Skip to content
This repository was archived by the owner on Jan 31, 2021. It is now read-only.

Commit 0b20d18

Browse files
aknyshaknysh
authored
Initial implementation (#1)
* Init repo * Initial implementation * Add `terraform.tfvars` to the example * Address CR * Address CR
1 parent 8227556 commit 0b20d18

File tree

16 files changed

+647
-5
lines changed

16 files changed

+647
-5
lines changed

‎.gitignore‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,8 @@
55
*.tfstate
66
*.tfstate.*
77

8-
# .tfvars files
9-
*.tfvars
8+
**/.idea
9+
**/*.iml
10+
11+
**/.build-harness
12+
**/build-harness

‎.travis.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
addons:
2+
apt:
3+
packages:
4+
- git
5+
- make
6+
- curl
7+
8+
install:
9+
- make init
10+
11+
script:
12+
- make terraform/install
13+
- make terraform/get-plugins
14+
- make terraform/get-modules
15+
- make terraform/lint
16+
- make terraform/validate

‎LICENSE‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -178,15 +178,15 @@
178178
APPENDIX: How to apply the Apache License to your work.
179179

180180
To apply the Apache License to your work, attach the following
181-
boilerplate notice, with the fields enclosed by brackets "[]"
181+
boilerplate notice, with the fields enclosed by brackets "{}"
182182
replaced with your own identifying information. (Don't include
183183
the brackets!) The text should be enclosed in the appropriate
184184
comment syntax for the file format. We also recommend that a
185185
file or class name and description of purpose be included on the
186186
same "printed page" as the copyright notice for easier
187187
identification within third-party archives.
188188

189-
Copyright [yyyy] [name of copyright owner]
189+
Copyright 2019 Cloud Posse, LLC
190190

191191
Licensed under the Apache License, Version 2.0 (the "License");
192192
you may not use this file except in compliance with the License.

‎Makefile‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
SHELL := /bin/bash
2+
3+
# List of targets the `readme` target should call before generating the readme
4+
export README_DEPS ?= docs/targets.md docs/terraform.md
5+
6+
-include $(shell curl -sSL -o .build-harness "https://git.io/build-harness"; echo .build-harness)
7+
8+
## Lint terraform code
9+
lint:
10+
$(SELF) terraform/install terraform/get-modules terraform/get-plugins terraform/lint terraform/validate

‎README.md‎

Lines changed: 297 additions & 1 deletion
Large diffs are not rendered by default.

‎README.yaml‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
---
2+
#
3+
# This is the canonical configuration for the `README.md`
4+
# Run `make readme` to rebuild the `README.md`
5+
#
6+
7+
# Name of this project
8+
name: terraform-aws-kops-iam-authenticator-config
9+
10+
# Tags of this project
11+
tags:
12+
- aws
13+
- terraform
14+
- terraform-modules
15+
- kops
16+
- kubernetes
17+
- iam
18+
- iam-authenticator
19+
20+
# Logo for this project
21+
#logo: docs/logo.png
22+
23+
# License of this project
24+
license: "APACHE2"
25+
26+
# Canonical GitHub repo
27+
github_repo: cloudposse/terraform-aws-kops-iam-authenticator-config
28+
29+
# Badges to display
30+
badges:
31+
- name: "Build Status"
32+
image: "https://travis-ci.org/cloudposse/terraform-aws-kops-iam-authenticator-config.svg?branch=master"
33+
url: "https://travis-ci.org/cloudposse/terraform-aws-kops-iam-authenticator-config"
34+
- name: "Latest Release"
35+
image: "https://img.shields.io/github/release/cloudposse/terraform-aws-kops-iam-authenticator-config.svg"
36+
url: "https://github.com/cloudposse/terraform-aws-kops-iam-authenticator-config/releases/latest"
37+
- name: "Slack Community"
38+
image: "https://slack.cloudposse.com/badge.svg"
39+
url: "https://slack.cloudposse.com"
40+
41+
related:
42+
- name: "terraform-aws-kops-metadata"
43+
description: "Terraform module to lookup resources within a Kops cluster for easier integration with Terraform"
44+
url: "https://github.com/cloudposse/terraform-aws-kops-metadata"
45+
- name: "terraform-aws-kops-vpc-peering"
46+
description: "Terraform module to create a peering connection between a backing services VPC and a VPC created by Kops"
47+
url: "https://github.com/cloudposse/terraform-aws-kops-vpc-peering"
48+
- name: "terraform-aws-kops-ecr"
49+
description: "Terraform module to provision an ECR repository and grant users and kubernetes nodes access to it."
50+
url: "https://github.com/cloudposse/terraform-aws-kops-ecr"
51+
- name: "terraform-aws-kops-state-backend"
52+
description: "Easily bootstrap kops clusters (DNS & S3 Bucket)"
53+
url: "https://github.com/cloudposse/terraform-aws-kops-state-backend"
54+
- name: "terraform-aws-kops-external-dns"
55+
description: "Terraform module to provision an IAM role for external-dns running in a Kops cluster, and attach an IAM policy to the role with permissions to modify Route53 record sets"
56+
url: "https://github.com/cloudposse/terraform-aws-kops-external-dns"
57+
- name: "terraform-aws-kops-route53"
58+
description: "Terraform module to lookup the IAM role associated with `kops` masters, and attach an IAM policy to the role with permissions to modify Route53 record sets"
59+
url: "https://github.com/cloudposse/terraform-aws-kops-route53"
60+
- name: "terraform-aws-kops-vault-backend"
61+
description: "Terraform module to provision an S3 bucket for HashiCorp Vault secrets storage, and an IAM role and policy with permissions for Kops nodes to access the bucket"
62+
url: "https://github.com/cloudposse/terraform-aws-kops-vault-backend"
63+
- name: "terraform-aws-kops-chart-repo"
64+
description: "Terraform module to provision an S3 bucket for Helm chart repository, and an IAM role and policy with permissions for Kops nodes to access the bucket"
65+
url: "https://github.com/cloudposse/terraform-aws-kops-chart-repo"
66+
- name: "terraform-aws-eks-cluster"
67+
description: "Terraform module to provision an EKS cluster on AWS"
68+
url: "https://github.com/cloudposse/terraform-aws-eks-cluster"
69+
- name: "terraform-aws-eks-workers"
70+
description: "Terraform module to provision an AWS AutoScaling Group, IAM Role, and Security Group for EKS Workers"
71+
url: "https://github.com/cloudposse/terraform-aws-eks-workers"
72+
- name: "terraform-aws-ec2-autoscale-group"
73+
description: "Terraform module to provision AutoScaling Group and Launch Template on AWS"
74+
url: "https://github.com/cloudposse/terraform-aws-ec2-autoscale-group"
75+
76+
# Short description of this project
77+
description: |-
78+
Terraform module to create and apply a [`Kubernetes`](https://kubernetes.io/) ConfigMap to map AWS IAM roles to Kubernetes users/groups.
79+
This will configure clusters managed by [`kops`](https://github.com/kubernetes/kops) to use [`aws-iam-authenticator`](https://github.com/kubernetes-sigs/aws-iam-authenticator),
80+
allowing to use AWS IAM credentials to authenticate to a Kubernetes cluster.
81+
82+
83+
# How to use this project
84+
usage: |-
85+
86+
```hcl
87+
module "iam_authenticator_config" {
88+
source = "git::https://github.com/cloudposse/terraform-aws-kops-iam-authenticator-config.git?ref=master"
89+
cluster_id = "us-west-2.testing.example.com"
90+
kube_config_path = "/.kube/config"
91+
admin_iam_role_arn = "arn:aws:iam::000000000000:role/KubernetesAdmin"
92+
admin_k8s_username = "kubernetes-admin"
93+
admin_k8s_groups = ["system:masters"]
94+
readonly_iam_role_arn = "arn:aws:iam::000000000000:role/KubernetesReadonly"
95+
readonly_k8s_username = "kubernetes-readonly"
96+
readonly_k8s_groups = ["system:authenticated"]
97+
}
98+
```
99+
100+
references:
101+
- name: "Kops Authentication"
102+
description: "Describes what support Kops has for configuring authentication systems"
103+
url: "https://github.com/kubernetes/kops/blob/master/docs/authentication.md"
104+
- name: "aws-iam-authenticator"
105+
description: "A tool to use AWS IAM credentials to authenticate to a Kubernetes cluster"
106+
url: "https://github.com/kubernetes-sigs/aws-iam-authenticator"
107+
- name: "Getting Started with Terraform Kubernetes provider"
108+
description: "Getting Started with Terraform Kubernetes provider"
109+
url: "https://www.terraform.io/docs/providers/kubernetes/guides/getting-started.html"
110+
- name: "Terraform Kubernetes Provider"
111+
description: "Terraform Kubernetes Provider with examples"
112+
url: "https://www.terraform.io/docs/providers/kubernetes/index.html"
113+
- name: "Kubernetes RBAC Authorization"
114+
description: "Using Kubernetes RBAC Authorization"
115+
url: "https://kubernetes.io/docs/reference/access-authn-authz/rbac"
116+
117+
include:
118+
- "docs/targets.md"
119+
- "docs/terraform.md"
120+
121+
# Contributors to this project
122+
contributors:
123+
- name: "Erik Osterman"
124+
homepage: "https://github.com/osterman"
125+
github: "osterman"
126+
- name: "Andriy Knysh"
127+
homepage: "https://github.com/aknysh"
128+
github: "aknysh"

‎config.tpl‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
clusterID: ${cluster_id}
2+
server:
3+
mapRoles:
4+
- roleARN: ${admin_iam_role_arn}
5+
username: ${admin_k8s_username}
6+
groups: ${admin_k8s_groups}
7+
- roleARN: ${readonly_iam_role_arn}
8+
username: ${readonly_k8s_username}
9+
groups: ${readonly_k8s_groups}

‎docs/targets.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
## Makefile Targets
2+
```
3+
Available targets:
4+
5+
help Help screen
6+
help/all Display help for all targets
7+
help/short This help short screen
8+
lint Lint terraform code
9+
10+
```

‎docs/terraform.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
## Inputs
2+
3+
| Name | Description | Type | Default | Required |
4+
|------|-------------|:----:|:-----:|:-----:|
5+
| admin_iam_role_arn | IAM Role with admin permissions to map to `admin_k8s_username` | string | - | yes |
6+
| admin_k8s_groups | List of Kubernetes groups to be mapped to `admin_iam_role_arn` | list | `<list>` | no |
7+
| admin_k8s_username | Kubernetes admin username to be mapped to `admin_iam_role_arn` | string | `` | no |
8+
| cluster_id | A unique-per-cluster identifier to prevent replay attacks. Good choices are a random token or a domain name that will be unique to your cluster | string | - | yes |
9+
| kube_config_path | Path to the kube config file. Can be sourced from `KUBE_CONFIG` or `KUBECONFIG` | string | - | yes |
10+
| readonly_iam_role_arn | IAM Role with readonly permissions to map to `readonly_k8s_username` | string | - | yes |
11+
| readonly_k8s_groups | List of Kubernetes groups to be mapped to `readonly_iam_role_arn` | list | `<list>` | no |
12+
| readonly_k8s_username | Kubernetes readonly username to be mapped to `readonly_iam_role_arn` | string | `` | no |
13+
14+
## Outputs
15+
16+
| Name | Description |
17+
|------|-------------|
18+
| kubeconfig_path | kubeconfig path |
19+

‎examples/complete/.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
.terraform
2+
**/.terraform/*
3+
*.tfstate
4+
*.tfstate.*

0 commit comments

Comments
 (0)