setup addons for efs

terraform-modules · Aug 10, 2023 · 76f1ba8 · 76f1ba8
1 parent baea4d2
commit 76f1ba8
Show file tree

Hide file tree

Showing 20 changed files with 394 additions and 164 deletions.
diff --git a/examples/full-cluster-tf-upgrade/1.24/dns-zone.tf b/examples/full-cluster-tf-upgrade/1.24/dns-zone.tf
@@ -31,7 +31,7 @@ provider "aws" {
 # dummy vpc, so we can associate the zone to this account
 #---
 data "aws_vpc" "dummy_vpc" {
-  count = var.shared_vpc_label != null ? 1 : 0
+  count = ! (var.shared_vpc_label == null || var.shared_vpc_label == "") ? 1 : 0
   filter {
     name   = "tag:Name"
     values = ["vpc0-dummy"]
@@ -44,12 +44,16 @@ resource "aws_route53_zone" "cluster_domain" {
   force_destroy = false
 
   vpc {
-    vpc_id     = var.shared_vpc_label != null ? try(data.aws_vpc.dummy_vpc[0].id, null) : data.aws_vpc.eks_vpc.id
+    vpc_id     = ! (var.shared_vpc_label == null || var.shared_vpc_label == "") ? try(data.aws_vpc.dummy_vpc[0].id, null) : data.aws_vpc.eks_vpc.id
     vpc_region = local.region
   }
 
   lifecycle {
     ignore_changes = [vpc]
+    precondition {
+      condition     = (var.shared_vpc_label == null || var.shared_vpc_label == "") || (! (var.shared_vpc_label == null || var.shared_vpc_label == "") && ! (var.domain == null || var.domain == ""))
+      error_message = "var.domain must be provided when shared VPCs are in use."
+    }
   }
 
   tags = merge(
@@ -65,7 +69,7 @@ resource "aws_route53_zone" "cluster_domain" {
 # need to also associate with network-prod account and this vpc
 #---
 module "route53_cluster_domain_east" {
-  count = local.region == "us-gov-east-1" && var.shared_vpc_label != null ? 1 : 0
+  count = local.region == "us-gov-east-1" && ! (var.shared_vpc_label == null || var.shared_vpc_label == "") ? 1 : 0
   providers = {
     aws.self = aws
     aws.peer = aws.route53_main_east
@@ -83,7 +87,7 @@ module "route53_cluster_domain_east" {
 }
 
 module "route53_cluster_domain_west" {
-  count = local.region == "us-gov-west-1" && var.shared_vpc_label != null ? 1 : 0
+  count = local.region == "us-gov-west-1" && ! (var.shared_vpc_label == null || var.shared_vpc_label == "") ? 1 : 0
   providers = {
     aws.self = aws
     aws.peer = aws.route53_main_west

diff --git a/examples/full-cluster-tf-upgrade/1.25/addons/README.addons.md b/examples/full-cluster-tf-upgrade/1.25/addons/README.addons.md
@@ -0,0 +1,3 @@
+tf-aws eks describe-addon-versions --kubernetes-version 1.25
+
+
diff --git a/examples/full-cluster-tf-upgrade/1.25/addons/variables.addons.tf b/examples/full-cluster-tf-upgrade/1.25/addons/variables.addons.tf
@@ -9,12 +9,12 @@ variable "addon_versions" {
       "aws-ebs-csi-driver" = "v1.18.0-eksbuild.1"
     }
     "1.25" = {
-      "coredns"            = "v1.9.3-eksbuild.2"
-      "kube-proxy"         = "v1.25.6-eksbuild.1"
-      "vpc-cni"            = "v1.12.2-eksbuild.1"
-      "aws-ebs-csi-driver" = "v1.18.0-eksbuild.1"
+      "coredns"            = "v1.9.3-eksbuild.5"
+      "kube-proxy"         = "v1.25.11-eksbuild.2"
+      "vpc-cni"            = "v1.13.4-eksbuild.1"
+      "aws-ebs-csi-driver" = "v1.21.0-eksbuild.1"
+      "aws-efs-csi-driver" = "v1.5.8-eksbuild.1"
+      "adot"               = "v0.78.0-eksbuild.1"
     }
   }
 }
-
-
diff --git a/examples/full-cluster-tf-upgrade/1.25/common-services/images.tf b/examples/full-cluster-tf-upgrade/1.25/common-services/images.tf
@@ -1,6 +1,9 @@
 locals {
   image_config = [for k, v in var.image_details : v if v.enabled]
-  image_output = { for k, v in module.images.image_info : v.name => v }
+  image_output = { for k, v in module.images.images : v.name => v }
+
+  charts = { for k, v in var.chart_details : k => v if try(v.enabled, true) }
+  images = { for k, v in var.image_details : k => v if v.enabled }
 }
 
 module "images" {
@@ -13,7 +16,6 @@ module "images" {
   tags = merge(
     local.base_tags,
     local.common_tags,
-    var.tags,
     var.application_tags,
   )
 

diff --git a/examples/full-cluster-tf-upgrade/1.25/dns-zone.tf b/examples/full-cluster-tf-upgrade/1.25/dns-zone.tf
@@ -50,6 +50,10 @@ resource "aws_route53_zone" "cluster_domain" {
 
   lifecycle {
     ignore_changes = [vpc]
+    precondition {
+      condition     = (var.shared_vpc_label == null || var.shared_vpc_label == "") || (! (var.shared_vpc_label == null || var.shared_vpc_label == "") && ! (var.domain == null || var.domain == ""))
+      error_message = "var.domain must be provided when shared VPCs are in use."
+    }
   }
 
   tags = merge(

diff --git a/examples/full-cluster-tf-upgrade/1.25/efs/addon.tf b/examples/full-cluster-tf-upgrade/1.25/efs/addon.tf
@@ -0,0 +1,15 @@
+# https://docs.aws.amazon.com/eks/latest/userguide/efs-csi.html
+
+resource "aws_eks_addon" "aws-efs-csi-driver" {
+  count = lookup(lookup(var.addon_versions, var.cluster_version, {}), "aws-efs-csi-driver", null) != null ? 1 : 0
+
+  cluster_name  = var.cluster_name
+  addon_name    = "aws-efs-csi-driver"
+  addon_version = lookup(lookup(var.addon_versions, var.cluster_version, {}), "aws-efs-csi-driver", null)
+  #  resolve_conflicts        = "OVERWRITE"
+  # note OVERWRITE resets to eks addon defaults, PRESERVE uses any values set here
+  resolve_conflicts_on_create = "OVERWRITE"
+  resolve_conflicts_on_update = "OVERWRITE"
+  service_account_role_arn    = module.role_efs-driver.role_arn
+  configuration_values        = null
+}
diff --git a/examples/full-cluster-tf-upgrade/1.25/efs/copy_image.sh b/examples/full-cluster-tf-upgrade/1.25/efs/copy_image.sh
diff --git a/examples/full-cluster-tf-upgrade/1.25/efs/copy_images.tf b/examples/full-cluster-tf-upgrade/1.25/efs/copy_images.tf
diff --git a/examples/full-cluster-tf-upgrade/1.25/efs/ecr.tf b/examples/full-cluster-tf-upgrade/1.25/efs/ecr.tf
@@ -1,57 +1,70 @@
-
-# Populated from:
-# https://docs.aws.amazon.com/eks/latest/userguide/add-ons-images.html
-
-data "aws_caller_identity" "whoami" {}
-
-locals {
-  af_south_1 = (var.region == "af-south-1" ? "877085696533.dkr.ecr.af-south-1.amazonaws.com/" : "")
-  af         = local.af_south_1
-
-  ap_east_1      = var.region == "ap-east-1" ? "800184023465.dkr.ecr.ap-east-1.amazonaws.com/" : ""
-  ap_northeast_1 = var.region == "ap-northeast-1" ? "602401143452.dkr.ecr.ap-northeast-1.amazonaws.com/" : ""
-  ap_northeast_2 = var.region == "ap-northeast-2" ? "602401143452.dkr.ecr.ap-northeast-2.amazonaws.com/" : ""
-  ap_northeast_3 = var.region == "ap-northeast-3" ? "602401143452.dkr.ecr.ap-northeast-3.amazonaws.com/" : ""
-  ap_south_1     = var.region == "ap-south-1" ? "602401143452.dkr.ecr.ap-south-1.amazonaws.com/" : ""
-  ap_southeast_1 = var.region == "ap-southeast-1" ? "602401143452.dkr.ecr.ap-southeast-1.amazonaws.com/" : ""
-  ap_southeast_2 = var.region == "ap-southeast-2" ? "602401143452.dkr.ecr.ap-southeast-2.amazonaws.com/" : ""
-  ap_1           = "${local.ap_east_1}${local.ap_northeast_1}${local.ap_northeast_2}${local.ap_northeast_3}${local.ap_south_1}"
-  ap_2           = "${local.ap_southeast_1}${local.ap_southeast_2}"
-  ap             = "${local.ap_1}${local.ap_2}"
-
-  ca_central_1 = var.region == "ca-central-1" ? "602401143452.dkr.ecr.ca-central-1.amazonaws.com/" : ""
-  ca           = local.ca_central_1
-
-  cn_north_1     = var.region == "cn-north-1" ? "918309763551.dkr.ecr.cn-north-1.amazonaws.com.cn/" : ""
-  cn_northwest_1 = var.region == "cn-northwest-1" ? "961992271922.dkr.ecr.cn-northwest-1.amazonaws.com.cn/" : ""
-  cn             = "${local.cn_north_1}${local.cn_northwest_1}"
-
-  eu_central_1 = var.region == "eu-central-1" ? "602401143452.dkr.ecr.eu-central-1.amazonaws.com/" : ""
-  eu_north_1   = var.region == "eu-north-1" ? "602401143452.dkr.ecr.eu-north-1.amazonaws.com/" : ""
-  eu_south_1   = var.region == "eu-south-1" ? "590381155156.dkr.ecr.eu-south-1.amazonaws.com/" : ""
-  eu_west_1    = var.region == "eu-west-1" ? "602401143452.dkr.ecr.eu-west-1.amazonaws.com/" : ""
-  eu_west_2    = var.region == "eu-west-2" ? "602401143452.dkr.ecr.eu-west-2.amazonaws.com/" : ""
-  eu_west_3    = var.region == "eu-west-3" ? "602401143452.dkr.ecr.eu-west-3.amazonaws.com/" : ""
-  eu           = "${local.eu_central_1}${local.eu_north_1}${local.eu_south_1}${local.eu_west_1}${local.eu_west_2}${local.eu_west_3}"
-
-  me_south_1 = var.region == "me-south-1" ? "558608220178.dkr.ecr.me-south-1.amazonaws.com/" : ""
-  me         = local.me_south_1
-
-  sa_east_1 = var.region == "sa-east-1" ? "602401143452.dkr.ecr.sa-east-1.amazonaws.com/" : ""
-  sa        = local.sa_east_1
-
-  us_east_1     = var.region == "us-east-1" ? "602401143452.dkr.ecr.us-east-1.amazonaws.com/" : ""
-  us_east_2     = var.region == "us-east-2" ? "602401143452.dkr.ecr.us-east-2.amazonaws.com/" : ""
-  us_gov_east_1 = var.region == "us-gov-east-1" ? "151742754352.dkr.ecr.us-gov-east-1.amazonaws.com/" : ""
-  us_gov_west_1 = var.region == "us-gov-west-1" ? "013241004608.dkr.ecr.us-gov-west-1.amazonaws.com/" : ""
-  us_west_1     = var.region == "us-west-1" ? "602401143452.dkr.ecr.us-west-1.amazonaws.com/" : ""
-  us_west_2     = var.region == "us-west-2" ? "602401143452.dkr.ecr.us-west-2.amazonaws.com/" : ""
-  us            = "${local.us_east_1}${local.us_east_2}${local.us_gov_east_1}${local.us_gov_west_1}${local.us_west_1}${local.us_west_2}"
-
-  ecr = "${local.af}${local.ap}${local.ca}${local.cn}${local.eu}${local.me}${local.sa}${local.us}"
-
-
-  public_reg  = "public.ecr.aws"
-  src_reg     = format("%v/eks-distro/kubernetes-csi", local.public_reg)
-  account_ecr = "${data.aws_caller_identity.whoami.account_id}.dkr.ecr.${var.region}.amazonaws.com/${var.cluster_name}"
+local {
+  ecr_mapping_default = "602401143452"
+  ecr_mapping = {
+    "us-gov-east-1" = "151742754352"
+    "us-gov-west-1" = "013241004608"
+    "us-east-1"     = "602401143452"
+    "us-west-2"     = "602401143452"
+    "us-east-1"     = "602401143452"
+    "us-west-2"     = "602401143452"
+  }
+  public_ecr = format("%v.dkr.ecr.%v.amazonaws.com", lookup(local.ecr_mapping, local.region, local.ecr_mapping_default), local.region)
 }
+
+## # Populated from:
+## # https://docs.aws.amazon.com/eks/latest/userguide/add-ons-images.html
+## 
+## data "aws_caller_identity" "whoami" {}
+## 
+## locals {
+##   af_south_1 = (var.region == "af-south-1" ? "877085696533.dkr.ecr.af-south-1.amazonaws.com/" : "")
+##   af         = local.af_south_1
+## 
+##   ap_east_1      = var.region == "ap-east-1" ? "800184023465.dkr.ecr.ap-east-1.amazonaws.com/" : ""
+##   ap_northeast_1 = var.region == "ap-northeast-1" ? "602401143452.dkr.ecr.ap-northeast-1.amazonaws.com/" : ""
+##   ap_northeast_2 = var.region == "ap-northeast-2" ? "602401143452.dkr.ecr.ap-northeast-2.amazonaws.com/" : ""
+##   ap_northeast_3 = var.region == "ap-northeast-3" ? "602401143452.dkr.ecr.ap-northeast-3.amazonaws.com/" : ""
+##   ap_south_1     = var.region == "ap-south-1" ? "602401143452.dkr.ecr.ap-south-1.amazonaws.com/" : ""
+##   ap_southeast_1 = var.region == "ap-southeast-1" ? "602401143452.dkr.ecr.ap-southeast-1.amazonaws.com/" : ""
+##   ap_southeast_2 = var.region == "ap-southeast-2" ? "602401143452.dkr.ecr.ap-southeast-2.amazonaws.com/" : ""
+##   ap_1           = "${local.ap_east_1}${local.ap_northeast_1}${local.ap_northeast_2}${local.ap_northeast_3}${local.ap_south_1}"
+##   ap_2           = "${local.ap_southeast_1}${local.ap_southeast_2}"
+##   ap             = "${local.ap_1}${local.ap_2}"
+## 
+##   ca_central_1 = var.region == "ca-central-1" ? "602401143452.dkr.ecr.ca-central-1.amazonaws.com/" : ""
+##   ca           = local.ca_central_1
+## 
+##   cn_north_1     = var.region == "cn-north-1" ? "918309763551.dkr.ecr.cn-north-1.amazonaws.com.cn/" : ""
+##   cn_northwest_1 = var.region == "cn-northwest-1" ? "961992271922.dkr.ecr.cn-northwest-1.amazonaws.com.cn/" : ""
+##   cn             = "${local.cn_north_1}${local.cn_northwest_1}"
+## 
+##   eu_central_1 = var.region == "eu-central-1" ? "602401143452.dkr.ecr.eu-central-1.amazonaws.com/" : ""
+##   eu_north_1   = var.region == "eu-north-1" ? "602401143452.dkr.ecr.eu-north-1.amazonaws.com/" : ""
+##   eu_south_1   = var.region == "eu-south-1" ? "590381155156.dkr.ecr.eu-south-1.amazonaws.com/" : ""
+##   eu_west_1    = var.region == "eu-west-1" ? "602401143452.dkr.ecr.eu-west-1.amazonaws.com/" : ""
+##   eu_west_2    = var.region == "eu-west-2" ? "602401143452.dkr.ecr.eu-west-2.amazonaws.com/" : ""
+##   eu_west_3    = var.region == "eu-west-3" ? "602401143452.dkr.ecr.eu-west-3.amazonaws.com/" : ""
+##   eu           = "${local.eu_central_1}${local.eu_north_1}${local.eu_south_1}${local.eu_west_1}${local.eu_west_2}${local.eu_west_3}"
+## 
+##   me_south_1 = var.region == "me-south-1" ? "558608220178.dkr.ecr.me-south-1.amazonaws.com/" : ""
+##   me         = local.me_south_1
+## 
+##   sa_east_1 = var.region == "sa-east-1" ? "602401143452.dkr.ecr.sa-east-1.amazonaws.com/" : ""
+##   sa        = local.sa_east_1
+## 
+##   us_east_1     = var.region == "us-east-1" ? "602401143452.dkr.ecr.us-east-1.amazonaws.com/" : ""
+##   us_east_2     = var.region == "us-east-2" ? "602401143452.dkr.ecr.us-east-2.amazonaws.com/" : ""
+##   us_gov_east_1 = var.region == "us-gov-east-1" ? "151742754352.dkr.ecr.us-gov-east-1.amazonaws.com/" : ""
+##   us_gov_west_1 = var.region == "us-gov-west-1" ? "013241004608.dkr.ecr.us-gov-west-1.amazonaws.com/" : ""
+##   us_west_1     = var.region == "us-west-1" ? "602401143452.dkr.ecr.us-west-1.amazonaws.com/" : ""
+##   us_west_2     = var.region == "us-west-2" ? "602401143452.dkr.ecr.us-west-2.amazonaws.com/" : ""
+##   us            = "${local.us_east_1}${local.us_east_2}${local.us_gov_east_1}${local.us_gov_west_1}${local.us_west_1}${local.us_west_2}"
+## 
+##   ecr = "${local.af}${local.ap}${local.ca}${local.cn}${local.eu}${local.me}${local.sa}${local.us}"
+## 
+## 
+##   public_reg  = "public.ecr.aws"
+##   src_reg     = format("%v/eks-distro/kubernetes-csi", local.public_reg)
+##   account_ecr = "${data.aws_caller_identity.whoami.account_id}.dkr.ecr.${var.region}.amazonaws.com/${var.cluster_name}"
+## }
+## 
diff --git a/examples/full-cluster-tf-upgrade/1.25/efs/efs.tf b/examples/full-cluster-tf-upgrade/1.25/efs/efs.tf
@@ -4,9 +4,10 @@
 module "efs" {
   source = "git@github.e.it.census.gov:terraform-modules/aws-efs.git"
 
-  name            = var.cluster_name
-  vpc_id          = local.vpc_id
-  subnet_ids      = local.subnet_ids
+  name       = var.cluster_name
+  vpc_id     = local.vpc_id
+  subnet_ids = local.subnet_ids
+  ## consider changing this to the new extra_cluster_sg
   security_groups = [local.cluster_worker_sg_id]
   ##  subnet_ids      = local.cni_subnet_ids
   ##  security_groups = [local.cluster_cni_worker_sg_id]