From aa551d5b1fdc7bfa0d88bf4562ef5fbfe9da6122 Mon Sep 17 00:00:00 2001 From: Abhinav Rau Date: Wed, 13 Jan 2021 11:59:08 -0500 Subject: [PATCH] feat: Support for ACM for non GKE clusters (#786) * Tested with EKS and GKE * Reformatting to support PR for ACM support for non GKE Clusters * update docs * fix shellcheck errors * Update modules/k8s-operator-crd-support/main.tf Remove unneeded format call. Co-authored-by: Bharath KKB Co-authored-by: Abhinav Rau Co-authored-by: Bharath KKB --- modules/acm/README.md | 1 + modules/acm/main.tf | 1 + modules/acm/variables.tf | 6 +++++ modules/k8s-operator-crd-support/main.tf | 25 +++++++++++-------- .../scripts/wait_for_gatekeeper.sh | 16 ++++++++++-- modules/k8s-operator-crd-support/variables.tf | 6 +++++ 6 files changed, 43 insertions(+), 12 deletions(-) diff --git a/modules/acm/README.md b/modules/acm/README.md index f4dab2a0f..b15215239 100644 --- a/modules/acm/README.md +++ b/modules/acm/README.md @@ -62,6 +62,7 @@ By default, this module will attempt to download the ACM operator from Google di | ssh\_auth\_key | Key for Git authentication. Overrides 'create\_ssh\_key' variable. Can be set using 'file(path/to/file)'-function. | `string` | `null` | no | | sync\_branch | ACM repo Git branch. If un-set, uses Config Management default. | `string` | `""` | no | | sync\_repo | ACM Git repo address | `string` | n/a | yes | +| use\_existing\_context | Use existing kubecontext to auth kube-api. | `bool` | `false` | no | ## Outputs diff --git a/modules/acm/main.tf b/modules/acm/main.tf index e6ae18854..419abf615 100644 --- a/modules/acm/main.tf +++ b/modules/acm/main.tf @@ -50,6 +50,7 @@ module "acm_operator" { hierarchy_controller = var.hierarchy_controller enable_log_denies = var.enable_log_denies service_account_key_file = var.service_account_key_file + use_existing_context = var.use_existing_context operator_latest_manifest_url = "gs://config-management-release/released/latest/config-management-operator.yaml" operator_cr_template_path = "${path.module}/templates/acm-config.yml.tpl" diff --git a/modules/acm/variables.tf b/modules/acm/variables.tf index acc6644ec..ac8f13478 100644 --- a/modules/acm/variables.tf +++ b/modules/acm/variables.tf @@ -109,3 +109,9 @@ variable "service_account_key_file" { description = "Path to service account key file to auth as for running `gcloud container clusters get-credentials`." default = "" } + +variable "use_existing_context" { + description = "Use existing kubecontext to auth kube-api." + type = bool + default = false +} diff --git a/modules/k8s-operator-crd-support/main.tf b/modules/k8s-operator-crd-support/main.tf index 3c4a2ff91..50b3f3ec1 100644 --- a/modules/k8s-operator-crd-support/main.tf +++ b/modules/k8s-operator-crd-support/main.tf @@ -15,15 +15,16 @@ */ locals { - cluster_endpoint = "https://${var.cluster_endpoint}" - private_key = var.create_ssh_key && var.ssh_auth_key == null ? tls_private_key.k8sop_creds[0].private_key_pem : var.ssh_auth_key - k8sop_creds_secret_key = var.secret_type == "cookiefile" ? "cookie_file" : var.secret_type - should_download_manifest = var.operator_path == null ? true : false - manifest_path = local.should_download_manifest ? "${path.root}/.terraform/tmp/${var.project_id}-${var.cluster_name}/config-management-operator.yaml" : var.operator_path - sync_branch_node = var.sync_branch != "" ? format("syncBranch: %s", var.sync_branch) : "" - policy_dir_node = var.policy_dir != "" ? format("policyDir: %s", var.policy_dir) : "" - hierarchy_controller_map_node = var.hierarchy_controller == null ? "" : format("hierarchy_controller:\n %s", yamlencode(var.hierarchy_controller)) - source_format_node = var.source_format != "" ? format("sourceFormat: %s", var.source_format) : "" + cluster_endpoint = "https://${var.cluster_endpoint}" + private_key = var.create_ssh_key && var.ssh_auth_key == null ? tls_private_key.k8sop_creds[0].private_key_pem : var.ssh_auth_key + k8sop_creds_secret_key = var.secret_type == "cookiefile" ? "cookie_file" : var.secret_type + should_download_manifest = var.operator_path == null ? true : false + manifest_path = local.should_download_manifest ? "${path.root}/.terraform/tmp/${var.project_id}-${var.cluster_name}/config-management-operator.yaml" : var.operator_path + sync_branch_node = var.sync_branch != "" ? format("syncBranch: %s", var.sync_branch) : "" + policy_dir_node = var.policy_dir != "" ? format("policyDir: %s", var.policy_dir) : "" + hierarchy_controller_map_node = var.hierarchy_controller == null ? "" : format("hierarchy_controller:\n %s", yamlencode(var.hierarchy_controller)) + source_format_node = var.source_format != "" ? format("sourceFormat: %s", var.source_format) : "" + append_arg_use_existing_context_for_gatekeeper = var.use_existing_context ? "USE_EXISTING_CONTEXT_ARG" : "" } module "k8sop_manifest" { @@ -46,6 +47,7 @@ module "k8s_operator" { cluster_location = var.location project_id = var.project_id service_account_key_file = var.service_account_key_file + use_existing_context = var.use_existing_context kubectl_create_command = "kubectl apply -f ${local.manifest_path}" kubectl_destroy_command = "kubectl delete -f ${local.manifest_path}" @@ -68,6 +70,7 @@ module "k8sop_creds_secret" { cluster_location = var.location project_id = var.project_id service_account_key_file = var.service_account_key_file + use_existing_context = var.use_existing_context kubectl_create_command = local.private_key != null ? "kubectl create secret generic ${var.operator_credential_name} -n=${var.operator_credential_namespace} --from-literal=${local.k8sop_creds_secret_key}='${local.private_key}'" : "" kubectl_destroy_command = "kubectl delete secret ${var.operator_credential_name} -n=${var.operator_credential_namespace}" @@ -100,6 +103,7 @@ module "k8sop_config" { project_id = var.project_id create_cmd_triggers = { configmanagement = data.template_file.k8sop_config.rendered } service_account_key_file = var.service_account_key_file + use_existing_context = var.use_existing_context kubectl_create_command = "kubectl apply -f - <