Skip to content

Commit 898be18

Browse files
matihostmatihost
committed
feat: prepare aws-eks to EUSC AWS partition, migrate Terragrunt cli usage
1 parent d99a259 commit 898be18

File tree

20 files changed

+219
-50
lines changed

20 files changed

+219
-50
lines changed

‎.pre-commit-config.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ repos:
103103
additional_dependencies:
104104
- .[community,yamllint]
105105
- repo: https://github.com/astral-sh/ruff-pre-commit
106-
rev: v0.14.11
106+
rev: v0.15.0
107107
hooks:
108108
- id: ruff # python linter
109109
args: [ --fix ]

‎ansible/system/inventory/inventory.yml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,6 @@ all:
6060
foxundermoon.shell-format
6161
garytyler.darcula-pycharm
6262
george-alisson.html-preview-vscode
63-
github.copilot
6463
github.copilot-chat
6564
github.vscode-github-actions
6665
github.vscode-pull-request-github

‎k8s/apps/echoserver/stage/eks/Makefile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
NS := learning
22
APP := echoserver
3-
CN := $(APP).$(NS).us-east-1.dev.aws.testing
3+
CN := $(APP).$(NS).$(shell kubectl config current-context | cut -d: -f4).dev.aws.testing
44

55
k8s:
6-
@kubectl config current-context | grep -q "aws:eks" || { echo "Not logged to AKS cluster"; exit 1; }
6+
@kubectl config current-context | grep -q ":eks:" || { echo "Not logged to EKS cluster"; exit 1; }
77
@kubectl config set-context --current --namespace $(NS)
88

99

‎k8s/apps/echoserver/stage/eks/deploy.sh‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,15 @@
11
#!/usr/bin/env bash
22
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null && pwd)"
33

4-
CN="echoserver.learning.us-east-1.dev.aws.testing"
4+
[[ "$(kubectl config current-context)" == *":eks:"* ]] || echo "Not logged to EKS cluster" && {
5+
REGION="$(kubectl config current-context | cut -d: -f4)"
6+
CN="echoserver.learning.${REGION}.dev.aws.testing"
57

6-
[[ "$(kubectl config current-context)" == *"aws:eks"* ]] || echo "Not logged to EKS cluster" && {
78
kubectl config set-context --current --namespace learning
89
[ -e "/tmp/${CN}.key" ] || {
910
openssl req -x509 -sha256 -nodes -days 365 -subj "/CN=${CN}" -newkey rsa:2048 -keyout "/tmp/${CN}.key" -out "/tmp/${CN}.crt"
1011
}
11-
helm upgrade --install echoserver "$(dirname "${SCRIPT_DIR}")" -n learning --set ingress.tls.crt="$(base64 -w 0 /tmp/${CN}.crt)" --set ingress.tls.key="$(base64 -w 0 /tmp/${CN}.key)" \
12+
helm upgrade --install echoserver "$(dirname "${SCRIPT_DIR}")" -n learning --set ingress.tls.crt="$(base64 -w 0 "/tmp/${CN}.crt")" --set ingress.tls.key="$(base64 -w 0 "/tmp/${CN}.key")" \
1213
--set ingress.host="${CN}" \
1314
--set networkPolicy.enabled=false \
1415
--set ingress.class=nginx

‎terraform/aws/aws-eks/Makefile‎

Lines changed: 18 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -4,34 +4,40 @@ SHELL := /usr/bin/env bash
44
DEBUG := false
55
ifeq ($(strip $(DEBUG)),true)
66
TF_LOG := DEBUG
7-
TG_FLAGS := --terragrunt-debug
7+
TG_FLAGS := --inputs-debug
88
endif
99

1010
MODE := apply
1111
ifeq ($(strip $(MODE)),apply)
12-
MODE_STR := apply -auto-approve
12+
MODE_STR := --non-interactive -- apply -auto-approve
1313
K8S_MODE_STR := apply
1414
else ifeq ($(strip $(MODE)),destroy)
15-
MODE_STR := destroy -auto-approve
15+
MODE_STR := --non-interactive -- destroy -auto-approve
1616
K8S_MODE_STR := delete
1717
else
18-
MODE_STR := plan
18+
MODE_STR := --non-interactive -- plan
1919
K8S_MODE_STR := get
2020
endif
2121

22+
PARTITION := aws
2223

2324
ENV := dev
2425

25-
init:
26-
cd stage/$(ENV) && terragrunt init -upgrade=true --backend-bootstrap --non-interactive
26+
ifeq ($(strip $(PARTITION)),eusc)
27+
DEPLOY_PATH := stage/eusc/$(ENV)
28+
else
29+
DEPLOY_PATH := stage/$(ENV)
30+
endif
2731

32+
init:
33+
cd $(DEPLOY_PATH) && terragrunt run -- init -upgrade=true
2834

29-
run: init ## setup VPC: make run [ENV=dev] [MODE=apply]
30-
@cd stage/$(ENV) && terragrunt validate && terragrunt $(MODE_STR) --non-interactive $(TG_FLAGS)
35+
run: init ## setup EKS: make run [ENV=dev] [MODE=apply]
36+
@cd $(DEPLOY_PATH) && terragrunt run validate && terragrunt run $(MODE_STR) $(TG_FLAGS)
3137

3238

3339
kubeconfig: ## generate kubeconfig entry for EKS cluster
34-
aws eks --region $(shell cd stage/$(ENV) && terragrunt output -raw region) update-kubeconfig --name $(shell cd stage/$(ENV) && terragrunt output -raw cluster_name)
40+
aws eks --region $(shell cd $(DEPLOY_PATH)&& terragrunt output -raw region) update-kubeconfig --name $(shell cd $(DEPLOY_PATH)&& terragrunt output -raw cluster_name)
3541

3642
oidc-test: ## test OIDC setup and provide instructions to update ~/.kube/config to use it
3743
ifndef ISSUER_URL
@@ -76,19 +82,18 @@ test: ## install test application, make test [MODE=apply] [FARGATE=true] [APP=a
7682

7783

7884
list-pod-identity-associations: ## list Pod Identity Associations
79-
aws eks list-pod-identity-associations --cluster-name $(shell cd stage/$(ENV) && terragrunt output -raw cluster_name) --region $(shell cd stage/$(ENV) && terragrunt output -raw region)
85+
aws eks list-pod-identity-associations --cluster-name $(shell cd $(DEPLOY_PATH)&& terragrunt output -raw cluster_name) --region $(shell cd $(DEPLOY_PATH)&& terragrunt output -raw region)
8086

8187
show-state: ## show state
82-
cd stage/$(ENV) && terragrunt state list && terragrunt show
88+
cd $(DEPLOY_PATH)&& terragrunt state list && terragrunt show
8389

8490
clean: ## clean cached plugins and data
8591
find . -name ".terra*" -exec rm -rf {} +
8692
find . -name "target" -exec rm -rf {} +
8793

8894
upgrade-providers-version: init
8995

90-
9196
help: ## show usage and tasks (default)
9297
@eval $$(sed -E -n 's/^([\*\.a-zA-Z0-9_-]+):.*?## (.*)$$/printf "\\033[36m%-30s\\033[0m %s\\n" "\1" "\2" ;/; ta; b; :a p' $(MAKEFILE_LIST))
9398
.DEFAULT_GOAL := help
94-
.PHONY: help run clean test
99+
.PHONY: help run clean

‎terraform/aws/aws-eks/module/backup.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ resource "aws_iam_policy" "velero-policy" {
8484
"s3:ListMultipartUploadParts"
8585
],
8686
"Resource": [
87-
"arn:aws:s3:::${aws_s3_bucket.backup.bucket}/*"
87+
"arn:${var.partition}:s3:::${aws_s3_bucket.backup.bucket}/*"
8888
]
8989
},
9090
{
@@ -93,7 +93,7 @@ resource "aws_iam_policy" "velero-policy" {
9393
"s3:ListBucket"
9494
],
9595
"Resource": [
96-
"arn:aws:s3:::${aws_s3_bucket.backup.bucket}"
96+
"arn:${var.partition}:s3:::${aws_s3_bucket.backup.bucket}"
9797
]
9898
}
9999
]

‎terraform/aws/aws-eks/module/configure-cluster.sh‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
#!/usr/bin/env bash
2-
3-
ACCOUNT_ID="${1:?ACCOUNT_ID is required}"
4-
CLUSTER_NAME="${2:?CLUSTER_NAME is required}"
5-
REGION="${3:?REGION is required}"
6-
NAMESPACES="${4:?NAMESPACES is required}"
7-
INSTALL_NGINX="${5:-false}"
8-
DATADOG_API_KEY="${6:-}"
9-
DATADOG_APP_KEY="${7:-}"
2+
AWS_PARTITION="${1:?AWS_PARTITION is required}"
3+
ACCOUNT_ID="${2:?ACCOUNT_ID is required}"
4+
CLUSTER_NAME="${3:?CLUSTER_NAME is required}"
5+
REGION="${4:?REGION is required}"
6+
NAMESPACES="${5:?NAMESPACES is required}"
7+
INSTALL_NGINX="${6:-false}"
8+
DATADOG_API_KEY="${7:-}"
9+
DATADOG_APP_KEY="${8:-}"
1010

1111
set -e
1212
set -x
@@ -42,6 +42,7 @@ function configure-namespaces() {
4242
helm upgrade --install "ns-${NS}-config" -n cluster-config --create-namespace "${DIRNAME}/namespace-config-chart" \
4343
--set namespace="${NS}" \
4444
--set aws.accountId="${ACCOUNT_ID}" \
45+
--set aws.partition="${AWS_PARTITION}" \
4546
--set irsaRole="${IRSA_ROLE}" \
4647
--set-json quota="$(echo "${QUOTA}" | jq -r)"
4748
done
@@ -181,7 +182,7 @@ function ensure-backup() {
181182
--set configuration.volumeSnapshotLocation[0].name="default" \
182183
--set configuration.volumeSnapshotLocation[0].provider="aws" \
183184
--set configuration.volumeSnapshotLocation[0].config.region="${REGION}" \
184-
--set serviceAccount.server.annotations."eks\\.amazonaws\\.com/role-arn"="arn:aws:iam::${ACCOUNT_ID}:role/${CLUSTER_NAME}-velero-irsa"
185+
--set serviceAccount.server.annotations."eks\\.amazonaws\\.com/role-arn"="arn:${AWS_PARTITION}:iam::${ACCOUNT_ID}:role/${CLUSTER_NAME}-velero-irsa"
185186

186187
for NAMESPACE in $(echo "${NAMESPACES}" | jq -cr '.[]'); do
187188

‎terraform/aws/aws-eks/module/eks-addons.tf‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,11 @@ resource "aws_eks_addon" "snapshot-controller" {
2828

2929
# https://docs.aws.amazon.com/eks/latest/userguide/workloads-add-ons-available-eks.html#add-ons-aws-efs-csi-driver
3030
resource "aws_eks_addon" "efs" {
31+
count = var.install_efs ? "1" : "0"
32+
3133
cluster_name = aws_eks_cluster.cluster.name
3234
addon_name = "aws-efs-csi-driver"
33-
# addon_version = "v2.1.9-eksbuild.1"
35+
# addon_version = "v2.3.0-eksbuild.1"
3436
resolve_conflicts_on_create = "OVERWRITE"
3537

3638
pod_identity_association {
@@ -83,7 +85,7 @@ resource "aws_iam_role" "efs-addon" {
8385

8486

8587
resource "aws_iam_role_policy_attachment" "efs-addon_AmazonEFSCSIDriverPolicy" {
86-
policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy"
88+
policy_arn = "arn:${var.partition}:iam::aws:policy/service-role/AmazonEFSCSIDriverPolicy"
8789
role = aws_iam_role.efs-addon.name
8890
}
8991

‎terraform/aws/aws-eks/module/eks.tf‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -159,19 +159,19 @@ EOF
159159
}
160160

161161
resource "aws_iam_role_policy_attachment" "node_AmazonEKSWorkerNodeMinimalPolicy" {
162-
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSWorkerNodeMinimalPolicy"
162+
policy_arn = "arn:${var.partition}:iam::aws:policy/AmazonEKSWorkerNodeMinimalPolicy"
163163
role = aws_iam_role.node.name
164164
}
165165

166166
# to download images from this account ECR
167167
resource "aws_iam_role_policy_attachment" "node_AmazonEC2ContainerRegistryPullOnly" {
168-
policy_arn = "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPullOnly"
168+
policy_arn = "arn:${var.partition}:iam::aws:policy/AmazonEC2ContainerRegistryPullOnly"
169169
role = aws_iam_role.node.name
170170
}
171171

172172
# To be able to install Cloud Watch EKS Addons with access to all metrics
173173
resource "aws_iam_role_policy_attachment" "node_CloudWatchAgentServerPolicy" {
174-
policy_arn = "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy"
174+
policy_arn = "arn:${var.partition}:iam::aws:policy/CloudWatchAgentServerPolicy"
175175
role = aws_iam_role.node.name
176176
}
177177

@@ -196,27 +196,27 @@ resource "aws_iam_role" "cluster" {
196196
}
197197

198198
resource "aws_iam_role_policy_attachment" "cluster_AmazonEKSClusterPolicy" {
199-
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSClusterPolicy"
199+
policy_arn = "arn:${var.partition}:iam::aws:policy/AmazonEKSClusterPolicy"
200200
role = aws_iam_role.cluster.name
201201
}
202202

203203
resource "aws_iam_role_policy_attachment" "cluster_AmazonEKSComputePolicy" {
204-
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSComputePolicy"
204+
policy_arn = "arn:${var.partition}:iam::aws:policy/AmazonEKSComputePolicy"
205205
role = aws_iam_role.cluster.name
206206
}
207207

208208
resource "aws_iam_role_policy_attachment" "cluster_AmazonEKSBlockStoragePolicy" {
209-
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSBlockStoragePolicy"
209+
policy_arn = "arn:${var.partition}:iam::aws:policy/AmazonEKSBlockStoragePolicy"
210210
role = aws_iam_role.cluster.name
211211
}
212212

213213
resource "aws_iam_role_policy_attachment" "cluster_AmazonEKSLoadBalancingPolicy" {
214-
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSLoadBalancingPolicy"
214+
policy_arn = "arn:${var.partition}:iam::aws:policy/AmazonEKSLoadBalancingPolicy"
215215
role = aws_iam_role.cluster.name
216216
}
217217

218218
resource "aws_iam_role_policy_attachment" "cluster_AmazonEKSNetworkingPolicy" {
219-
policy_arn = "arn:aws:iam::aws:policy/AmazonEKSNetworkingPolicy"
219+
policy_arn = "arn:${var.partition}:iam::aws:policy/AmazonEKSNetworkingPolicy"
220220
role = aws_iam_role.cluster.name
221221
}
222222

@@ -226,7 +226,7 @@ resource "null_resource" "cluster-config" {
226226
always_run = timestamp()
227227
}
228228
provisioner "local-exec" {
229-
command = "${path.module}/configure-cluster.sh '${local.account_id}' '${aws_eks_cluster.cluster.name}' '${var.region}' '${jsonencode(var.namespaces)}' '${var.install_nginx}' '${nonsensitive(var.dd_api_key)}' '${nonsensitive(var.dd_app_key)}'"
229+
command = "${path.module}/configure-cluster.sh '${var.partition}' '${local.account_id}' '${aws_eks_cluster.cluster.name}' '${var.region}' '${jsonencode(var.namespaces)}' '${var.install_nginx}' '${nonsensitive(var.dd_api_key)}' '${nonsensitive(var.dd_app_key)}'"
230230
}
231231

232232
depends_on = [

‎terraform/aws/aws-eks/module/external-dns.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ resource "aws_iam_policy" "externaldns" {
1414
"route53:ChangeResourceRecordSets"
1515
],
1616
"Resource": [
17-
"arn:aws:route53:::hostedzone/*"
17+
"arn:${var.partition}:route53:::hostedzone/*"
1818
]
1919
},
2020
{

0 commit comments

Comments
 (0)
⚡