diff --git a/.circleci/config.yml b/.circleci/config.yml index 2c4262b6..f5f51033 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -176,7 +176,7 @@ jobs: name: "Set module source to latest published release" working_directory: tests command: | - latest_release_tag="$(git tag --sort=-v:refname | head -1)" + latest_release_tag=$(jq -r '.tag_name' <(curl -sSfL -H "X-GitHub-Api-Version: 2022-11-28" -H "Accept: application/vnd.github+json" https://api.github.com/repos/dominodatalab/terraform-aws-eks/releases/latest)) export MOD_SOURCE="github.com/${CIRCLE_PROJECT_USERNAME}/${CIRCLE_PROJECT_REPONAME}.git?ref=${latest_release_tag}" echo "Latest published release tag is: ${latest_release_tag}" echo "Setting module source to: ${MOD_SOURCE}" diff --git a/.github/workflows/deploy-upgrade.yml b/.github/workflows/deploy-upgrade.yml index 7e3661c7..50239c23 100644 --- a/.github/workflows/deploy-upgrade.yml +++ b/.github/workflows/deploy-upgrade.yml @@ -7,14 +7,16 @@ jobs: steps: - name: Test-Deploy id: test-deploy-workflow - uses: CircleCI-Public/trigger-circleci-pipeline-action@v1.0.7 + uses: CircleCI-Public/trigger-circleci-pipeline-action@v1.1.0 env: CCI_TOKEN: ${{ secrets.CIRCLE_PERSONAL_TOKEN }} + TARGET_BRANCH: ${{ github.event.pull_request.head.ref }} test-upgrade: runs-on: ubuntu-latest steps: - name: Test-Module-Upgrade id: test-upgrade-workflow - uses: CircleCI-Public/trigger-circleci-pipeline-action@v1.0.7 + uses: CircleCI-Public/trigger-circleci-pipeline-action@v1.1.0 env: CCI_TOKEN: ${{ secrets.CIRCLE_PERSONAL_TOKEN }} + TARGET_BRANCH: ${{ github.event.pull_request.head.ref }} diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 4ee0355b..e48bf66e 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -76,4 +76,4 @@ repos: name: Check for hard coded AWS partition entry: ./bin/check-aws-partition.sh language: script - files: ".*" + exclude: "^(examples|bin)" diff --git a/README.md b/README.md index cf799fa7..8a2ff1e1 100644 --- a/README.md +++ b/README.md @@ -127,7 +127,7 @@ aws s3 rb s3://"${AWS_TERRAFORM_REMOTE_STATE_BUCKET}" --force | [default\_node\_groups](#input\_default\_node\_groups) | EKS managed node groups definition. | 
object(
    {
      compute = object(
        {
          ami                   = optional(string, null)
          bootstrap_extra_args  = optional(string, "")
          instance_types        = optional(list(string), ["m5.2xlarge"])
          spot                  = optional(bool, false)
          min_per_az            = optional(number, 0)
          max_per_az            = optional(number, 10)
          desired_per_az        = optional(number, 0)
          availability_zone_ids = list(string)
          labels = optional(map(string), {
            "dominodatalab.com/node-pool" = "default"
          })
          taints = optional(list(object({
            key    = string
            value  = optional(string)
            effect = string
          })), [])
          tags = optional(map(string), {})
          gpu  = optional(bool, null)
          volume = optional(object({
            size = optional(number, 1000)
            type = optional(string, "gp3")
            }), {
            size = 1000
            type = "gp3"
            }
          )
      }),
      platform = object(
        {
          ami                   = optional(string, null)
          bootstrap_extra_args  = optional(string, "")
          instance_types        = optional(list(string), ["m5.2xlarge"])
          spot                  = optional(bool, false)
          min_per_az            = optional(number, 1)
          max_per_az            = optional(number, 10)
          desired_per_az        = optional(number, 1)
          availability_zone_ids = list(string)
          labels = optional(map(string), {
            "dominodatalab.com/node-pool" = "platform"
          })
          taints = optional(list(object({
            key    = string
            value  = optional(string)
            effect = string
          })), [])
          tags = optional(map(string), {})
          gpu  = optional(bool, null)
          volume = optional(object({
            size = optional(number, 100)
            type = optional(string, "gp3")
            }), {
            size = 100
            type = "gp3"
            }
          )
      }),
      gpu = object(
        {
          ami                   = optional(string, null)
          bootstrap_extra_args  = optional(string, "")
          instance_types        = optional(list(string), ["g4dn.xlarge"])
          spot                  = optional(bool, false)
          min_per_az            = optional(number, 0)
          max_per_az            = optional(number, 10)
          desired_per_az        = optional(number, 0)
          availability_zone_ids = list(string)
          labels = optional(map(string), {
            "dominodatalab.com/node-pool" = "default-gpu"
            "nvidia.com/gpu"              = true
          })
          taints = optional(list(object({
            key    = string
            value  = optional(string)
            effect = string
            })), [{
            key    = "nvidia.com/gpu"
            value  = "true"
            effect = "NO_SCHEDULE"
            }
          ])
          tags = optional(map(string), {})
          gpu  = optional(bool, null)
          volume = optional(object({
            size = optional(number, 1000)
            type = optional(string, "gp3")
            }), {
            size = 1000
            type = "gp3"
            }
          )
      })
  })
| n/a | yes | | [deploy\_id](#input\_deploy\_id) | Domino Deployment ID. | `string` | `"domino-eks"` | no | | [eks](#input\_eks) | k8s\_version = "EKS cluster k8s version."
kubeconfig = {
extra\_args = "Optional extra args when generating kubeconfig."
path = "Fully qualified path name to write the kubeconfig file."
}
public\_access = {
enabled = "Enable EKS API public endpoint."
cidrs = "List of CIDR ranges permitted for accessing the EKS public endpoint."
}
"Custom role maps for aws auth configmap"
custom\_role\_maps = {
rolearn = string
username = string
groups = list(string)
}
master\_role\_names = "IAM role names to be added as masters in eks."
cluster\_addons = "EKS cluster addons. vpc-cni is installed separately."
vpc\_cni = Configuration for AWS VPC CNI
ssm\_log\_group\_name = "CloudWatch log group to send the SSM session logs to."
identity\_providers = "Configuration for IDP(Identity Provider)."
} | 
object({
    k8s_version = optional(string, "1.25")
    kubeconfig = optional(object({
      extra_args = optional(string, "")
      path       = optional(string, "kubeconfig")
    }), {})
    public_access = optional(object({
      enabled = optional(bool, false)
      cidrs   = optional(list(string), [])
    }), {})
    custom_role_maps = optional(list(object({
      rolearn  = string
      username = string
      groups   = list(string)
    })), [])
    master_role_names  = optional(list(string), [])
    cluster_addons     = optional(list(string), ["kube-proxy", "coredns"])
    ssm_log_group_name = optional(string, "session-manager")
    vpc_cni = optional(object({
      prefix_delegation = optional(bool)
    }))
    identity_providers = optional(list(object({
      client_id                     = string
      groups_claim                  = optional(string, null)
      groups_prefix                 = optional(string, null)
      identity_provider_config_name = string
      issuer_url                    = optional(string, null)
      required_claims               = optional(string, null)
      username_claim                = optional(string, null)
      username_prefix               = optional(string, null)
    })), [])
  })
| `{}` | no | -| [kms](#input\_kms) | enabled = "Toggle,if set use either the specified KMS key\_id or a Domino-generated one"
key\_id = optional(string, null) | 
object({
    enabled = optional(bool, true)
    key_id  = optional(string, null)
  })
| `{}` | no | +| [kms](#input\_kms) | enabled = "Toggle, if set use either the specified KMS key\_id or a Domino-generated one"
key\_id = optional(string, null)
additional\_policies = "Allows setting additional KMS key policies when using a Domino-generated key" | 
object({
    enabled             = optional(bool, true)
    key_id              = optional(string, null)
    additional_policies = optional(list(string), [])
  })
| `{}` | no | | [network](#input\_network) | vpc = {
id = Existing vpc id, it will bypass creation by this module.
subnets = {
private = Existing private subnets.
public = Existing public subnets.
pod = Existing pod subnets.
}), {})
}), {})
network\_bits = {
public = Number of network bits to allocate to the public subnet. i.e /27 -> 32 IPs.
private = Number of network bits to allocate to the private subnet. i.e /19 -> 8,192 IPs.
pod = Number of network bits to allocate to the private subnet. i.e /19 -> 8,192 IPs.
}
cidrs = {
vpc = The IPv4 CIDR block for the VPC.
pod = The IPv4 CIDR block for the Pod subnets.
}
use\_pod\_cidr = Use additional pod CIDR range (ie 100.64.0.0/16) for pod networking. | 
object({
    vpc = optional(object({
      id = optional(string, null)
      subnets = optional(object({
        private = optional(list(string), [])
        public  = optional(list(string), [])
        pod     = optional(list(string), [])
      }), {})
    }), {})
    network_bits = optional(object({
      public  = optional(number, 27)
      private = optional(number, 19)
      pod     = optional(number, 19)
      }
    ), {})
    cidrs = optional(object({
      vpc = optional(string, "10.0.0.0/16")
      pod = optional(string, "100.64.0.0/16")
    }), {})
    use_pod_cidr = optional(bool, true)
  })
| `{}` | no | | [region](#input\_region) | AWS region for the deployment | `string` | n/a | yes | | [route53\_hosted\_zone\_name](#input\_route53\_hosted\_zone\_name) | Optional hosted zone for External DNS zone. | `string` | `null` | no | diff --git a/bin/check-aws-partition.sh b/bin/check-aws-partition.sh index 900d2c68..e04c67ed 100755 --- a/bin/check-aws-partition.sh +++ b/bin/check-aws-partition.sh @@ -5,7 +5,7 @@ exec 1>&2 check_aws_partition() { declare -A failed_files - for file in $(git ls-files | grep -v "check-aws-partition.sh"); do + for file in "$@"; do if grep -q "arn:aws" "${file}"; then failed_files["${file}"]=1 fi @@ -22,6 +22,6 @@ check_aws_partition() { } -check_aws_partition +check_aws_partition "$@" exit_code=$? exit $exit_code diff --git a/examples/kms-additional-policy/README.md b/examples/kms-additional-policy/README.md new file mode 100644 index 00000000..c30c660e --- /dev/null +++ b/examples/kms-additional-policy/README.md @@ -0,0 +1,52 @@ +# Adds a custom KMS key policy + +### Provide full path for existing ssh key: `ssh_pvt_key_path` +### Otherwise generate using: +```bash +ssh-keygen -q -P '' -t rsa -b 4096 -m PEM -f domino.pem +``` +### Add a custom KMS key policy + +```hcl + kms = { + additional_policies = [file("${path.module}/kms-policy.json")] + } +``` + + + +## Requirements + +| Name | Version | +|------|---------| +| [terraform](#requirement\_terraform) | >= 1.4.0 | +| [aws](#requirement\_aws) | >= 4.0 | +| [local](#requirement\_local) | >= 2.2.0 | +| [tls](#requirement\_tls) | >= 3.4.0 | + +## Providers + +No providers. + +## Modules + +| Name | Source | Version | +|------|--------|---------| +| [domino\_eks](#module\_domino\_eks) | ./../.. | n/a | + +## Resources + +No resources. + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [region](#input\_region) | AWS region for deployment. | `string` | `"us-west-2"` | no | + +## Outputs + +| Name | Description | +|------|-------------| +| [domino\_eks](#output\_domino\_eks) | Module domino\_eks output | + diff --git a/examples/kms-additional-policy/kms-policy.json b/examples/kms-additional-policy/kms-policy.json new file mode 100644 index 00000000..2f9ee3da --- /dev/null +++ b/examples/kms-additional-policy/kms-policy.json @@ -0,0 +1,12 @@ +{ + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "AllowAll", + "Effect": "Allow", + "Principal": "arn:aws:iam::123457890:root", + "Action": ["kms:Decrypt"], + "Resource": "*" + } + ] +} diff --git a/examples/kms-additional-policy/main.tf b/examples/kms-additional-policy/main.tf new file mode 100644 index 00000000..2880e45e --- /dev/null +++ b/examples/kms-additional-policy/main.tf @@ -0,0 +1,21 @@ +module "domino_eks" { + source = "./../.." + region = var.region + ssh_pvt_key_path = "./../examples.pem" + deploy_id = "dominoeks007" + bastion = {} + default_node_groups = { + compute = { + availability_zone_ids = ["usw2-az1", "usw2-az2"] + } + platform = { + availability_zone_ids = ["usw2-az1", "usw2-az2"] + } + gpu = { + availability_zone_ids = ["usw2-az1", "usw2-az2"] + } + } + kms = { + additional_policies = [file("${path.module}/kms-policy.json")] + } +} diff --git a/examples/kms-additional-policy/outputs.tf b/examples/kms-additional-policy/outputs.tf new file mode 100644 index 00000000..99ed4cdb --- /dev/null +++ b/examples/kms-additional-policy/outputs.tf @@ -0,0 +1,4 @@ +output "domino_eks" { + description = "Module domino_eks output" + value = module.domino_eks +} diff --git a/examples/kms-additional-policy/variables.tf b/examples/kms-additional-policy/variables.tf new file mode 100644 index 00000000..b78602f5 --- /dev/null +++ b/examples/kms-additional-policy/variables.tf @@ -0,0 +1,5 @@ +variable "region" { + description = "AWS region for deployment." + type = string + default = "us-west-2" +} diff --git a/examples/kms-additional-policy/versions.tf b/examples/kms-additional-policy/versions.tf new file mode 100644 index 00000000..308816cb --- /dev/null +++ b/examples/kms-additional-policy/versions.tf @@ -0,0 +1,21 @@ +terraform { + required_version = ">= 1.4.0" + required_providers { + aws = { + source = "hashicorp/aws" + version = ">= 4.0" + } + local = { + source = "hashicorp/local" + version = ">= 2.2.0" + } + tls = { + source = "hashicorp/tls" + version = ">= 3.4.0" + } + } +} + +provider "aws" { + region = var.region +} diff --git a/examples/tf-plan-test.sh b/examples/tf-plan-test.sh index 8032f125..489a5726 100755 --- a/examples/tf-plan-test.sh +++ b/examples/tf-plan-test.sh @@ -17,7 +17,7 @@ verify_terraform() { tf_plan() { local dir="${1}" - terraform -chdir="$dir" init + terraform -chdir="$dir" init -upgrade terraform -chdir="$dir" plan if [ "$?" != "0" ]; then diff --git a/kms.tf b/kms.tf index 4c5b39b1..d494db1c 100644 --- a/kms.tf +++ b/kms.tf @@ -4,6 +4,9 @@ locals { data "aws_iam_policy_document" "kms_key_global" { count = local.create_kms_key + + override_policy_documents = var.kms.additional_policies + statement { actions = [ "kms:Create*", diff --git a/variables.tf b/variables.tf index 3aeabfb4..25ef3c62 100644 --- a/variables.tf +++ b/variables.tf @@ -353,13 +353,15 @@ variable "storage" { variable "kms" { description = <