Allow service role to be passed in (cloudposse#116)

* allow the eks service role to be passed in instead of created

Co-authored-by: Andriy Knysh <[email protected]>
Co-authored-by: Ben Leibig <[email protected]>
Co-authored-by: Ben Leibig <[email protected]>
Co-authored-by: devslx <[email protected]>

README.md

@@ -444,6 +444,7 @@ Available targets:
 | <a name="input_cluster_log_retention_period"></a> [cluster\_log\_retention\_period](#input\_cluster\_log\_retention\_period) | Number of days to retain cluster logs. Requires `enabled_cluster_log_types` to be set. See https://docs.aws.amazon.com/en_us/eks/latest/userguide/control-plane-logs.html. | `number` | `0` | no |
 | <a name="input_context"></a> [context](#input\_context) | Single object for setting entire context at once.<br>See description of individual variables for details.<br>Leave string and numeric variables as `null` to use default value.<br>Individual variable settings (non-null) override settings in context object,<br>except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | <pre>{<br>  "additional_tag_map": {},<br>  "attributes": [],<br>  "delimiter": null,<br>  "enabled": true,<br>  "environment": null,<br>  "id_length_limit": null,<br>  "label_key_case": null,<br>  "label_order": [],<br>  "label_value_case": null,<br>  "name": null,<br>  "namespace": null,<br>  "regex_replace_chars": null,<br>  "stage": null,<br>  "tags": {}<br>}</pre> | no |
 | <a name="input_delimiter"></a> [delimiter](#input\_delimiter) | Delimiter to be used between `namespace`, `environment`, `stage`, `name` and `attributes`.<br>Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no |
+| <a name="input_eks_cluster_service_role_arn"></a> [eks\_cluster\_service\_role\_arn](#input\_eks\_cluster\_service\_role\_arn) | The ARN of an externally created EKS service role to use, or leave blank to create one | `string` | `null` | no |
 | <a name="input_enabled"></a> [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no |
 | <a name="input_enabled_cluster_log_types"></a> [enabled\_cluster\_log\_types](#input\_enabled\_cluster\_log\_types) | A list of the desired control plane logging to enable. For more information, see https://docs.aws.amazon.com/en_us/eks/latest/userguide/control-plane-logs.html. Possible values [`api`, `audit`, `authenticator`, `controllerManager`, `scheduler`] | `list(string)` | `[]` | no |
 | <a name="input_endpoint_private_access"></a> [endpoint\_private\_access](#input\_endpoint\_private\_access) | Indicates whether or not the Amazon EKS private API server endpoint is enabled. Default to AWS EKS resource and it is false | `bool` | `false` | no |

docs/terraform.md

@@ -67,6 +67,7 @@
 | <a name="input_cluster_log_retention_period"></a> [cluster\_log\_retention\_period](#input\_cluster\_log\_retention\_period) | Number of days to retain cluster logs. Requires `enabled_cluster_log_types` to be set. See https://docs.aws.amazon.com/en_us/eks/latest/userguide/control-plane-logs.html. | `number` | `0` | no |
 | <a name="input_context"></a> [context](#input\_context) | Single object for setting entire context at once.<br>See description of individual variables for details.<br>Leave string and numeric variables as `null` to use default value.<br>Individual variable settings (non-null) override settings in context object,<br>except for attributes, tags, and additional\_tag\_map, which are merged. | `any` | <pre>{<br>  "additional_tag_map": {},<br>  "attributes": [],<br>  "delimiter": null,<br>  "enabled": true,<br>  "environment": null,<br>  "id_length_limit": null,<br>  "label_key_case": null,<br>  "label_order": [],<br>  "label_value_case": null,<br>  "name": null,<br>  "namespace": null,<br>  "regex_replace_chars": null,<br>  "stage": null,<br>  "tags": {}<br>}</pre> | no |
 | <a name="input_delimiter"></a> [delimiter](#input\_delimiter) | Delimiter to be used between `namespace`, `environment`, `stage`, `name` and `attributes`.<br>Defaults to `-` (hyphen). Set to `""` to use no delimiter at all. | `string` | `null` | no |
+| <a name="input_eks_cluster_service_role_arn"></a> [eks\_cluster\_service\_role\_arn](#input\_eks\_cluster\_service\_role\_arn) | The ARN of an externally created EKS service role to use, or leave blank to create one | `string` | `null` | no |
 | <a name="input_enabled"></a> [enabled](#input\_enabled) | Set to false to prevent the module from creating any resources | `bool` | `null` | no |
 | <a name="input_enabled_cluster_log_types"></a> [enabled\_cluster\_log\_types](#input\_enabled\_cluster\_log\_types) | A list of the desired control plane logging to enable. For more information, see https://docs.aws.amazon.com/en_us/eks/latest/userguide/control-plane-logs.html. Possible values [`api`, `audit`, `authenticator`, `controllerManager`, `scheduler`] | `list(string)` | `[]` | no |
 | <a name="input_endpoint_private_access"></a> [endpoint\_private\_access](#input\_endpoint\_private\_access) | Indicates whether or not the Amazon EKS private API server endpoint is enabled. Default to AWS EKS resource and it is false | `bool` | `false` | no |

iam.tf

@@ -12,22 +12,28 @@ data "aws_iam_policy_document" "assume_role" {
   }
 }
 
+locals {
+  eks_service_role = var.eks_cluster_service_role_arn != null ? var.eks_cluster_service_role_arn : join("", aws_iam_role.default.*.arn)
+
+  create_eks_service_role = local.enabled && var.eks_cluster_service_role_arn == null
+}
+
 resource "aws_iam_role" "default" {
-  count                = local.enabled ? 1 : 0
+  count                = local.create_eks_service_role ? 1 : 0
   name                 = module.label.id
   assume_role_policy   = join("", data.aws_iam_policy_document.assume_role.*.json)
   tags                 = module.label.tags
   permissions_boundary = var.permissions_boundary
 }
 
 resource "aws_iam_role_policy_attachment" "amazon_eks_cluster_policy" {
-  count      = local.enabled ? 1 : 0
+  count      = local.create_eks_service_role ? 1 : 0
   policy_arn = format("arn:%s:iam::aws:policy/AmazonEKSClusterPolicy", join("", data.aws_partition.current.*.partition))
   role       = join("", aws_iam_role.default.*.name)
 }
 
 resource "aws_iam_role_policy_attachment" "amazon_eks_service_policy" {
-  count      = local.enabled ? 1 : 0
+  count      = local.create_eks_service_role ? 1 : 0
   policy_arn = format("arn:%s:iam::aws:policy/AmazonEKSServicePolicy", join("", data.aws_partition.current.*.partition))
   role       = join("", aws_iam_role.default.*.name)
 }
@@ -37,7 +43,7 @@ resource "aws_iam_role_policy_attachment" "amazon_eks_service_policy" {
 # Because of that, on a new AWS account (where load balancers have not been provisioned yet, `nginx-ingress` fails to provision a load balancer
 
 data "aws_iam_policy_document" "cluster_elb_service_role" {
-  count = local.enabled ? 1 : 0
+  count = local.create_eks_service_role ? 1 : 0
 
   statement {
     effect = "Allow"
@@ -53,7 +59,7 @@ data "aws_iam_policy_document" "cluster_elb_service_role" {
 }
 
 resource "aws_iam_role_policy" "cluster_elb_service_role" {
-  count  = local.enabled ? 1 : 0
+  count  = local.create_eks_service_role ? 1 : 0
   name   = module.label.id
   role   = join("", aws_iam_role.default.*.name)
   policy = join("", data.aws_iam_policy_document.cluster_elb_service_role.*.json)

main.tf

@@ -6,7 +6,7 @@ locals {
     provider_key_arn = local.enabled && var.cluster_encryption_config_enabled && var.cluster_encryption_config_kms_key_id == "" ? join("", aws_kms_key.cluster.*.arn) : var.cluster_encryption_config_kms_key_id
   }
 
-  security_group_enabled = module.this.enabled && var.security_group_enabled
+  security_group_enabled = local.enabled && var.security_group_enabled
 }
 
 module "label" {
@@ -48,7 +48,7 @@ resource "aws_eks_cluster" "default" {
   count                     = local.enabled ? 1 : 0
   name                      = module.label.id
   tags                      = module.label.tags
-  role_arn                  = join("", aws_iam_role.default.*.arn)
+  role_arn                  = local.eks_service_role
   version                   = var.kubernetes_version
   enabled_cluster_log_types = var.enabled_cluster_log_types
 

outputs.tf

@@ -55,7 +55,7 @@ output "eks_cluster_managed_security_group_id" {
 
 output "eks_cluster_role_arn" {
   description = "ARN of the EKS cluster IAM role"
-  value       = join("", aws_iam_role.default.*.arn)
+  value       = local.eks_service_role
 }
 
 output "kubernetes_config_map_id" {

variables.tf

@@ -56,6 +56,12 @@ variable "security_groups" {
   description = "A list of Security Group IDs to associate with EKS cluster."
 }
 
+variable "eks_cluster_service_role_arn" {
+  type        = string
+  description = "The ARN of an externally created EKS service role to use, or leave blank to create one"
+  default     = null
+}
+
 variable "workers_role_arns" {
   type        = list(string)
   description = "List of Role ARNs of the worker nodes"