From 4f0dc085cff4dc3a98782a07dd9a97c9b39e05f0 Mon Sep 17 00:00:00 2001 From: Nuru Date: Mon, 6 Dec 2021 13:53:53 -0800 Subject: [PATCH] Hide KUBECONFIG when not in use (#137) --- README.md | 7 ++++--- auth.tf | 5 ++++- docs/terraform.md | 7 ++++--- iam.tf | 35 +++++++++++++++-------------------- main.tf | 7 +++++++ variables.tf | 15 +++++++++++++++ 6 files changed, 49 insertions(+), 27 deletions(-) diff --git a/README.md b/README.md index e38404b2..a3c2f4a4 100644 --- a/README.md +++ b/README.md @@ -399,11 +399,11 @@ Available targets: | [aws_eks_addon.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_addon) | resource | | [aws_eks_cluster.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_cluster) | resource | | [aws_iam_openid_connect_provider.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_openid_connect_provider) | resource | +| [aws_iam_policy.cluster_elb_service_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | | [aws_iam_role.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | -| [aws_iam_role_policy.cluster_deny_log_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource | -| [aws_iam_role_policy.cluster_elb_service_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource | | [aws_iam_role_policy_attachment.amazon_eks_cluster_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | | [aws_iam_role_policy_attachment.amazon_eks_service_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | +| [aws_iam_role_policy_attachment.cluster_elb_service_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | | [aws_kms_alias.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | resource | | [aws_kms_key.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource | | [aws_security_group.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource | @@ -416,7 +416,6 @@ Available targets: | [null_resource.wait_for_cluster](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | | [aws_eks_cluster_auth.eks](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source | | [aws_iam_policy_document.assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_iam_policy_document.cluster_deny_log_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.cluster_elb_service_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source | | [tls_certificate.cluster](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/data-sources/certificate) | data source | @@ -457,6 +456,7 @@ Available targets: | [kube\_exec\_auth\_enabled](#input\_kube\_exec\_auth\_enabled) | If `true`, use the Kubernetes provider `exec` feature to execute `aws eks get-token` to authenticate to the EKS cluster.
Disabled by `kubeconfig_path_enabled`, overrides `kube_data_auth_enabled`. | `bool` | `false` | no | | [kube\_exec\_auth\_role\_arn](#input\_kube\_exec\_auth\_role\_arn) | The role ARN for `aws eks get-token` to use | `string` | `""` | no | | [kube\_exec\_auth\_role\_arn\_enabled](#input\_kube\_exec\_auth\_role\_arn\_enabled) | If `true`, pass `kube_exec_auth_role_arn` as the role ARN to `aws eks get-token` | `bool` | `false` | no | +| [kubeconfig\_context](#input\_kubeconfig\_context) | Context to choose from the Kubernetes kube config file | `string` | `""` | no | | [kubeconfig\_path](#input\_kubeconfig\_path) | The Kubernetes provider `config_path` setting to use when `kubeconfig_path_enabled` is `true` | `string` | `""` | no | | [kubeconfig\_path\_enabled](#input\_kubeconfig\_path\_enabled) | If `true`, configure the Kubernetes provider with `kubeconfig_path` and use it for authenticating to the EKS cluster | `bool` | `false` | no | | [kubernetes\_config\_map\_ignore\_role\_changes](#input\_kubernetes\_config\_map\_ignore\_role\_changes) | Set to `true` to ignore IAM role changes in the Kubernetes Auth ConfigMap | `bool` | `true` | no | @@ -476,6 +476,7 @@ Available targets: | [public\_access\_cidrs](#input\_public\_access\_cidrs) | Indicates which CIDR blocks can access the Amazon EKS public API server endpoint when enabled. EKS defaults this to a list with 0.0.0.0/0. | `list(string)` | 
[
  "0.0.0.0/0"
]
| no | | [regex\_replace\_chars](#input\_regex\_replace\_chars) | Terraform regular expression (regex) string.
Characters matching the regex will be removed from the ID elements.
If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no | | [region](#input\_region) | AWS Region | `string` | n/a | yes | +| [service\_ipv4\_cidr](#input\_service\_ipv4\_cidr) | The CIDR block to assign Kubernetes service IP addresses from.
You can only specify a custom CIDR block when you create a cluster, changing this value will force a new cluster to be created. | `string` | `null` | no | | [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no | | [subnet\_ids](#input\_subnet\_ids) | A list of subnet IDs to launch the cluster in | `list(string)` | n/a | yes | | [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no | diff --git a/auth.tf b/auth.tf index f33bdfcb..65d2cadd 100644 --- a/auth.tf +++ b/auth.tf @@ -97,7 +97,10 @@ provider "kubernetes" { host = local.enabled ? coalesce(aws_eks_cluster.default[0].endpoint, var.dummy_kubeapi_server) : var.dummy_kubeapi_server cluster_ca_certificate = local.enabled ? base64decode(local.certificate_authority_data) : null token = local.kube_data_auth_enabled ? data.aws_eks_cluster_auth.eks[0].token : null - config_path = local.kubeconfig_path_enabled ? var.kubeconfig_path : null + # The Kubernetes provider will use information from KUBECONFIG if it exists, but if the default cluster + # in KUBECONFIG is some other cluster, this will cause problems, so we override it always. + config_path = local.kubeconfig_path_enabled ? var.kubeconfig_path : "" + config_context = var.kubeconfig_context dynamic "exec" { for_each = local.kube_exec_auth_enabled ? ["exec"] : [] diff --git a/docs/terraform.md b/docs/terraform.md index 1229edcd..b7337120 100644 --- a/docs/terraform.md +++ b/docs/terraform.md @@ -34,11 +34,11 @@ | [aws_eks_addon.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_addon) | resource | | [aws_eks_cluster.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_cluster) | resource | | [aws_iam_openid_connect_provider.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_openid_connect_provider) | resource | +| [aws_iam_policy.cluster_elb_service_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | | [aws_iam_role.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | -| [aws_iam_role_policy.cluster_deny_log_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource | -| [aws_iam_role_policy.cluster_elb_service_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource | | [aws_iam_role_policy_attachment.amazon_eks_cluster_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | | [aws_iam_role_policy_attachment.amazon_eks_service_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | +| [aws_iam_role_policy_attachment.cluster_elb_service_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | | [aws_kms_alias.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | resource | | [aws_kms_key.cluster](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource | | [aws_security_group.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource | @@ -51,7 +51,6 @@ | [null_resource.wait_for_cluster](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | | [aws_eks_cluster_auth.eks](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_cluster_auth) | data source | | [aws_iam_policy_document.assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_iam_policy_document.cluster_deny_log_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_iam_policy_document.cluster_elb_service_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source | | [tls_certificate.cluster](https://registry.terraform.io/providers/hashicorp/tls/latest/docs/data-sources/certificate) | data source | @@ -92,6 +91,7 @@ | [kube\_exec\_auth\_enabled](#input\_kube\_exec\_auth\_enabled) | If `true`, use the Kubernetes provider `exec` feature to execute `aws eks get-token` to authenticate to the EKS cluster.
Disabled by `kubeconfig_path_enabled`, overrides `kube_data_auth_enabled`. | `bool` | `false` | no | | [kube\_exec\_auth\_role\_arn](#input\_kube\_exec\_auth\_role\_arn) | The role ARN for `aws eks get-token` to use | `string` | `""` | no | | [kube\_exec\_auth\_role\_arn\_enabled](#input\_kube\_exec\_auth\_role\_arn\_enabled) | If `true`, pass `kube_exec_auth_role_arn` as the role ARN to `aws eks get-token` | `bool` | `false` | no | +| [kubeconfig\_context](#input\_kubeconfig\_context) | Context to choose from the Kubernetes kube config file | `string` | `""` | no | | [kubeconfig\_path](#input\_kubeconfig\_path) | The Kubernetes provider `config_path` setting to use when `kubeconfig_path_enabled` is `true` | `string` | `""` | no | | [kubeconfig\_path\_enabled](#input\_kubeconfig\_path\_enabled) | If `true`, configure the Kubernetes provider with `kubeconfig_path` and use it for authenticating to the EKS cluster | `bool` | `false` | no | | [kubernetes\_config\_map\_ignore\_role\_changes](#input\_kubernetes\_config\_map\_ignore\_role\_changes) | Set to `true` to ignore IAM role changes in the Kubernetes Auth ConfigMap | `bool` | `true` | no | @@ -111,6 +111,7 @@ | [public\_access\_cidrs](#input\_public\_access\_cidrs) | Indicates which CIDR blocks can access the Amazon EKS public API server endpoint when enabled. EKS defaults this to a list with 0.0.0.0/0. | `list(string)` | 
[
  "0.0.0.0/0"
]
| no | | [regex\_replace\_chars](#input\_regex\_replace\_chars) | Terraform regular expression (regex) string.
Characters matching the regex will be removed from the ID elements.
If not set, `"/[^a-zA-Z0-9-]/"` is used to remove all characters other than hyphens, letters and digits. | `string` | `null` | no | | [region](#input\_region) | AWS Region | `string` | n/a | yes | +| [service\_ipv4\_cidr](#input\_service\_ipv4\_cidr) | The CIDR block to assign Kubernetes service IP addresses from.
You can only specify a custom CIDR block when you create a cluster, changing this value will force a new cluster to be created. | `string` | `null` | no | | [stage](#input\_stage) | ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release' | `string` | `null` | no | | [subnet\_ids](#input\_subnet\_ids) | A list of subnet IDs to launch the cluster in | `list(string)` | n/a | yes | | [tags](#input\_tags) | Additional tags (e.g. `{'BusinessUnit': 'XYZ'}`).
Neither the tag keys nor the tag values will be modified by this module. | `map(string)` | `{}` | no | diff --git a/iam.tf b/iam.tf index 40aac568..bb40bbe1 100644 --- a/iam.tf +++ b/iam.tf @@ -49,7 +49,9 @@ data "aws_iam_policy_document" "cluster_elb_service_role" { count = local.create_eks_service_role ? 1 : 0 statement { + sid = "AllowElasticLoadBalancer" effect = "Allow" + #bridgecrew:skip=BC_AWS_IAM_57:There is no workable constraint to add to this policy actions = [ "ec2:DescribeAccountAttributes", "ec2:DescribeAddresses", @@ -59,23 +61,10 @@ data "aws_iam_policy_document" "cluster_elb_service_role" { ] resources = ["*"] } -} - -resource "aws_iam_role_policy" "cluster_elb_service_role" { - count = local.create_eks_service_role ? 1 : 0 - - name = module.label.id - role = join("", aws_iam_role.default.*.name) - policy = join("", data.aws_iam_policy_document.cluster_elb_service_role.*.json) -} - -# Adding a policy to cluster IAM role that deny permissions to logs:CreateLogGroup -# it is not needed since we create the log group ourselve in this module, and it is causing trouble during cleanup/deletion - -data "aws_iam_policy_document" "cluster_deny_log_group" { - count = local.create_eks_service_role ? 1 : 0 - + # Adding a policy to cluster IAM role that deny permissions to logs:CreateLogGroup + # it is not needed since we create the log group elsewhere in this module, and it is causing trouble during "destroy" statement { + sid = "DenyCreateLogGroup" effect = "Deny" actions = [ "logs:CreateLogGroup" @@ -84,10 +73,16 @@ data "aws_iam_policy_document" "cluster_deny_log_group" { } } -resource "aws_iam_role_policy" "cluster_deny_log_group" { +resource "aws_iam_policy" "cluster_elb_service_role" { + count = local.create_eks_service_role ? 1 : 0 + + name = "${module.label.id}-ServiceRole" + policy = join("", data.aws_iam_policy_document.cluster_elb_service_role.*.json) +} + +resource "aws_iam_role_policy_attachment" "cluster_elb_service_role" { count = local.create_eks_service_role ? 1 : 0 - name = module.label.id - role = join("", aws_iam_role.default.*.name) - policy = join("", data.aws_iam_policy_document.cluster_deny_log_group.*.json) + policy_arn = aws_iam_policy.cluster_elb_service_role[0].arn + role = join("", aws_iam_role.default.*.name) } diff --git a/main.tf b/main.tf index b965fcc8..85a49c55 100644 --- a/main.tf +++ b/main.tf @@ -68,6 +68,13 @@ resource "aws_eks_cluster" "default" { public_access_cidrs = var.public_access_cidrs } + dynamic "kubernetes_network_config" { + for_each = compact([var.service_ipv4_cidr]) + content { + service_ipv4_cidr = kubernetes_network_config.value + } + } + depends_on = [ aws_iam_role_policy_attachment.amazon_eks_cluster_policy, aws_iam_role_policy_attachment.amazon_eks_service_policy, diff --git a/variables.tf b/variables.tf index e5329977..6f43cf2b 100644 --- a/variables.tf +++ b/variables.tf @@ -83,6 +83,15 @@ variable "public_access_cidrs" { description = "Indicates which CIDR blocks can access the Amazon EKS public API server endpoint when enabled. EKS defaults this to a list with 0.0.0.0/0." } +variable "service_ipv4_cidr" { + type = string + default = null + description = <<-EOT + The CIDR block to assign Kubernetes service IP addresses from. + You can only specify a custom CIDR block when you create a cluster, changing this value will force a new cluster to be created. + EOT +} + variable "enabled_cluster_log_types" { type = list(string) default = [] @@ -217,6 +226,12 @@ variable "kubeconfig_path" { description = "The Kubernetes provider `config_path` setting to use when `kubeconfig_path_enabled` is `true`" } +variable "kubeconfig_context" { + type = string + default = "" + description = "Context to choose from the Kubernetes kube config file" +} + variable "kube_data_auth_enabled" { type = bool default = true