From 47492ba97cb613f48f81937cb6565e5e5dfe5876 Mon Sep 17 00:00:00 2001 From: Bryant Biggs Date: Thu, 25 May 2023 12:54:23 -0400 Subject: [PATCH 1/2] chore: Sync changes from Blueprints examples refactoring (ALB controller + Fargate FluentBit) --- README.md | 4 +- main.tf | 353 ++++++++++++++++++++++++++++------------------------- outputs.tf | 7 +- 3 files changed, 198 insertions(+), 166 deletions(-) diff --git a/README.md b/README.md index 1888f0ff..6326a051 100644 --- a/README.md +++ b/README.md @@ -69,6 +69,7 @@ Please note: not all addons will be supported as they are today in the main EKS | [aws_cloudwatch_log_group.fargate_fluentbit](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource | | [aws_eks_addon.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_addon) | resource | | [aws_iam_instance_profile.karpenter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_instance_profile) | resource | +| [aws_iam_policy.fargate_fluentbit](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | | [aws_iam_role.karpenter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | | [aws_iam_role_policy_attachment.additional](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | | [aws_iam_role_policy_attachment.karpenter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | @@ -87,6 +88,7 @@ Please note: not all addons will be supported as they are today in the main EKS | [aws_iam_policy_document.cluster_autoscaler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.external_dns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.external_secrets](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | +| [aws_iam_policy_document.fargate_fluentbit](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.karpenter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.karpenter_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.velero](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | @@ -189,7 +191,7 @@ Please note: not all addons will be supported as they are today in the main EKS | [eks\_addons](#output\_eks\_addons) | Map of attributes for each EKS addons enabled | | [external\_dns](#output\_external\_dns) | Map of attributes of the Helm release and IRSA created | | [external\_secrets](#output\_external\_secrets) | Map of attributes of the Helm release and IRSA created | -| [fargate\_fluentbit](#output\_fargate\_fluentbit) | Map of attributes of the Helm release and IRSA created | +| [fargate\_fluentbit](#output\_fargate\_fluentbit) | Map of attributes of the configmap and IAM policy created | | [gatekeeper](#output\_gatekeeper) | Map of attributes of the Helm release and IRSA created | | [ingress\_nginx](#output\_ingress\_nginx) | Map of attributes of the Helm release and IRSA created | | [karpenter](#output\_karpenter) | Map of attributes of the Helm release and IRSA created | diff --git a/main.tf b/main.tf index ceb5af47..959bbf8a 100644 --- a/main.tf +++ b/main.tf @@ -518,7 +518,7 @@ data "aws_iam_policy_document" "aws_for_fluentbit" { sid = "PutLogEvents" effect = "Allow" resources = [ - "arn:${local.partition}:logs:${local.region}:${local.account_id}:log-group:${try(var.aws_for_fluentbit_cw_log_group.name, "")}*:log-stream:*", + "arn:${local.partition}:logs:${local.region}:${local.account_id}:log-group:${try(var.aws_for_fluentbit_cw_log_group.name, "*")}:log-stream:*", ] actions = [ @@ -530,7 +530,7 @@ data "aws_iam_policy_document" "aws_for_fluentbit" { sid = "CreateCWLogs" effect = "Allow" resources = [ - "arn:${local.partition}:logs:${local.region}:${local.account_id}:log-group:${try(var.aws_for_fluentbit_cw_log_group.name, "")}*", + "arn:${local.partition}:logs:${local.region}:${local.account_id}:log-group:${try(var.aws_for_fluentbit_cw_log_group.name, "*")}", ] actions = [ @@ -792,7 +792,9 @@ locals { data "aws_iam_policy_document" "aws_load_balancer_controller" { statement { - resources = ["*"] + sid = "AllowCreateServiceLinkedRole" + effect = "Allow" + resources = ["arn:${local.partition}:iam::${local.account_id}:role/aws-service-role/elasticloadbalancing.amazonaws.com/AWSServiceRoleForElasticLoadBalancing"] actions = ["iam:CreateServiceLinkedRole"] condition { @@ -803,8 +805,28 @@ data "aws_iam_policy_document" "aws_load_balancer_controller" { } statement { + sid = "AllowDescribeElbTags" + effect = "Allow" + resources = ["*"] #tfsec:ignore:aws-iam-no-policy-wildcards + + actions = ["elasticloadbalancing:DescribeTags"] + } + + statement { + sid = "AllowGetResources" + effect = "Allow" resources = ["*"] + actions = [ + "elasticloadbalancing:DescribeListenerCertificates", + "elasticloadbalancing:DescribeListeners", + "elasticloadbalancing:DescribeLoadBalancerAttributes", + "elasticloadbalancing:DescribeLoadBalancers", + "elasticloadbalancing:DescribeRules", + "elasticloadbalancing:DescribeSSLPolicies", + "elasticloadbalancing:DescribeTargetGroupAttributes", + "elasticloadbalancing:DescribeTargetGroups", + "elasticloadbalancing:DescribeTargetHealth", "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", "ec2:DescribeAvailabilityZones", @@ -818,238 +840,211 @@ data "aws_iam_policy_document" "aws_load_balancer_controller" { "ec2:DescribeVpcPeeringConnections", "ec2:DescribeVpcs", "ec2:GetCoipPoolUsage", - "elasticloadbalancing:DescribeListenerCertificates", - "elasticloadbalancing:DescribeListeners", - "elasticloadbalancing:DescribeLoadBalancerAttributes", - "elasticloadbalancing:DescribeLoadBalancers", - "elasticloadbalancing:DescribeRules", - "elasticloadbalancing:DescribeSSLPolicies", - "elasticloadbalancing:DescribeTags", - "elasticloadbalancing:DescribeTargetGroupAttributes", - "elasticloadbalancing:DescribeTargetGroups", - "elasticloadbalancing:DescribeTargetHealth", ] } statement { - resources = ["*"] - actions = [ - "acm:DescribeCertificate", - "acm:ListCertificates", - "cognito-idp:DescribeUserPoolClient", - "iam:GetServerCertificate", - "iam:ListServerCertificates", - "shield:CreateProtection", - "shield:DeleteProtection", - "shield:DescribeProtection", - "shield:GetSubscriptionState", - "waf-regional:AssociateWebACL", - "waf-regional:DisassociateWebACL", - "waf-regional:GetWebACL", - "waf-regional:GetWebACLForResource", - "wafv2:AssociateWebACL", - "wafv2:DisassociateWebACL", - "wafv2:GetWebACL", - "wafv2:GetWebACLForResource", + sid = "AllowManageElbs" + effect = "Allow" + + resources = [ + "arn:${local.partition}:elasticloadbalancing:${local.region}:${local.account_id}:loadbalancer/app/*/*", + "arn:${local.partition}:elasticloadbalancing:${local.region}:${local.account_id}:loadbalancer/net/*/*", + "arn:${local.partition}:elasticloadbalancing:${local.region}:${local.account_id}:targetgroup/*/*", ] - } - statement { - resources = ["*"] actions = [ - "ec2:AuthorizeSecurityGroupIngress", - "ec2:RevokeSecurityGroupIngress", + "elasticloadbalancing:AddTags", + "elasticloadbalancing:DeleteTargetGroup", + "elasticloadbalancing:RemoveTags", + "elasticloadbalancing:CreateLoadBalancer", + "elasticloadbalancing:CreateListener", + "elasticloadbalancing:DeleteLoadBalancer", + "elasticloadbalancing:ModifyLoadBalancerAttributes", + "elasticloadbalancing:SetIpAddressType", + "elasticloadbalancing:SetSecurityGroups", + "elasticloadbalancing:SetSubnets", ] } statement { - resources = ["*"] - actions = ["ec2:CreateSecurityGroup"] + sid = "AllowManageTargetGroup" + effect = "Allow" + resources = [ + "arn:${local.partition}:elasticloadbalancing:${local.region}:${local.account_id}:targetgroup/*/*", + ] + + actions = [ + "elasticloadbalancing:CreateTargetGroup", + "elasticloadbalancing:DeleteTargetGroup", + "elasticloadbalancing:ModifyTargetGroup", + "elasticloadbalancing:ModifyTargetGroupAttributes", + ] } statement { - resources = ["arn:${local.partition}:ec2:*:*:security-group/*"] - actions = ["ec2:CreateTags"] - - condition { - test = "Null" - variable = "aws:RequestTag/elbv2.k8s.aws/cluster" - values = ["false"] - } + sid = "AllowManageListeners" + effect = "Allow" + resources = [ + "arn:${local.partition}:elasticloadbalancing:${local.region}:${local.account_id}:listener/app/*/*/*", + "arn:${local.partition}:elasticloadbalancing:${local.region}:${local.account_id}:listener/net/*/*/*", + ] - condition { - test = "StringEquals" - variable = "ec2:CreateAction" - values = ["CreateSecurityGroup"] - } + actions = [ + "elasticloadbalancing:CreateRule", + "elasticloadbalancing:DeleteListener", + "elasticloadbalancing:ModifyListener", + "elasticloadbalancing:AddListenerCertificates", + "elasticloadbalancing:RemoveListenerCertificates" + ] } statement { - resources = ["arn:${local.partition}:ec2:*:*:security-group/*"] - actions = [ - "ec2:CreateTags", - "ec2:DeleteTags", + sid = "AllowManageRules" + effect = "Allow" + resources = [ + "arn:${local.partition}:elasticloadbalancing:${local.region}:${local.account_id}:listener-rule/app/*/*/*/*", + "arn:${local.partition}:elasticloadbalancing:${local.region}:${local.account_id}:listener-rule/net/*/*/*/*", ] - condition { - test = "Null" - variable = "aws:ResourceTag/ingress.k8s.aws/cluster" - values = ["false"] - } + actions = [ + "elasticloadbalancing:DeleteRule", + "elasticloadbalancing:ModifyRule" + ] } statement { + sid = "AllowManageResourceTags" + effect = "Allow" + resources = [ - "arn:${local.partition}:elasticloadbalancing:*:*:loadbalancer/app/*/*", - "arn:${local.partition}:elasticloadbalancing:*:*:loadbalancer/net/*/*", - "arn:${local.partition}:elasticloadbalancing:*:*:targetgroup/*/*", + "arn:${local.partition}:elasticloadbalancing:${local.region}:${local.account_id}:loadbalancer/app/*/*", + "arn:${local.partition}:elasticloadbalancing:${local.region}:${local.account_id}:loadbalancer/net/*/*", + "arn:${local.partition}:elasticloadbalancing:${local.region}:${local.account_id}:listener/app/*/*/*", + "arn:${local.partition}:elasticloadbalancing:${local.region}:${local.account_id}:listener/net/*/*/*", + "arn:${local.partition}:elasticloadbalancing:${local.region}:${local.account_id}:listener-rule/app/*/*/*/*", + "arn:${local.partition}:elasticloadbalancing:${local.region}:${local.account_id}:listener-rule/net/*/*/*/*", + "arn:${local.partition}:elasticloadbalancing:${local.region}:${local.account_id}:targetgroup/*/*", ] + actions = [ "elasticloadbalancing:AddTags", - "elasticloadbalancing:DeleteTargetGroup", "elasticloadbalancing:RemoveTags", ] - - condition { - test = "Null" - variable = "aws:ResourceTag/ingress.k8s.aws/cluster" - values = ["false"] - } } statement { - resources = ["arn:${local.partition}:ec2:*:*:security-group/*"] + sid = "AllowManageTargets" + effect = "Allow" + resources = ["arn:${local.partition}:elasticloadbalancing:${local.region}:${local.account_id}:targetgroup/*/*"] + actions = [ - "ec2:CreateTags", - "ec2:DeleteTags", + "elasticloadbalancing:DeregisterTargets", + "elasticloadbalancing:RegisterTargets" ] - - condition { - test = "Null" - variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" - values = ["false"] - } - - condition { - test = "Null" - variable = "aws:RequestTag/elbv2.k8s.aws/cluster" - values = ["true"] - } } statement { - resources = ["*"] - actions = [ - "ec2:AuthorizeSecurityGroupIngress", - "ec2:DeleteSecurityGroup", - "ec2:RevokeSecurityGroupIngress", + sid = "AllowGetCertificates" + effect = "Allow" + resources = [ + "arn:${local.partition}:acm:${local.region}:${local.account_id}:*", + "arn:${local.partition}:acm:${local.region}:${local.account_id}:certificate/*" ] - condition { - test = "Null" - variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" - values = ["false"] - } - } - - statement { - resources = ["*"] actions = [ - "elasticloadbalancing:CreateLoadBalancer", - "elasticloadbalancing:CreateTargetGroup", + "acm:DescribeCertificate", + "acm:ListCertificates" ] - - condition { - test = "Null" - variable = "aws:RequestTag/elbv2.k8s.aws/cluster" - values = ["false"] - } } statement { - resources = ["*"] - actions = [ - "elasticloadbalancing:CreateListener", - "elasticloadbalancing:CreateRule", - "elasticloadbalancing:DeleteListener", - "elasticloadbalancing:DeleteRule", - ] + sid = "AllowDescribeCognitoIdp" + effect = "Allow" + resources = ["arn:${local.partition}:cognito-idp:${local.region}:${local.account_id}:userpool/*"] + + actions = ["cognito-idp:DescribeUserPoolClient"] } statement { + sid = "AllowGetServerCertificates" + effect = "Allow" resources = [ - "arn:${local.partition}:elasticloadbalancing:*:*:loadbalancer/app/*/*", - "arn:${local.partition}:elasticloadbalancing:*:*:loadbalancer/net/*/*", - "arn:${local.partition}:elasticloadbalancing:*:*:targetgroup/*/*", + "arn:${local.partition}:iam::${local.account_id}:*", + "arn:${local.partition}:iam::${local.account_id}:server-certificate/*" ] + actions = [ - "elasticloadbalancing:AddTags", - "elasticloadbalancing:RemoveTags", + "iam:GetServerCertificate", + "iam:ListServerCertificates", ] - - condition { - test = "Null" - variable = "aws:RequestTag/elbv2.k8s.aws/cluster" - values = ["true"] - } - - condition { - test = "Null" - variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" - values = ["false"] - } } statement { + sid = "AllowShield" + effect = "Allow" resources = [ - "arn:${local.partition}:elasticloadbalancing:*:*:listener/net/*/*/*", - "arn:${local.partition}:elasticloadbalancing:*:*:listener/app/*/*/*", - "arn:${local.partition}:elasticloadbalancing:*:*:listener-rule/net/*/*/*", - "arn:${local.partition}:elasticloadbalancing:*:*:listener-rule/app/*/*/*", + "arn:${local.partition}:shield::${local.account_id}:*", + "arn:${local.partition}:shield::${local.account_id}:protection/*" ] + actions = [ - "elasticloadbalancing:AddTags", - "elasticloadbalancing:RemoveTags", + "shield:CreateProtection", + "shield:DeleteProtection", + "shield:DescribeProtection", + "shield:GetSubscriptionState", ] } statement { - resources = ["*"] - actions = [ - "elasticloadbalancing:DeleteLoadBalancer", - "elasticloadbalancing:DeleteTargetGroup", - "elasticloadbalancing:ModifyLoadBalancerAttributes", - "elasticloadbalancing:ModifyTargetGroup", - "elasticloadbalancing:ModifyTargetGroupAttributes", - "elasticloadbalancing:SetIpAddressType", - "elasticloadbalancing:SetSecurityGroups", - "elasticloadbalancing:SetSubnets", + sid = "AllowManageWebAcl" + effect = "Allow" + resources = [ + "arn:${local.partition}:elasticloadbalancing:${local.region}:${local.account_id}:loadbalancer/app/*/*", + "arn:${local.partition}:apigateway:${local.region}::/restapis/*/stages/*", + "arn:${local.partition}:appsync:${local.region}:${local.account_id}:apis/*", + "arn:${local.partition}:cognito-idp:${local.region}:${local.account_id}:userpool/*", + "arn:${local.partition}:wafv2:${local.region}:${local.account_id}:*", + "arn:${local.partition}:wafv2:${local.region}:${local.account_id}:*/webacl/*/*", + "arn:${local.partition}:waf-regional:${local.region}:${local.account_id}:*", + "arn:${local.partition}:waf-regional:${local.region}:${local.account_id}:webacl/*" ] - condition { - test = "Null" - variable = "aws:ResourceTag/elbv2.k8s.aws/cluster" - values = ["false"] - } + actions = [ + "elasticloadbalancing:SetWebAcl", + "waf-regional:AssociateWebACL", + "waf-regional:DisassociateWebACL", + "waf-regional:GetWebACL", + "waf-regional:GetWebACLForResource", + "wafv2:AssociateWebACL", + "wafv2:DisassociateWebACL", + "wafv2:GetWebACL", + "wafv2:GetWebACLForResource", + ] } statement { - resources = ["arn:${local.partition}:elasticloadbalancing:*:*:targetgroup/*/*"] + sid = "AllowManageSecurityGroups" + effect = "Allow" + resources = ["arn:${local.partition}:ec2:${local.region}:${local.account_id}:security-group/*"] + actions = [ - "elasticloadbalancing:DeregisterTargets", - "elasticloadbalancing:RegisterTargets", + "ec2:AuthorizeSecurityGroupIngress", + "ec2:RevokeSecurityGroupIngress", + "ec2:DeleteSecurityGroup", + "ec2:CreateTags", + "ec2:DeleteTags", ] } statement { - resources = ["*"] - actions = [ - "elasticloadbalancing:AddListenerCertificates", - "elasticloadbalancing:ModifyListener", - "elasticloadbalancing:ModifyRule", - "elasticloadbalancing:RemoveListenerCertificates", - "elasticloadbalancing:SetWebAcl", + sid = "AllowCreateSecurityGroups" + effect = "Allow" + resources = [ + "arn:${local.partition}:ec2:${local.region}:${local.account_id}:security-group/*", + "arn:${local.partition}:ec2:${local.region}:${local.account_id}:vpc/*", ] + actions = ["ec2:CreateSecurityGroup"] } } @@ -2089,6 +2084,10 @@ module "external_secrets" { # Fargate Fluentbit ################################################################################ +locals { + fargate_fluentbit_policy_name = try(var.fargate_fluentbit_cw_log_group.create, true) ? try(var.fargate_fluentbit.policy_name, "${var.cluster_name}-fargate-fluentbit-logs") : null +} + resource "aws_cloudwatch_log_group" "fargate_fluentbit" { count = try(var.fargate_fluentbit_cw_log_group.create, true) && var.enable_fargate_fluentbit ? 1 : 0 @@ -2100,6 +2099,34 @@ resource "aws_cloudwatch_log_group" "fargate_fluentbit" { tags = merge(var.tags, try(var.fargate_fluentbit_cw_log_group.tags, {})) } +resource "aws_iam_policy" "fargate_fluentbit" { + count = try(var.fargate_fluentbit_cw_log_group.create, true) && var.enable_fargate_fluentbit ? 1 : 0 + + name = try(var.fargate_fluentbit.policy_name_use_prefix, true) ? null : local.fargate_fluentbit_policy_name + name_prefix = try(var.fargate_fluentbit.policy_name_use_prefix, true) ? try(var.fargate_fluentbit.policy_name_prefix, "${local.fargate_fluentbit_policy_name}-") : null + description = try(var.fargate_fluentbit.policy_description, null) + policy = data.aws_iam_policy_document.fargate_fluentbit[0].json +} + +data "aws_iam_policy_document" "fargate_fluentbit" { + count = try(var.fargate_fluentbit_cw_log_group.create, true) && var.enable_fargate_fluentbit ? 1 : 0 + + statement { + sid = "PutLogEvents" + effect = "Allow" + actions = [ + "logs:CreateLogStream", + "logs:CreateLogGroup", + "logs:DescribeLogStreams", + "logs:PutLogEvents" + ] + resources = [ + try("${var.fargate_fluentbit.cwlog_arn}:*", "${aws_cloudwatch_log_group.fargate_fluentbit[0].arn}:*"), + try("${var.fargate_fluentbit.cwlog_arn}:logstream:*", "${aws_cloudwatch_log_group.fargate_fluentbit[0].arn}:logstream:*") + ] + } +} + # Help on Fargate Logging with Fluentbit and CloudWatch # https://docs.aws.amazon.com/eks/latest/userguide/fargate-logging.html resource "kubernetes_namespace_v1" "aws_observability" { diff --git a/outputs.tf b/outputs.tf index 22ce2ffe..59e9ab16 100644 --- a/outputs.tf +++ b/outputs.tf @@ -84,8 +84,11 @@ output "external_secrets" { } output "fargate_fluentbit" { - description = "Map of attributes of the Helm release and IRSA created" - value = kubernetes_config_map_v1.aws_logging + description = "Map of attributes of the configmap and IAM policy created" + value = { + configmap = kubernetes_config_map_v1.aws_logging + iam_policy = aws_iam_policy.fargate_fluentbit + } } output "gatekeeper" { From 03653e7a051498d5c943b71f7547e9ba8d865c52 Mon Sep 17 00:00:00 2001 From: Bryant Biggs Date: Thu, 25 May 2023 14:56:58 -0400 Subject: [PATCH 2/2] feat: Add docs --- .github/workflows/publish-docs.yaml | 52 +++++++++ README.md | 4 +- docs/aws-cloudwatch-metrics.md | 30 +++++ docs/aws-efs-csi-driver.md | 42 +++++++ docs/aws-load-balancer-controller.md | 86 ++++++++++++++ docs/aws-private-ca-issuer.md | 65 +++++++++++ docs/cert-manager.md | 95 ++++++++++++++++ docs/fargate-fluentbit.md | 107 ++++++++++++++++++ docs/images/colored-logo.png | Bin 0 -> 106378 bytes docs/images/white-logo.png | Bin 0 -> 94617 bytes docs/index.md | 3 + docs/karpenter.md | 99 ++++++++++++++++ docs/nginx-ingress.md | 38 +++++++ docs/opa-gatekeeper.md | 28 +++++ docs/velero.md | 163 +++++++++++++++++++++++++++ docs/vpa.md | 28 +++++ mkdocs.yml | 79 +++++++++++++ 17 files changed, 918 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/publish-docs.yaml create mode 100644 docs/aws-cloudwatch-metrics.md create mode 100644 docs/aws-efs-csi-driver.md create mode 100644 docs/aws-load-balancer-controller.md create mode 100644 docs/aws-private-ca-issuer.md create mode 100644 docs/cert-manager.md create mode 100644 docs/fargate-fluentbit.md create mode 100644 docs/images/colored-logo.png create mode 100644 docs/images/white-logo.png create mode 100644 docs/index.md create mode 100644 docs/karpenter.md create mode 100644 docs/nginx-ingress.md create mode 100644 docs/opa-gatekeeper.md create mode 100644 docs/velero.md create mode 100644 docs/vpa.md create mode 100644 mkdocs.yml diff --git a/.github/workflows/publish-docs.yaml b/.github/workflows/publish-docs.yaml new file mode 100644 index 00000000..7d392d79 --- /dev/null +++ b/.github/workflows/publish-docs.yaml @@ -0,0 +1,52 @@ +name: Publish docs via GitHub Pages +on: + push: + branches: + - main + paths: + - "docs/**" + - "mkdocs.yml" + - README.md + + release: + types: + - published + +env: + PYTHON_VERSION: 3.x + +jobs: + build: + name: Deploy docs + runs-on: ubuntu-latest + steps: + - name: Checkout main + uses: actions/checkout@v3 + with: + fetch-depth: 0 + + - name: Set up Python ${{ env.PYTHON_VERSION }} + uses: actions/setup-python@v3 + with: + python-version: ${{ env.PYTHON_VERSION }} + + - name: Install dependencies + run: | + python -m pip install --upgrade pip + pip install mike=1.1.2 mkdocs-material==9.1.4 mkdocs-include-markdown-plugin==4.0.4 + + - name: git config + run: | + git config --local user.email "action@github.com" + git config --local user.name "GitHub Action" + + - name: mike deploy main + if: contains(github.ref, 'refs/heads/main') + run: | + mike deploy --push main + + - name: mike deploy new version + if: contains(github.ref, 'refs/tags/v') && !github.event.release.prerelease + run: | + VERSION=${GITHUB_REF/refs\/tags\//} + mike deploy --rebase --push --update-aliases "${VERSION}" latest diff --git a/README.md b/README.md index 6326a051..f01c9f1b 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,6 @@ -# EKS Blueprints Addons Terraform Module +# AWS EKS Blueprints Addons + +Terraform module to deploy Kubernetes addons on AWS EKS clusters. ### 🚧 Currently under development 🚧 diff --git a/docs/aws-cloudwatch-metrics.md b/docs/aws-cloudwatch-metrics.md new file mode 100644 index 00000000..030c0f22 --- /dev/null +++ b/docs/aws-cloudwatch-metrics.md @@ -0,0 +1,30 @@ +# AWS CloudWatch Metrics + +Use CloudWatch Container Insights to collect, aggregate, and summarize metrics and logs from your containerized applications and microservices. CloudWatch automatically collects metrics for many resources, such as CPU, memory, disk, and network. Container Insights also provides diagnostic information, such as container restart failures, to help you isolate issues and resolve them quickly. You can also set CloudWatch alarms on metrics that Container Insights collects. + +Container Insights collects data as performance log events using embedded metric format. These performance log events are entries that use a structured JSON schema that enables high-cardinality data to be ingested and stored at scale. From this data, CloudWatch creates aggregated metrics at the cluster, node, pod, task, and service level as CloudWatch metrics. The metrics that Container Insights collects are available in CloudWatch automatic dashboards, and also viewable in the Metrics section of the CloudWatch console. + +## Usage + +[aws-cloudwatch-metrics](https://github.com/aws-ia/terraform-aws-eks-blueprints/tree/main/modules/kubernetes-addons/aws-cloudwatch-metrics) can be deployed by enabling the add-on via the following. + +```hcl +enable_aws_cloudwatch_metrics = true +``` + +You can also customize the Helm chart that deploys `aws-cloudwatch-metrics` via the following configuration: + + +```hcl + enable_aws_cloudwatch_metrics = true + + aws_cloudwatch_metrics_irsa_policies = ["IAM Policies"] + aws_cloudwatch_metrics = { + role_policies = ["IAM Policies"] # extra policies in addition of CloudWatchAgentServerPolicy + name = "aws-cloudwatch-metrics" + repository = "https://aws.github.io/eks-charts" + chart_version = "0.0.9" + namespace = "amazon-cloudwatch" + values = [templatefile("${path.module}/values.yaml", {})] # The value `clusterName` is already set to the EKS cluster name, no need to specify here + } +``` diff --git a/docs/aws-efs-csi-driver.md b/docs/aws-efs-csi-driver.md new file mode 100644 index 00000000..4a415568 --- /dev/null +++ b/docs/aws-efs-csi-driver.md @@ -0,0 +1,42 @@ +# AWS EFS CSI Driver + +This add-on deploys the [AWS EFS CSI driver](https://docs.aws.amazon.com/eks/latest/userguide/efs-csi.html) into an EKS cluster. + +## Usage + +The [AWS EFS CSI driver](https://github.com/aws-ia/terraform-aws-eks-blueprints/tree/main/modules/kubernetes-addons/aws-efs-csi-driver) can be deployed by enabling the add-on via the following. Check out the full [example](https://github.com/aws-ia/terraform-aws-eks-blueprints/blob/main/examples/stateful/main.tf) to deploy an EKS Cluster with EFS backing the dynamic provisioning of persistent volumes. + +```hcl + enable_aws_efs_csi_driver = true +``` + +Once deployed, you will be able to see a number of supporting resources in the `kube-system` namespace. + +```sh +$ kubectl get deployment efs-csi-controller -n kube-system + +NAME READY UP-TO-DATE AVAILABLE AGE +efs-csi-controller 2/2 2 2 4m29s +``` + +```sh +$ kubectl get daemonset efs-csi-node -n kube-system + +NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE +efs-csi-node 3 3 3 3 3 beta.kubernetes.io/os=linux 4m32s +``` + +You can optionally customize the Helm chart that deploys the driver via the following configuration. + +```hcl + enable_aws_efs_csi_driver = true + + # Optional aws_efs_csi_driver_helm_config + aws_efs_csi_driver = { + repository = "https://kubernetes-sigs.github.io/aws-efs-csi-driver/" + chart_version = "2.4.1" + } + aws_efs_csi_driver { + role_policies = [""] + } +``` diff --git a/docs/aws-load-balancer-controller.md b/docs/aws-load-balancer-controller.md new file mode 100644 index 00000000..afe8ff23 --- /dev/null +++ b/docs/aws-load-balancer-controller.md @@ -0,0 +1,86 @@ +# AWS Load Balancer Controller. + +[AWS Load Balancer Controller ](https://kubernetes-sigs.github.io/aws-load-balancer-controller/) is a controller to help manage Elastic Load Balancers for a Kubernetes cluster. This Add-on deploys this controller in an Amazon EKS Cluster. + +## Usage + +In order to deploy the AWS Load Balancer Controller Addon via [EKS Blueprints Addons](https://github.com/aws-ia/terraform-aws-eks-blueprints-addons), reference the following parameters under the `module.eks_blueprints_addons`. + +```hcl +module "eks_blueprints_addons" { + + enable_aws_load_balancer_controller = true + aws_load_balancer_controller = { + set = [ + { + name = "vpcId" + value = module.vpc.vpc_id + }, + { + name = "podDisruptionBudget.maxUnavailable" + value = 1 + }, + ] + } +``` +### Helm Chart customization + +It's possible to customize your deployment using the Helm Chart parameters inside the `aws_load_balancer_controller` configuration block: + +```hcl + aws_load_balancer_controller = { + set = [ + { + name = "vpcId" + value = module.vpc.vpc_id + }, + { + name = "podDisruptionBudget.maxUnavailable" + value = 1 + }, + { + name = "resources.requests.cpu" + value = 100m + }, + { + name = "resources.requests.memory" + value = 128Mi + }, + ] + } +} +``` + +You can find all available Helm Chart parameter values [here](https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/helm/aws-load-balancer-controller/values.yaml). + + +## Validate + +1. To validate the deployment, check if the `aws-load-balancer-controller` Pods were created in the `kube-system` Namespace, as the following example. + +```sh +kubectl -n kube-system get pods | grep aws-load-balancer-controller +NAMESPACE NAME READY STATUS RESTARTS AGE +kube-system aws-load-balancer-controller-6cbdb58654-fvskt 1/1 Running 0 26m +kube-system aws-load-balancer-controller-6cbdb58654-sc7dk 1/1 Running 0 26m +``` + +2. Create a Kubernetes Ingress, using the `alb` IngressClass, pointing to an existing Service. In this example we'll use a Service called `example-svc`. + +```sh +kubectl create ingress example-ingress --class alb --rule="/*=example-svc:80" \ +--annotation alb.ingress.kubernetes.io/scheme=internet-facing \ +--annotation alb.ingress.kubernetes.io/target-type=ip +``` + +```sh +kubectl get ingress +NAME CLASS HOSTS ADDRESS PORTS AGE +example-ingress alb * k8s-example-ingress-7e0d6f03e7-1234567890.us-west-2.elb.amazonaws.com 80 4m9s +``` + +## Resources + +[GitHub Repo](https://github.com/kubernetes-sigs/aws-load-balancer-controller/) +[Helm Chart](https://github.com/kubernetes-sigs/aws-load-balancer-controller/tree/main/helm/aws-load-balancer-controller) +[AWS Docs](https://docs.aws.amazon.com/eks/latest/userguide/aws-load-balancer-controller.html) diff --git a/docs/aws-private-ca-issuer.md b/docs/aws-private-ca-issuer.md new file mode 100644 index 00000000..d7a5bd46 --- /dev/null +++ b/docs/aws-private-ca-issuer.md @@ -0,0 +1,65 @@ +# AWS Private CA (PCA) Issuer + +[AWS Private CA](https://aws.amazon.com/private-ca/) is an AWS service that can setup and manage private CAs, as well as issue private certifiates. This Add-on deployes the AWS Private CA Issuer as an [external issuer](https://cert-manager.io/docs/configuration/external/) to **cert-manager** that signs off certificate requests using AWS Private CA in an Amazon EKS Cluster. + +## Usage + +### Pre-requisites + +To deploy the AWS PCA, you need to install cert-manager first, refer to this [documentation](https://github.com/aws-ia/terraform-aws-eks-blueprints-addons/docs/cert-manager.md) to do it through EKS Blueprints Addons. + +### Deployment + +With **cert-manager** deployed in place, you can deploy the AWS Private CA Issuer Add-on via [EKS Blueprints Addons](https://github.com/aws-ia/terraform-aws-eks-blueprints-addons), reference the following parameters under the `module.eks_blueprints_addons`. + +```hcl +module "eks_blueprints_addons" { + + enable_cert_manager = true + enable_aws_privateca_issuer = true + aws_privateca_issuer = { + acmca_arn = aws_acmpca_certificate_authority.this.arn + } +} +``` + +### Helm Chart customization + +It's possible to customize your deployment using the Helm Chart parameters inside the `aws_load_balancer_controller` configuration block: + +```hcl + aws_privateca_issuer = { + acmca_arn = aws_acmpca_certificate_authority.this.arn + namespace = "aws-privateca-issuer" + create_namespace = true + } +``` + +You can find all available Helm Chart parameter values [here](https://github.com/cert-manager/aws-privateca-issuer/blob/main/charts/aws-pca-issuer/values.yaml). + +## Validation + +1. List all the pods running in `aws-privateca-issuer` and `cert-manager` Namespace. + +```sh +kubectl get pods -n aws-privateca-issuer +kubectl get pods -n cert-manager +``` + +2. Check the `certificate` status in it should be in `Ready` state, and be pointing to a `secret` created in the same Namespace. + +```sh +kubectl get certificate -o wide +NAME READY SECRET ISSUER STATUS AGE +example True example-clusterissuer tls-with-aws-pca-issuer Certificate is up to date and has not expired 41m + +kubectl get secret example-clusterissuer +NAME TYPE DATA AGE +example-clusterissuer kubernetes.io/tls 3 43m +``` + +## Resources + +[GitHub Repo](https://github.com/cert-manager/aws-privateca-issuer) +[Helm Chart](https://github.com/cert-manager/aws-privateca-issuer/tree/main/charts/aws-pca-issuer) +[AWS Docs](https://docs.aws.amazon.com/privateca/latest/userguide/PcaKubernetes.html) diff --git a/docs/cert-manager.md b/docs/cert-manager.md new file mode 100644 index 00000000..9c69f67d --- /dev/null +++ b/docs/cert-manager.md @@ -0,0 +1,95 @@ +# Certificate Manager + +[Cert-manager](https://cert-manager.io/) is a X.509 certificate controller for Kubernetes-like workloads. It will obtain certificates from a variety of Issuers, both popular public Issuers as well as private Issuers, and ensure the certificates are valid and up-to-date, and will attempt to renew certificates at a configured time before expiry. This Add-on deploys this controller in an Amazon EKS Cluster. + +## Usage + +To deploy cert-manager Add-on via [EKS Blueprints Addons](https://github.com/aws-ia/terraform-aws-eks-blueprints-addons), reference the following parameters under the `module.eks_blueprints_addons`. + +```hcl +module "eks_blueprints_addons" { + + enable_cert_manager = true +} +``` + +### Helm Chart customization + +It's possible to customize your deployment using the Helm Chart parameters inside the `cert-manager` configuration block: + +```hcl + cert-manager = { + chart_version = "v1.11.1" + namespace = "cert-manager" + create_namespace = true + } +``` + +You can find all available Helm Chart parameter values [here]https://github.com/cert-manager/cert-manager/blob/master/deploy/charts/cert-manager/values.yaml + +## Validation + +1. Validate if the Cert-Manger Pods are Running. + +```sh +kubectl -n cert-manager get pods +NAME READY STATUS RESTARTS AGE +cert-manager-5989bcc87-96qvf 1/1 Running 0 2m49s +cert-manager-cainjector-9b44ddb68-8c7b9 1/1 Running 0 2m49s +cert-manager-webhook-776b65456-k6br4 1/1 Running 0 2m49s +``` + +2. Create a SelfSigned ClusterIssuer resource in the cluster. + +```yaml +apiVersion: cert-manager.io/v1 +kind: ClusterIssuer +metadata: + name: selfsigned-cluster-issuer +spec: + selfSigned: {} +``` + +```sh +kubectl get clusterissuers -o wide selfsigned-cluster-issuer +NAME READY STATUS AGE +selfsigned-cluster-issuer True 3m +``` + +2. Create a Certificate in a given Namespace. + +```yaml +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: example + namespace: default +spec: + isCA: true + commonName: example + secretName: example-secret + privateKey: + algorithm: ECDSA + size: 256 + issuerRef: + name: selfsigned-cluster-issuer + kind: ClusterIssuer + group: cert-manager.io +``` + +3. Check the `certificate` status in it should be in `Ready` state, and be pointing to a `secret` created in the same Namespace. + +```sh +kubectl get certificate -o wide +NAME READY SECRET ISSUER STATUS AGE +example True example-secret selfsigned-cluster-issuer Certificate is up to date and has not expired 44s + +kubectl get secret example-secret +NAME TYPE DATA AGE +example-secret kubernetes.io/tls 3 70s +``` + +## Resources + +[GitHub Repo](https://github.com/cert-manager/cert-manager) +[Helm Chart](https://github.com/cert-manager/cert-manager/blob/master/deploy/charts/cert-manager/) diff --git a/docs/fargate-fluentbit.md b/docs/fargate-fluentbit.md new file mode 100644 index 00000000..4aca457c --- /dev/null +++ b/docs/fargate-fluentbit.md @@ -0,0 +1,107 @@ +# Fargate Fluentbit + +Amazon EKS on Fargate offers a built-in log router based on Fluent Bit. This means that you don't explicitly run a Fluent Bit container as a sidecar, but Amazon runs it for you. All that you have to do is configure the log router. The configuration happens through a dedicated ConfigMap, that is deployed via this Add-on. + +## Usage + +To configure the Fargate Fluentbit ConfigMap via the [EKS Blueprints Addons](https://github.com/aws-ia/terraform-aws-eks-blueprints-addons), just reference the following parameters under the `module.eks_blueprints_addons`. + +```hcl +module "eks_blueprints_addons" { + + enable_fargate_fluentbit = true + fargate_fluentbit = { + flb_log_cw = true + } +} +``` + +It's possible to customize the CloudWatch Log Group parameters in the `fargate_fluentbit_cw_log_group` configuration block: + +```hcl + fargate_fluentbit_cw_log_group = { + + name = "existing-log-group" + name_prefix = "dev-environment-logs" + retention_in_days = 7 + kms_key_id = "arn:aws:kms:us-west-2:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab" + skip_destroy = true +``` + +## Validation + +1. Check if the `aws-logging` configMap for Fargate Fluentbit was created. + +```sh +kubectl -n aws-observability get configmap aws-logging -o yaml +apiVersion: v1 +data: + filters.conf: | + [FILTER] + Name parser + Match * + Key_Name log + Parser regex + Preserve_Key True + Reserve_Data True + flb_log_cw: "true" + output.conf: | + [OUTPUT] + Name cloudwatch_logs + Match * + region us-west-2 + log_group_name /fargate-serverless/fargate-fluentbit-logs20230509014113352200000006 + log_stream_prefix fargate-logs- + auto_create_group true + parsers.conf: | + [PARSER] + Name regex + Format regex + Regex ^(?