptance of support, warranty, indemnity, 168 | or other liability obligations and/or rights consistent with this 169 | License. However, in accepting such obligations, You may act only 170 | on Your own behalf and on Your sole responsibility, not on behalf 171 | of any other Contributor, and only if You agree to indemnify, 172 | defend, and hold each Contributor harmless for any liability 173 | incurred by, or claims asserted against, such Contributor by reason 174 | of your accepting any such warranty or additional liability. 175 | 176 | END OF TERMS AND CONDITIONS 177 | -------------------------------------------------------------------------------- /Makefile: -------------------------------------------------------------------------------- 1 | NAME = terraform-aws-eks-auth 2 | 3 | SHELL := /bin/bash 4 | 5 | .PHONY: help all 6 | 7 | help: ## This help. 8 | @awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {printf "\033[36m%-20s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST) 9 | 10 | .DEFAULT_GOAL := help 11 | 12 | build: ## Build docker dev container 13 | cd .devcontainer && docker build -f Dockerfile . -t $(NAME) 14 | 15 | run: ## Run docker dev container 16 | docker run -it --rm -v "$$(pwd)":/workspaces/$(NAME) -v ~/.aws:/root/.aws -v ~/.kube:/root/.kube -v ~/.cache/pre-commit:/root/.cache/pre-commit -v ~/.terraform.d/plugins:/root/.terraform.d/plugins --workdir /workspaces/$(NAME) $(NAME) /bin/bash 17 | 18 | install: ## Install project 19 | # terraform 20 | terraform init 21 | cd examples/basic && terraform init 22 | cd examples/complete && terraform init 23 | 24 | # terratest 25 | go get github.com/gruntwork-io/terratest/modules/terraform 26 | go mod init test/terraform_basic_test.go 27 | 28 | # pre-commit 29 | git init 30 | git add -A 31 | pre-commit install 32 | 33 | lint: ## Lint with pre-commit 34 | git add -A 35 | pre-commit run 36 | git add -A 37 | 38 | tests: test-basic test-complete ## Test with Terratest 39 | 40 | test-basic: ## Test Basic Example 41 | go test test/terraform_basic_test.go -timeout 45m -v |& tee test/terraform_basic_test.log 42 | 43 | test-complete: ## Test Complete Example 44 | go test test/terraform_complete_test.go -timeout 45m -v |& tee test/terraform_complete_test.log 45 | 46 | clean: ## Clean project 47 | @rm -f .terraform.lock.hcl 48 | @rm -f examples/basic/.terraform.lock.hcl 49 | @rm -f examples/complete/.terraform.lock.hcl 50 | 51 | @rm -rf .terraform 52 | @rm -rf examples/basic/.terraform 53 | @rm -rf examples/complete/.terraform 54 | 55 | @rm -f go.mod 56 | @rm -f go.sum 57 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Archive Notice 2 | 3 | The [`terraform-aws-modules/eks/aws` v.18.20.0 release](https://github.com/terraform-aws-modules/terraform-aws-eks/releases/tag/v18.20.0) has brought back support `aws-auth` configmap! For this reason, I highly encourage users to manage the `aws-auth` configmap with the EKS module. 4 | 5 | You are welcome to open an issue here if you are having trouble with the migration steps below and will do my best to help. 6 | 7 | 8 | # Migration: 9 | 10 | ## steps 11 | 12 | 1. Remove the `aidanmelen/eks-auth/aws` declaration for your terraform code. 13 | 2. Remove the `aidanmelen/eks-auth/aws` resources from terraform state. 14 | - The `aws-auth` configmap should still exist on the cluster but will no longer be managed by this module. 15 | - A plan should show that there are no infrastructure changes to the EKS cluster. 16 | 3. Upgrade the version of the EKS module: `version = ">= v18.20.0"` 17 | 4. Configure the `terraform-aws-modules/eks/aws` with `manage_aws_auth_configmap = true`. This version of the EKS module uses the new `kubernetes_config_map_v1_data` resource to patch `aws-auth` configmap data (just like the v1.0.0 version of this module). 18 | 5. Plan and Apply. 19 | - The `aws-auth` configmap should now be managed by the EKS module. 20 | 21 | Please see the [complete example](https://registry.terraform.io/modules/terraform-aws-modules/eks/aws/latest) for more information. 22 | 23 | --- 24 | 25 | [![Pre-Commit](https://github.com/aidanmelen/terraform-aws-eks-auth/actions/workflows/pre-commit.yaml/badge.svg)](https://github.com/aidanmelen/terraform-aws-eks-auth/actions/workflows/pre-commit.yaml) 26 | [![cookiecutter-tf-module](https://img.shields.io/badge/cookiecutter--tf--module-enabled-brightgreen)](https://github.com/aidanmelen/cookiecutter-tf-module) 27 | 28 | # terraform-aws-eks-auth 29 | 30 | A Terraform module to manage [cluster authentication](https://docs.aws.amazon.com/eks/latest/userguide/cluster-auth.html) for an Elastic Kubernetes (EKS) cluster on AWS. 31 | 32 | ## Assumptions 33 | 34 | - You are using the [terraform-aws-eks](https://registry.terraform.io/modules/terraform-aws-modules/eks/aws/latest) module. 35 | 36 | 37 | 38 | 39 | ## Usage 40 | 41 | Grant access to the AWS EKS cluster by adding `map_roles`, `map_user` or `map_accounts` to the `aws-auth` configmap. 42 | 43 | ```hcl 44 | module "eks" { 45 | source = "terraform-aws-modules/eks/aws" 46 | # insert the 15 required variables here 47 | } 48 | 49 | module "eks_auth" { 50 | source = "aidanmelen/eks-auth/aws" 51 | eks = module.eks 52 | 53 | map_roles = [ 54 | { 55 | rolearn = "arn:aws:iam::66666666666:role/role1" 56 | username = "role1" 57 | groups = ["system:masters"] 58 | }, 59 | ] 60 | 61 | map_users = [ 62 | { 63 | userarn = "arn:aws:iam::66666666666:user/user1" 64 | username = "user1" 65 | groups = ["system:masters"] 66 | }, 67 | { 68 | userarn = "arn:aws:iam::66666666666:user/user2" 69 | username = "user2" 70 | groups = ["system:masters"] 71 | }, 72 | ] 73 | 74 | map_accounts = [ 75 | "777777777777", 76 | "888888888888", 77 | ] 78 | } 79 | ``` 80 | 81 | Please see the [complete example](examples/complete) for more information. 82 | 83 | ## Requirements 84 | 85 | | Name | Version | 86 | |------|---------| 87 | | [terraform](#requirement\_terraform) | >= 0.14.8 | 88 | | [http](#requirement\_http) | >= 2.4.1 | 89 | | [kubernetes](#requirement\_kubernetes) | >= 2.10.0 | 90 | 91 | ## Providers 92 | 93 | | Name | Version | 94 | |------|---------| 95 | | [http](#provider\_http) | >= 2.4.1 | 96 | | [kubernetes](#provider\_kubernetes) | >= 2.10.0 | 97 | 98 | ## Modules 99 | 100 | No modules. 101 | 102 | ## Resources 103 | 104 | | Name | Type | 105 | |------|------| 106 | | [kubernetes_config_map_v1.aws_auth](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/config_map_v1) | resource | 107 | | [kubernetes_config_map_v1_data.aws_auth](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/config_map_v1_data) | resource | 108 | | [http_http.wait_for_cluster](https://registry.terraform.io/providers/terraform-aws-modules/http/latest/docs/data-sources/http) | data source | 109 | 110 | ## Inputs 111 | 112 | | Name | Description | Type | Default | Required | 113 | |------|-------------|------|---------|:--------:| 114 | | [eks](#input\_eks) | The outputs from the `terraform-aws-modules/terraform-aws-eks` module. | `any` | n/a | yes | 115 | | [map\_accounts](#input\_map\_accounts) | Additional AWS account numbers to add to the aws-auth configmap. | `list(string)` | `[]` | no | 116 | | [map\_roles](#input\_map\_roles) | Additional IAM roles to add to the aws-auth configmap. | 
list(object({
    rolearn  = string
    username = string
    groups   = list(string)
  }))
| `[]` | no | 117 | | [map\_users](#input\_map\_users) | Additional IAM users to add to the aws-auth configmap. | 
list(object({
    userarn  = string
    username = string
    groups   = list(string)
  }))
| `[]` | no | 118 | | [wait\_for\_cluster\_timeout](#input\_wait\_for\_cluster\_timeout) | A timeout (in seconds) to wait for cluster to be available. | `number` | `300` | no | 119 | 120 | ## Outputs 121 | 122 | | Name | Description | 123 | |------|-------------| 124 | | [aws\_auth\_configmap\_yaml](#output\_aws\_auth\_configmap\_yaml) | Formatted yaml output for aws-auth configmap. | 125 | | [map\_accounts](#output\_map\_accounts) | The aws-auth map accounts. | 126 | | [map\_roles](#output\_map\_roles) | The aws-auth map roles merged with the eks managed node group, self managed node groups and fargate profile roles. | 127 | | [map\_users](#output\_map\_users) | The aws-auth map users. | 128 | 129 | 130 | ## License 131 | 132 | Apache 2 Licensed. See [LICENSE](https://github.com/aidanmelen/terraform-aws-eks-auth/tree/master/LICENSE) for full details. 133 | -------------------------------------------------------------------------------- /examples/basic/.terraform-docs.yml: -------------------------------------------------------------------------------- 1 | content: |- 2 | {{ .Header }} 3 | 4 | # Basic Example 5 | 6 | Grant access to the AWS EKS cluster by creating a new `aws-auth` configmap with the `map_roles`, `map_user` and `map_accounts`. 7 | 8 | ℹ️ An AWS EKS cluster without managed node groups or fargate profiles will not automatically create the `aws-auth` configmap. So this module will create a new configmap with terraform. 9 | 10 | ```hcl 11 | {{ include "main.tf" }} 12 | ``` 13 | 14 | ## Running this module manually 15 | 16 | 1. Install [Terraform](https://www.terraform.io/) and make sure it's on your `PATH`. 17 | 1. Run `terraform init`. 18 | 1. Run `terraform apply`. 19 | 1. When you're done, run `terraform destroy`. 20 | 21 | ## Running automated tests against this module 22 | 23 | 1. Install [Terraform](https://www.terraform.io/) and make sure it's on your `PATH`. 24 | 1. Install [Golang](https://golang.org/) and make sure this code is checked out into your `GOPATH`. 25 | 1. `cd test` 26 | 1. `go test terraform_basic_test.go -v` 27 | 28 | {{ .Requirements }} 29 | 30 | {{ .Providers }} 31 | 32 | {{ .Modules }} 33 | 34 | {{ .Resources }} 35 | 36 | {{ .Inputs }} 37 | 38 | {{ .Outputs }} 39 | -------------------------------------------------------------------------------- /examples/basic/README.md: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | # Basic Example 5 | 6 | Grant access to the AWS EKS cluster by creating a new `aws-auth` configmap with the `map_roles`, `map_user` and `map_accounts`. 7 | 8 | ℹ️ An AWS EKS cluster without managed node groups or fargate profiles will not automatically create the `aws-auth` configmap. So this module will create a new configmap with terraform. 9 | 10 | ```hcl 11 | locals { 12 | name = "ex-${replace(basename(path.cwd), "_", "-")}" 13 | } 14 | 15 | module "eks" { 16 | source = "terraform-aws-modules/eks/aws" 17 | version = ">= 18.0.0" 18 | 19 | cluster_name = local.name 20 | vpc_id = module.vpc.vpc_id 21 | subnet_ids = module.vpc.private_subnets 22 | } 23 | 24 | module "eks_auth" { 25 | source = "../../" 26 | eks = module.eks 27 | 28 | map_roles = [ 29 | { 30 | rolearn = "arn:aws:iam::66666666666:role/role1" 31 | username = "role1" 32 | groups = ["system:masters"] 33 | }, 34 | ] 35 | 36 | map_users = [ 37 | { 38 | userarn = "arn:aws:iam::66666666666:user/user1" 39 | username = "user1" 40 | groups = ["system:masters"] 41 | }, 42 | { 43 | userarn = "arn:aws:iam::66666666666:user/user2" 44 | username = "user2" 45 | groups = ["system:masters"] 46 | }, 47 | ] 48 | 49 | map_accounts = [ 50 | "777777777777", 51 | "888888888888", 52 | ] 53 | } 54 | ``` 55 | 56 | ## Running this module manually 57 | 58 | 1. Install [Terraform](https://www.terraform.io/) and make sure it's on your `PATH`. 59 | 1. Run `terraform init`. 60 | 1. Run `terraform apply`. 61 | 1. When you're done, run `terraform destroy`. 62 | 63 | ## Running automated tests against this module 64 | 65 | 1. Install [Terraform](https://www.terraform.io/) and make sure it's on your `PATH`. 66 | 1. Install [Golang](https://golang.org/) and make sure this code is checked out into your `GOPATH`. 67 | 1. `cd test` 68 | 1. `go test terraform_basic_test.go -v` 69 | 70 | ## Requirements 71 | 72 | | Name | Version | 73 | |------|---------| 74 | | [terraform](#requirement\_terraform) | >= 0.14.8 | 75 | | [aws](#requirement\_aws) | >= 3.72 | 76 | | [kubernetes](#requirement\_kubernetes) | >= 2.10.0 | 77 | 78 | ## Providers 79 | 80 | | Name | Version | 81 | |------|---------| 82 | | [aws](#provider\_aws) | >= 3.72 | 83 | 84 | ## Modules 85 | 86 | | Name | Source | Version | 87 | |------|--------|---------| 88 | | [eks](#module\_eks) | terraform-aws-modules/eks/aws | >= 18.0.0 | 89 | | [eks\_auth](#module\_eks\_auth) | ../../ | n/a | 90 | | [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3.0 | 91 | 92 | ## Resources 93 | 94 | | Name | Type | 95 | |------|------| 96 | | [aws_eks_cluster.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source | 97 | | [aws_eks_cluster_auth.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source | 98 | 99 | ## Inputs 100 | 101 | | Name | Description | Type | Default | Required | 102 | |------|-------------|------|---------|:--------:| 103 | | [aws\_region](#input\_aws\_region) | The AWS Region | `string` | `"us-west-2"` | no | 104 | 105 | ## Outputs 106 | 107 | | Name | Description | 108 | |------|-------------| 109 | | [map\_accounts](#output\_map\_accounts) | The aws-auth map accounts. | 110 | | [map\_roles](#output\_map\_roles) | The aws-auth map roles merged with the eks cluster node group and fargate profile roles. | 111 | | [map\_users](#output\_map\_users) | The aws-auth map users. | 112 | 113 | -------------------------------------------------------------------------------- /examples/basic/data.tf: -------------------------------------------------------------------------------- 1 | data "aws_eks_cluster" "cluster" { 2 | name = module.eks.cluster_id 3 | } 4 | 5 | data "aws_eks_cluster_auth" "cluster" { 6 | name = module.eks.cluster_id 7 | } 8 | -------------------------------------------------------------------------------- /examples/basic/main.tf: -------------------------------------------------------------------------------- 1 | locals { 2 | name = "ex-${replace(basename(path.cwd), "_", "-")}" 3 | } 4 | 5 | module "eks" { 6 | source = "terraform-aws-modules/eks/aws" 7 | version = ">= 18.0.0" 8 | 9 | cluster_name = local.name 10 | vpc_id = module.vpc.vpc_id 11 | subnet_ids = module.vpc.private_subnets 12 | } 13 | 14 | module "eks_auth" { 15 | source = "../../" 16 | eks = module.eks 17 | 18 | map_roles = [ 19 | { 20 | rolearn = "arn:aws:iam::66666666666:role/role1" 21 | username = "role1" 22 | groups = ["system:masters"] 23 | }, 24 | ] 25 | 26 | map_users = [ 27 | { 28 | userarn = "arn:aws:iam::66666666666:user/user1" 29 | username = "user1" 30 | groups = ["system:masters"] 31 | }, 32 | { 33 | userarn = "arn:aws:iam::66666666666:user/user2" 34 | username = "user2" 35 | groups = ["system:masters"] 36 | }, 37 | ] 38 | 39 | map_accounts = [ 40 | "777777777777", 41 | "888888888888", 42 | ] 43 | } 44 | -------------------------------------------------------------------------------- /examples/basic/outputs.tf: -------------------------------------------------------------------------------- 1 | output "map_accounts" { 2 | description = "The aws-auth map accounts." 3 | value = module.eks_auth.map_accounts 4 | } 5 | 6 | output "map_roles" { 7 | description = "The aws-auth map roles merged with the eks cluster node group and fargate profile roles." 8 | value = module.eks_auth.map_roles 9 | } 10 | 11 | output "map_users" { 12 | description = "The aws-auth map users." 13 | value = module.eks_auth.map_users 14 | } 15 | -------------------------------------------------------------------------------- /examples/basic/providers.tf: -------------------------------------------------------------------------------- 1 | provider "aws" { 2 | region = var.aws_region 3 | default_tags { 4 | tags = { 5 | Example = local.name 6 | GithubRepo = "terraform-aws-eks-auth" 7 | GithubOrg = "aidan-melen" 8 | } 9 | } 10 | } 11 | 12 | provider "kubernetes" { 13 | host = module.eks.cluster_endpoint 14 | cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data) 15 | token = data.aws_eks_cluster_auth.cluster.token 16 | } 17 | -------------------------------------------------------------------------------- /examples/basic/variables.tf: -------------------------------------------------------------------------------- 1 | variable "aws_region" { 2 | description = "The AWS Region" 3 | type = string 4 | default = "us-west-2" 5 | } 6 | -------------------------------------------------------------------------------- /examples/basic/versions.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_version = ">= 0.14.8" 3 | 4 | required_providers { 5 | aws = { 6 | source = "hashicorp/aws" 7 | version = ">= 3.72" 8 | } 9 | 10 | kubernetes = { 11 | source = "hashicorp/kubernetes" 12 | version = ">= 2.10.0" 13 | } 14 | } 15 | } 16 | -------------------------------------------------------------------------------- /examples/basic/vpc.tf: -------------------------------------------------------------------------------- 1 | module "vpc" { 2 | source = "terraform-aws-modules/vpc/aws" 3 | version = "~> 3.0" 4 | 5 | name = local.name 6 | cidr = "10.0.0.0/16" 7 | 8 | azs = ["${var.aws_region}a", "${var.aws_region}b", "${var.aws_region}c"] 9 | private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] 10 | public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"] 11 | 12 | enable_nat_gateway = true 13 | single_nat_gateway = true 14 | enable_dns_hostnames = true 15 | 16 | public_subnet_tags = { 17 | "kubernetes.io/cluster/${local.name}" = "shared" 18 | "kubernetes.io/role/elb" = 1 19 | } 20 | 21 | private_subnet_tags = { 22 | "kubernetes.io/cluster/${local.name}" = "shared" 23 | "kubernetes.io/role/internal-elb" = 1 24 | } 25 | } 26 | -------------------------------------------------------------------------------- /examples/complete/.terraform-docs.yml: -------------------------------------------------------------------------------- 1 | content: |- 2 | {{ .Header }} 3 | 4 | # Complete Example 5 | 6 | Grant access to the AWS EKS cluster by patching the already existing `aws-auth` configmap with the `map_roles`, `map_user` and `map_accounts`. 7 | 8 | ℹ️ The `aws-auth` configmap will already exist when the AWS EKS cluster is created with managed node groups or fargate profiles. So this module will patch the configmap with terraform. 9 | 10 | ```hcl 11 | {{ include "main.tf" }} 12 | ``` 13 | 14 | ## Running this module manually 15 | 16 | 1. Install [Terraform](https://www.terraform.io/) and make sure it's on your `PATH`. 17 | 1. Run `terraform init`. 18 | 1. Run `terraform apply`. 19 | 1. When you're done, run `terraform destroy`. 20 | 21 | ## Running automated tests against this module 22 | 23 | 1. Install [Terraform](https://www.terraform.io/) and make sure it's on your `PATH`. 24 | 1. Install [Golang](https://golang.org/) and make sure this code is checked out into your `GOPATH`. 25 | 1. `cd test` 26 | 1. `go test terraform_complete_test.go -v` 27 | 28 | {{ .Requirements }} 29 | 30 | {{ .Providers }} 31 | 32 | {{ .Modules }} 33 | 34 | {{ .Resources }} 35 | 36 | {{ .Inputs }} 37 | 38 | {{ .Outputs }} 39 | -------------------------------------------------------------------------------- /examples/complete/README.md: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | # Complete Example 5 | 6 | Grant access to the AWS EKS cluster by patching the already existing `aws-auth` configmap with the `map_roles`, `map_user` and `map_accounts`. 7 | 8 | ℹ️ The `aws-auth` configmap will already exist when the AWS EKS cluster is created with managed node groups or fargate profiles. So this module will patch the configmap with terraform. 9 | 10 | ```hcl 11 | locals { 12 | name = "ex-${replace(basename(path.cwd), "_", "-")}" 13 | } 14 | 15 | module "eks" { 16 | source = "terraform-aws-modules/eks/aws" 17 | version = ">= 18.0.0" 18 | 19 | cluster_name = local.name 20 | cluster_version = "1.21" 21 | 22 | vpc_id = module.vpc.vpc_id 23 | subnet_ids = module.vpc.private_subnets 24 | 25 | self_managed_node_groups = { 26 | boo = { 27 | instance_type = "t3.medium" 28 | instance_market_options = { 29 | market_type = "spot" 30 | } 31 | } 32 | } 33 | 34 | eks_managed_node_groups = { 35 | foo = {} 36 | } 37 | 38 | fargate_profiles = { 39 | bar = { 40 | selectors = [ 41 | { 42 | namespace = "bar" 43 | } 44 | ] 45 | } 46 | } 47 | } 48 | 49 | module "eks_auth" { 50 | source = "../../" 51 | eks = module.eks 52 | 53 | map_roles = [ 54 | { 55 | rolearn = "arn:aws:iam::66666666666:role/role1" 56 | username = "role1" 57 | groups = ["system:masters"] 58 | }, 59 | ] 60 | 61 | map_users = [ 62 | { 63 | userarn = "arn:aws:iam::66666666666:user/user1" 64 | username = "user1" 65 | groups = ["system:masters"] 66 | }, 67 | { 68 | userarn = "arn:aws:iam::66666666666:user/user2" 69 | username = "user2" 70 | groups = ["system:masters"] 71 | }, 72 | ] 73 | 74 | map_accounts = [ 75 | "777777777777", 76 | "888888888888", 77 | ] 78 | } 79 | ``` 80 | 81 | ## Running this module manually 82 | 83 | 1. Install [Terraform](https://www.terraform.io/) and make sure it's on your `PATH`. 84 | 1. Run `terraform init`. 85 | 1. Run `terraform apply`. 86 | 1. When you're done, run `terraform destroy`. 87 | 88 | ## Running automated tests against this module 89 | 90 | 1. Install [Terraform](https://www.terraform.io/) and make sure it's on your `PATH`. 91 | 1. Install [Golang](https://golang.org/) and make sure this code is checked out into your `GOPATH`. 92 | 1. `cd test` 93 | 1. `go test terraform_complete_test.go -v` 94 | 95 | ## Requirements 96 | 97 | | Name | Version | 98 | |------|---------| 99 | | [terraform](#requirement\_terraform) | >= 0.14.8 | 100 | | [aws](#requirement\_aws) | >= 3.72 | 101 | | [kubernetes](#requirement\_kubernetes) | >= 2.10.0 | 102 | 103 | ## Providers 104 | 105 | | Name | Version | 106 | |------|---------| 107 | | [aws](#provider\_aws) | >= 3.72 | 108 | 109 | ## Modules 110 | 111 | | Name | Source | Version | 112 | |------|--------|---------| 113 | | [eks](#module\_eks) | terraform-aws-modules/eks/aws | >= 18.0.0 | 114 | | [eks\_auth](#module\_eks\_auth) | ../../ | n/a | 115 | | [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | ~> 3.0 | 116 | 117 | ## Resources 118 | 119 | | Name | Type | 120 | |------|------| 121 | | [aws_eks_cluster.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster) | data source | 122 | | [aws_eks_cluster_auth.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source | 123 | 124 | ## Inputs 125 | 126 | | Name | Description | Type | Default | Required | 127 | |------|-------------|------|---------|:--------:| 128 | | [aws\_region](#input\_aws\_region) | The AWS Region | `string` | `"us-west-2"` | no | 129 | 130 | ## Outputs 131 | 132 | | Name | Description | 133 | |------|-------------| 134 | | [fargate\_profile\_iam\_role\_arn](#output\_fargate\_profile\_iam\_role\_arn) | The Amazon Resource Name (ARN) of the EKS Fargate Profile | 135 | | [managed\_node\_group\_iam\_role\_arn](#output\_managed\_node\_group\_iam\_role\_arn) | The Amazon Resource Name (ARN) specifying the IAM role for the managed node group | 136 | | [map\_accounts](#output\_map\_accounts) | The aws-auth map accounts | 137 | | [map\_roles](#output\_map\_roles) | The aws-auth map roles merged with the eks cluster node group and fargate profile roles | 138 | | [map\_users](#output\_map\_users) | The aws-auth map users | 139 | | [self\_managed\_node\_group\_iam\_role\_arn](#output\_self\_managed\_node\_group\_iam\_role\_arn) | The Amazon Resource Name (ARN) specifying the IAM role for the self managed node group | 140 | 141 | -------------------------------------------------------------------------------- /examples/complete/complete.tf.docs: -------------------------------------------------------------------------------- 1 | module "eks" { 2 | source = "terraform-aws-modules/eks/aws" 3 | # insert the 15 required variables here 4 | } 5 | 6 | module "eks_auth" { 7 | source = "aidanmelen/eks-auth/aws" 8 | eks = module.eks 9 | 10 | map_roles = [ 11 | { 12 | rolearn = "arn:aws:iam::66666666666:role/role1" 13 | username = "role1" 14 | groups = ["system:masters"] 15 | }, 16 | ] 17 | 18 | map_users = [ 19 | { 20 | userarn = "arn:aws:iam::66666666666:user/user1" 21 | username = "user1" 22 | groups = ["system:masters"] 23 | }, 24 | { 25 | userarn = "arn:aws:iam::66666666666:user/user2" 26 | username = "user2" 27 | groups = ["system:masters"] 28 | }, 29 | ] 30 | 31 | map_accounts = [ 32 | "777777777777", 33 | "888888888888", 34 | ] 35 | } 36 | -------------------------------------------------------------------------------- /examples/complete/data.tf: -------------------------------------------------------------------------------- 1 | data "aws_eks_cluster" "cluster" { 2 | name = module.eks.cluster_id 3 | } 4 | 5 | data "aws_eks_cluster_auth" "cluster" { 6 | name = module.eks.cluster_id 7 | } 8 | -------------------------------------------------------------------------------- /examples/complete/main.tf: -------------------------------------------------------------------------------- 1 | locals { 2 | name = "ex-${replace(basename(path.cwd), "_", "-")}" 3 | } 4 | 5 | module "eks" { 6 | source = "terraform-aws-modules/eks/aws" 7 | version = ">= 18.0.0" 8 | 9 | cluster_name = local.name 10 | cluster_version = "1.21" 11 | 12 | vpc_id = module.vpc.vpc_id 13 | subnet_ids = module.vpc.private_subnets 14 | 15 | self_managed_node_groups = { 16 | boo = { 17 | instance_type = "t3.medium" 18 | instance_market_options = { 19 | market_type = "spot" 20 | } 21 | } 22 | } 23 | 24 | eks_managed_node_groups = { 25 | foo = {} 26 | } 27 | 28 | fargate_profiles = { 29 | bar = { 30 | selectors = [ 31 | { 32 | namespace = "bar" 33 | } 34 | ] 35 | } 36 | } 37 | } 38 | 39 | module "eks_auth" { 40 | source = "../../" 41 | eks = module.eks 42 | 43 | map_roles = [ 44 | { 45 | rolearn = "arn:aws:iam::66666666666:role/role1" 46 | username = "role1" 47 | groups = ["system:masters"] 48 | }, 49 | ] 50 | 51 | map_users = [ 52 | { 53 | userarn = "arn:aws:iam::66666666666:user/user1" 54 | username = "user1" 55 | groups = ["system:masters"] 56 | }, 57 | { 58 | userarn = "arn:aws:iam::66666666666:user/user2" 59 | username = "user2" 60 | groups = ["system:masters"] 61 | }, 62 | ] 63 | 64 | map_accounts = [ 65 | "777777777777", 66 | "888888888888", 67 | ] 68 | } 69 | -------------------------------------------------------------------------------- /examples/complete/outputs.tf: -------------------------------------------------------------------------------- 1 | output "fargate_profile_iam_role_arn" { 2 | description = "The Amazon Resource Name (ARN) of the EKS Fargate Profile" 3 | value = module.eks.fargate_profiles.bar.iam_role_arn 4 | } 5 | 6 | output "managed_node_group_iam_role_arn" { 7 | description = "The Amazon Resource Name (ARN) specifying the IAM role for the managed node group" 8 | value = module.eks.eks_managed_node_groups.foo.iam_role_arn 9 | } 10 | 11 | output "map_accounts" { 12 | description = "The aws-auth map accounts" 13 | value = module.eks_auth.map_accounts 14 | } 15 | 16 | output "map_roles" { 17 | description = "The aws-auth map roles merged with the eks cluster node group and fargate profile roles" 18 | value = module.eks_auth.map_roles 19 | } 20 | 21 | output "map_users" { 22 | description = "The aws-auth map users" 23 | value = module.eks_auth.map_users 24 | } 25 | 26 | output "self_managed_node_group_iam_role_arn" { 27 | description = "The Amazon Resource Name (ARN) specifying the IAM role for the self managed node group" 28 | value = module.eks.self_managed_node_groups.boo.iam_role_arn 29 | } 30 | -------------------------------------------------------------------------------- /examples/complete/providers.tf: -------------------------------------------------------------------------------- 1 | provider "aws" { 2 | region = var.aws_region 3 | 4 | default_tags { 5 | tags = { 6 | Example = local.name 7 | GithubRepo = "terraform-aws-eks-auth" 8 | GithubOrg = "aidan-melen" 9 | } 10 | } 11 | } 12 | 13 | provider "kubernetes" { 14 | host = module.eks.cluster_endpoint 15 | cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data) 16 | token = data.aws_eks_cluster_auth.cluster.token 17 | } 18 | -------------------------------------------------------------------------------- /examples/complete/variables.tf: -------------------------------------------------------------------------------- 1 | variable "aws_region" { 2 | description = "The AWS Region" 3 | type = string 4 | default = "us-west-2" 5 | } 6 | -------------------------------------------------------------------------------- /examples/complete/versions.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_version = ">= 0.14.8" 3 | 4 | required_providers { 5 | aws = { 6 | source = "hashicorp/aws" 7 | version = ">= 3.72" 8 | } 9 | 10 | kubernetes = { 11 | source = "hashicorp/kubernetes" 12 | version = ">= 2.10.0" 13 | } 14 | } 15 | } 16 | -------------------------------------------------------------------------------- /examples/complete/vpc.tf: -------------------------------------------------------------------------------- 1 | module "vpc" { 2 | source = "terraform-aws-modules/vpc/aws" 3 | version = "~> 3.0" 4 | 5 | name = local.name 6 | cidr = "10.0.0.0/16" 7 | 8 | azs = ["${var.aws_region}a", "${var.aws_region}b", "${var.aws_region}c"] 9 | private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"] 10 | public_subnets = ["10.0.4.0/24", "10.0.5.0/24", "10.0.6.0/24"] 11 | 12 | enable_nat_gateway = true 13 | single_nat_gateway = true 14 | enable_dns_hostnames = true 15 | 16 | public_subnet_tags = { 17 | "kubernetes.io/cluster/${local.name}" = "shared" 18 | "kubernetes.io/role/elb" = 1 19 | } 20 | 21 | private_subnet_tags = { 22 | "kubernetes.io/cluster/${local.name}" = "shared" 23 | "kubernetes.io/role/internal-elb" = 1 24 | } 25 | } 26 | -------------------------------------------------------------------------------- /main.tf: -------------------------------------------------------------------------------- 1 | locals { 2 | create_aws_auth_configmap = length(var.eks.eks_managed_node_groups) == 0 && length(var.eks.fargate_profiles) == 0 3 | patch_aws_auth_configmap = !local.create_aws_auth_configmap 4 | 5 | merged_map_roles = distinct(concat( 6 | try(yamldecode(yamldecode(var.eks.aws_auth_configmap_yaml).data.mapRoles), []), 7 | var.map_roles, 8 | )) 9 | 10 | aws_auth_configmap_yaml = templatefile("${path.module}/templates/aws_auth_cm.tpl", 11 | { 12 | map_roles = local.merged_map_roles 13 | map_users = var.map_users 14 | map_accounts = var.map_accounts 15 | } 16 | ) 17 | } 18 | 19 | data "http" "wait_for_cluster" { 20 | url = format("%s/healthz", var.eks.cluster_endpoint) 21 | ca_certificate = base64decode(var.eks.cluster_certificate_authority_data) 22 | timeout = var.wait_for_cluster_timeout 23 | } 24 | 25 | resource "kubernetes_config_map_v1" "aws_auth" { 26 | count = local.create_aws_auth_configmap ? 1 : 0 27 | depends_on = [data.http.wait_for_cluster] 28 | 29 | metadata { 30 | name = "aws-auth" 31 | namespace = "kube-system" 32 | } 33 | 34 | data = { 35 | "mapRoles" = yamlencode(local.merged_map_roles) 36 | "mapUsers" = yamlencode(var.map_users) 37 | "mapAccounts" = yamlencode(var.map_accounts) 38 | } 39 | } 40 | 41 | 42 | resource "kubernetes_config_map_v1_data" "aws_auth" { 43 | count = local.patch_aws_auth_configmap ? 1 : 0 44 | depends_on = [data.http.wait_for_cluster] 45 | 46 | metadata { 47 | name = "aws-auth" 48 | namespace = "kube-system" 49 | } 50 | 51 | data = { 52 | "mapRoles" = yamlencode(local.merged_map_roles) 53 | "mapUsers" = yamlencode(var.map_users) 54 | "mapAccounts" = yamlencode(var.map_accounts) 55 | } 56 | 57 | force = true 58 | } 59 | -------------------------------------------------------------------------------- /outputs.tf: -------------------------------------------------------------------------------- 1 | output "aws_auth_configmap_yaml" { 2 | description = "Formatted yaml output for aws-auth configmap." 3 | value = local.aws_auth_configmap_yaml 4 | } 5 | 6 | output "map_accounts" { 7 | description = "The aws-auth map accounts." 8 | value = var.map_accounts 9 | } 10 | 11 | output "map_roles" { 12 | description = "The aws-auth map roles merged with the eks managed node group, self managed node groups and fargate profile roles." 13 | value = local.merged_map_roles 14 | } 15 | 16 | output "map_users" { 17 | description = "The aws-auth map users." 18 | value = var.map_users 19 | } 20 | -------------------------------------------------------------------------------- /templates/aws_auth_cm.tpl: -------------------------------------------------------------------------------- 1 | apiVersion: v1 2 | kind: ConfigMap 3 | metadata: 4 | name: aws-auth 5 | namespace: kube-system 6 | data: 7 | mapRoles: | 8 | ${indent(4, yamlencode(map_roles))} 9 | mapUsers: | 10 | ${indent(4, yamlencode(map_users))} 11 | mapAccounts: | 12 | ${indent(4, yamlencode(map_accounts))} 13 | -------------------------------------------------------------------------------- /test/terraform_basic_test.go: -------------------------------------------------------------------------------- 1 | package test 2 | 3 | import ( 4 | "testing" 5 | 6 | "github.com/gruntwork-io/terratest/modules/terraform" 7 | "github.com/stretchr/testify/assert" 8 | ) 9 | 10 | func TestTerraformBasicExample(t *testing.T) { 11 | terraformOptions := &terraform.Options{ 12 | // website::tag::1:: Set the path to the Terraform code that will be tested. 13 | TerraformDir: "../examples/basic", 14 | 15 | // Disable colors in Terraform commands so its easier to parse stdout/stderr 16 | NoColor: true, 17 | } 18 | 19 | // website::tag::4:: Clean up resources with "terraform destroy" at the end of the test. 20 | defer terraform.Destroy(t, terraformOptions) 21 | 22 | // website::tag::2:: Run "terraform init" and "terraform apply". Fail the test if there are any errors. 23 | terraform.InitAndApply(t, terraformOptions) 24 | 25 | // website::tag::3:: Run `terraform output` to get the values of output variables and check they have the expected values. 26 | outputMapRoles := terraform.OutputList(t, terraformOptions, "map_roles") 27 | outputMapUsers := terraform.OutputList(t, terraformOptions, "map_users") 28 | outputMapAccounts := terraform.OutputList(t, terraformOptions, "map_accounts") 29 | 30 | expectedMapRoles := []string([]string{ 31 | "map[groups:[system:masters] rolearn:arn:aws:iam::66666666666:role/role1 username:role1]", 32 | }) 33 | expectedMapUsers := []string([]string{ 34 | "map[groups:[system:masters] userarn:arn:aws:iam::66666666666:user/user1 username:user1]", 35 | "map[groups:[system:masters] userarn:arn:aws:iam::66666666666:user/user2 username:user2]", 36 | }) 37 | expectedMapAccounts := []string([]string{"777777777777", "888888888888"}) 38 | 39 | assert.Equal(t, expectedMapRoles, outputMapRoles, "Map %q should match %q", expectedMapRoles, expectedMapRoles) 40 | assert.Equal(t, expectedMapUsers, outputMapUsers, "Map %q should match %q", expectedMapUsers, outputMapUsers) 41 | assert.Equal(t, expectedMapAccounts, outputMapAccounts, "Map %q should match %q", expectedMapAccounts, outputMapAccounts) 42 | 43 | // website::tag::4:: Run a second "terraform apply". Fail the test if results have changes 44 | terraform.ApplyAndIdempotent(t, terraformOptions) 45 | } 46 | -------------------------------------------------------------------------------- /test/terraform_complete_test.go: -------------------------------------------------------------------------------- 1 | package test 2 | 3 | import ( 4 | "testing" 5 | 6 | "github.com/gruntwork-io/terratest/modules/terraform" 7 | "github.com/stretchr/testify/assert" 8 | ) 9 | 10 | func TestTerraformCompleteExample(t *testing.T) { 11 | terraformOptions := &terraform.Options{ 12 | // website::tag::1:: Set the path to the Terraform code that will be tested. 13 | TerraformDir: "../examples/complete", 14 | 15 | // Disable colors in Terraform commands so its easier to parse stdout/stderr 16 | NoColor: true, 17 | } 18 | 19 | // website::tag::4:: Clean up resources with "terraform destroy" at the end of the test. 20 | defer terraform.Destroy(t, terraformOptions) 21 | 22 | // website::tag::2:: Run "terraform init" and "terraform apply". Fail the test if there are any errors. 23 | terraform.InitAndApply(t, terraformOptions) 24 | 25 | // website::tag::3:: Run `terraform output` to get the values of output variables and check they have the expected values. 26 | outputManagedNodeGroupIamRoleArn := terraform.Output(t, terraformOptions, "managed_node_group_iam_role_arn") 27 | outputSelfManagedNodeGroupIamRoleArn := terraform.Output(t, terraformOptions, "self_managed_node_group_iam_role_arn") 28 | outputFargateProfilesIamRoleArn := terraform.Output(t, terraformOptions, "fargate_profile_iam_role_arn") 29 | outputMapRoles := terraform.OutputList(t, terraformOptions, "map_roles") 30 | outputMapUsers := terraform.OutputList(t, terraformOptions, "map_users") 31 | outputMapAccounts := terraform.OutputList(t, terraformOptions, "map_accounts") 32 | 33 | expectedMapRoles := []string([]string{ 34 | "map[groups:[system:bootstrappers system:nodes] rolearn:" + outputManagedNodeGroupIamRoleArn + " username:system:node:{{EC2PrivateDNSName}}]", 35 | "map[groups:[system:bootstrappers system:nodes] rolearn:" + outputSelfManagedNodeGroupIamRoleArn + " username:system:node:{{EC2PrivateDNSName}}]", 36 | "map[groups:[system:bootstrappers system:nodes system:node-proxier] rolearn:" + outputFargateProfilesIamRoleArn + " username:system:node:{{SessionName}}]", 37 | "map[groups:[system:masters] rolearn:arn:aws:iam::66666666666:role/role1 username:role1]", 38 | }) 39 | expectedMapUsers := []string([]string{ 40 | "map[groups:[system:masters] userarn:arn:aws:iam::66666666666:user/user1 username:user1]", 41 | "map[groups:[system:masters] userarn:arn:aws:iam::66666666666:user/user2 username:user2]", 42 | }) 43 | expectedMapAccounts := []string([]string{"777777777777", "888888888888"}) 44 | 45 | assert.Equal(t, expectedMapRoles, outputMapRoles, "Map %q should match %q", expectedMapRoles, expectedMapRoles) 46 | assert.Equal(t, expectedMapUsers, outputMapUsers, "Map %q should match %q", expectedMapUsers, outputMapUsers) 47 | assert.Equal(t, expectedMapAccounts, outputMapAccounts, "Map %q should match %q", expectedMapAccounts, outputMapAccounts) 48 | 49 | // website::tag::4:: Run a second "terraform apply". Fail the test if results have changes 50 | terraform.ApplyAndIdempotent(t, terraformOptions) 51 | } 52 | -------------------------------------------------------------------------------- /variables.tf: -------------------------------------------------------------------------------- 1 | variable "eks" { 2 | description = "The outputs from the `terraform-aws-modules/terraform-aws-eks` module." 3 | type = any 4 | } 5 | 6 | variable "wait_for_cluster_timeout" { 7 | description = "A timeout (in seconds) to wait for cluster to be available." 8 | type = number 9 | default = 300 10 | } 11 | 12 | variable "map_accounts" { 13 | description = "Additional AWS account numbers to add to the aws-auth configmap." 14 | type = list(string) 15 | default = [] 16 | } 17 | 18 | variable "map_roles" { 19 | description = "Additional IAM roles to add to the aws-auth configmap." 20 | type = list(object({ 21 | rolearn = string 22 | username = string 23 | groups = list(string) 24 | })) 25 | default = [] 26 | } 27 | 28 | variable "map_users" { 29 | description = "Additional IAM users to add to the aws-auth configmap." 30 | type = list(object({ 31 | userarn = string 32 | username = string 33 | groups = list(string) 34 | })) 35 | default = [] 36 | } 37 | -------------------------------------------------------------------------------- /versions.tf: -------------------------------------------------------------------------------- 1 | terraform { 2 | required_version = ">= 0.14.8" 3 | 4 | required_providers { 5 | http = { 6 | source = "terraform-aws-modules/http" 7 | version = ">= 2.4.1" 8 | } 9 | 10 | kubernetes = { 11 | source = "hashicorp/kubernetes" 12 | version = ">= 2.10.0" 13 | } 14 | } 15 | } 16 | --------------------------------------------------------------------------------