update: Updated ACK/Crossplane app re-configuration (aws-samples#1158)

manifests/modules/automation/controlplanes/ack/.workshop/cleanup.sh

@@ -2,5 +2,4 @@
 
 logmessage "Deleting resources created by ACK..."
 
-eksctl delete iamserviceaccount --name carts-ack --namespace carts --cluster $EKS_CLUSTER_NAME -v 0
 delete-all-if-crd-exists tables.dynamodb.services.k8s.aws

manifests/modules/automation/controlplanes/ack/.workshop/terraform/main.tf

@@ -21,10 +21,22 @@ data "aws_ecrpublic_authorization_token" "token" {
 
 
 
+module "iam_assumable_role_carts" {
+  source                        = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
+  version                       = "5.44.0"
+  create_role                   = true
+  role_name                     = "${var.addon_context.eks_cluster_id}-carts-ack"
+  provider_url                  = var.addon_context.eks_oidc_issuer_url
+  role_policy_arns              = [aws_iam_policy.carts_dynamo.arn]
+  oidc_fully_qualified_subjects = ["system:serviceaccount:carts:carts"]
+
+  tags = var.tags
+}
+
 resource "aws_iam_policy" "carts_dynamo" {
   name        = "${var.addon_context.eks_cluster_id}-carts-dynamo"
   path        = "/"
-  description = "DynamoDB policy for AWS Sample Carts Application"
+  description = "Dynamo policy for carts application"
 
   policy = <<EOF
 {
@@ -35,7 +47,8 @@ resource "aws_iam_policy" "carts_dynamo" {
       "Effect": "Allow",
       "Action": "dynamodb:*",
       "Resource": [
-        "arn:aws:dynamodb:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:*"        
+        "arn:aws:dynamodb:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:table/${var.addon_context.eks_cluster_id}-carts-ack",
+        "arn:aws:dynamodb:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:table/${var.addon_context.eks_cluster_id}-carts-ack/index/*"
       ]
     }
   ]

manifests/modules/automation/controlplanes/ack/.workshop/terraform/outputs.tf

@@ -1,6 +1,6 @@
 output "environment_variables" {
   description = "Environment variables to be added to the IDE shell"
   value = {
-    DYNAMODB_POLICY_ARN = aws_iam_policy.carts_dynamo.arn
+    CARTS_IAM_ROLE = module.iam_assumable_role_carts.iam_role_arn
   }
 }

manifests/modules/automation/controlplanes/ack/app/carts-serviceAccount.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: carts
+  namespace: carts
+  annotations:
+    eks.amazonaws.com/role-arn: ${CARTS_IAM_ROLE}

manifests/modules/automation/controlplanes/ack/app/config.properties

@@ -0,0 +1 @@
+CARTS_DYNAMODB_TABLENAME=${EKS_CLUSTER_NAME}-carts-ack

manifests/modules/automation/controlplanes/ack/app/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../../../../base-application/carts
+patches:
+  - path: carts-serviceAccount.yaml
+configMapGenerator:
+  - name: carts
+    namespace: carts
+    env: config.properties
+    behavior: replace
+    options:
+      disableNameSuffixHash: true

manifests/modules/automation/controlplanes/ack/dynamodb/kustomization.yaml

@@ -1,8 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ../../../../../base-application/carts
-  - dynamodb-ack-configmap.yaml
   - dynamodb-create.yaml
-patches:
-  - path: deployment.yaml