Enhance Kubernetes provider configuration (cloudposse#119)

.github/CODEOWNERS

@@ -15,8 +15,8 @@
 
 # Cloud Posse must review any changes to standard context definition,
 # but some changes can be rubber-stamped.
-**/*.tf       @cloudposse/engineering @cloudposse/approvers
-README.yaml   @cloudposse/engineering @cloudposse/approvers
+**/*.tf       @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers
+README.yaml   @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers
 README.md     @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers
 docs/*.md     @cloudposse/engineering @cloudposse/contributors @cloudposse/approvers
 

.github/auto-release.yml

@@ -46,7 +46,7 @@ template: |
 
 replacers:
 # Remove irrelevant information from Renovate bot
-- search: '/---\s+^#.*Renovate configuration(?:.|\n)*?This PR has been generated .*/gm'
+- search: '/(?<=---\s+)+^#.*(Renovate configuration|Configuration)(?:.|\n)*?This PR has been generated .*/gm'
   replace: ''
 # Remove Renovate bot banner image
 - search: '/\[!\[[^\]]*Renovate\][^\]]*\](\([^)]*\))?\s*\n+/gm'

.github/workflows/auto-release.yml

@@ -3,7 +3,9 @@ name: auto-release
 on:
   push:
     branches:
+      - main
       - master
+      - production
 
 jobs:
   publish:
@@ -14,7 +16,7 @@ jobs:
         id: get-merged-pull-request
         with:
           github_token: ${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}
-      # Drafts your next Release notes as Pull Requests are merged into "master"
+      # Drafts your next Release notes as Pull Requests are merged into "main"
       - uses: release-drafter/release-drafter@v5
         if: "!contains(steps.get-merged-pull-request.outputs.labels, 'no-release')"
         with:

.github/workflows/validate-codeowners.yml

@@ -1,5 +1,7 @@
 name: Validate Codeowners
 on:
+  workflow_dispatch:
+
   pull_request:
 
 jobs:

auth.tf

@@ -27,6 +27,17 @@
 
 
 locals {
+  yaml_quote = var.aws_auth_yaml_strip_quotes ? "" : "\""
+
+  need_kubernetes_provider = local.enabled && var.apply_config_map_aws_auth
+
+  kubeconfig_path_enabled = local.need_kubernetes_provider && var.kubeconfig_path_enabled
+  kube_exec_auth_enabled  = local.kubeconfig_path_enabled ? false : local.need_kubernetes_provider && var.kube_exec_auth_enabled
+  kube_data_auth_enabled  = local.kube_exec_auth_enabled ? false : local.need_kubernetes_provider && var.kube_data_auth_enabled
+
+  exec_profile = local.kube_exec_auth_enabled && var.kube_exec_auth_aws_profile_enabled ? ["--profile", var.kube_exec_auth_aws_profile] : []
+  exec_role    = local.kube_exec_auth_enabled && var.kube_exec_auth_role_arn_enabled ? ["--role-arn", var.kube_exec_auth_role_arn] : []
+
   certificate_authority_data_list          = coalescelist(aws_eks_cluster.default.*.certificate_authority, [[{ data : "" }]])
   certificate_authority_data_list_internal = local.certificate_authority_data_list[0]
   certificate_authority_data_map           = local.certificate_authority_data_list_internal[0]
@@ -59,25 +70,43 @@ resource "null_resource" "wait_for_cluster" {
   }
 }
 
-data "aws_eks_cluster" "eks" {
-  count = local.enabled && var.apply_config_map_aws_auth ? 1 : 0
-  name  = join("", aws_eks_cluster.default.*.id)
-}
 
 # Get an authentication token to communicate with the EKS cluster.
 # By default (before other roles are added to the Auth ConfigMap), you can authenticate to EKS cluster only by assuming the role that created the cluster.
 # `aws_eks_cluster_auth` uses IAM credentials from the AWS provider to generate a temporary token.
 # If the AWS provider assumes an IAM role, `aws_eks_cluster_auth` will use the same IAM role to get the auth token.
 # https://www.terraform.io/docs/providers/aws/d/eks_cluster_auth.html
+#
+# You can set `kube_exec_auth_enabled` to use a different IAM Role or AWS config profile to fetch the auth token
+#
 data "aws_eks_cluster_auth" "eks" {
-  count = local.enabled && var.apply_config_map_aws_auth ? 1 : 0
+  count = local.kube_data_auth_enabled ? 1 : 0
   name  = join("", aws_eks_cluster.default.*.id)
 }
 
+
 provider "kubernetes" {
-  token                  = join("", data.aws_eks_cluster_auth.eks.*.token)
-  host                   = join("", data.aws_eks_cluster.eks.*.endpoint)
-  cluster_ca_certificate = base64decode(join("", data.aws_eks_cluster.eks.*.certificate_authority.0.data))
+  # Without a dummy API server configured, the provider will throw an error and prevent a "plan" from succeeding
+  # in situations where Terraform does not provide it with the cluster endpoint before triggering an API call.
+  # Since those situations are limited to ones where we do not care about the failure, such as fetching the
+  # ConfigMap before the cluster has been created or in preparation for deleting it, and the worst that will
+  # happen is that the aws-auth ConfigMap will be unnecessarily updated, it is just better to ignore the error
+  # so we can proceed with the task of creating or destroying the cluster.
+  #
+  # If this solution bothers you, you can disable it by setting var.dummy_kubeapi_server = null
+  host                   = local.enabled ? coalesce(aws_eks_cluster.default[0].endpoint, var.dummy_kubeapi_server) : var.dummy_kubeapi_server
+  cluster_ca_certificate = local.enabled ? base64decode(local.certificate_authority_data) : null
+  token                  = local.kube_data_auth_enabled ? data.aws_eks_cluster_auth.eks[0].token : null
+  config_path            = local.kubeconfig_path_enabled ? var.kubeconfig_path : null
+
+  dynamic "exec" {
+    for_each = local.kube_exec_auth_enabled ? ["exec"] : []
+    content {
+      api_version = "client.authentication.k8s.io/v1alpha1"
+      command     = "aws"
+      args        = concat(local.exec_profile, ["eks", "get-token", "--cluster-name", aws_eks_cluster.default[0].id], local.exec_role)
+    }
+  }
 }
 
 resource "kubernetes_config_map" "aws_auth_ignore_changes" {
@@ -110,8 +139,8 @@ resource "kubernetes_config_map" "aws_auth" {
   }
 
   data = {
-    mapRoles    = yamlencode(distinct(concat(local.map_worker_roles, var.map_additional_iam_roles)))
-    mapUsers    = yamlencode(var.map_additional_iam_users)
-    mapAccounts = yamlencode(var.map_additional_aws_accounts)
+    mapRoles    = replace(yamlencode(distinct(concat(var.map_additional_iam_roles, local.map_worker_roles))), "\"", local.yaml_quote)
+    mapUsers    = replace(yamlencode(var.map_additional_iam_users), "\"", local.yaml_quote)
+    mapAccounts = replace(yamlencode(var.map_additional_aws_accounts), "\"", local.yaml_quote)
   }
 }