Skip to content

Commit 1cdb405

Browse files
bryantbiggsbryantbiggs
authored
feat: Add support for pganalyze (#48)
1 parent 1fd99db commit 1cdb405

File tree

7 files changed

+327
-3
lines changed

7 files changed

+327
-3
lines changed

‎README.md‎

Lines changed: 200 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,14 @@ module "custom_pod_identity" {
5151
additional = aws_iam_policy.additional.arn
5252
}
5353
54+
associations = {
55+
custom-association = {
56+
cluster_name = "custom-cluster"
57+
namespace = "custom-namespace"
58+
service_account = "custom-service-account"
59+
}
60+
}
61+
5462
tags = {
5563
Environment = "dev"
5664
}
@@ -67,6 +75,14 @@ module "aws_gateway_controller_pod_identity" {
6775
6876
attach_aws_gateway_controller_policy = true
6977
78+
associations = {
79+
this = {
80+
cluster_name = "example"
81+
namespace = "aws-application-networking-system"
82+
service_account = "gateway-api-controller"
83+
}
84+
}
85+
7086
tags = {
7187
Environment = "dev"
7288
}
@@ -84,6 +100,14 @@ module "cert_manager_pod_identity" {
84100
attach_cert_manager_policy = true
85101
cert_manager_hosted_zone_arns = ["arn:aws:route53:::hostedzone/IClearlyMadeThisUp"]
86102
103+
associations = {
104+
this = {
105+
cluster_name = "example"
106+
namespace = "cert-manager"
107+
service_account = "cert-manager"
108+
}
109+
}
110+
87111
tags = {
88112
Environment = "dev"
89113
}
@@ -100,13 +124,20 @@ module "aws_cloudwatch_observability_pod_identity" {
100124
101125
attach_aws_cloudwatch_observability_policy = true
102126
127+
associations = {
128+
this = {
129+
cluster_name = "example"
130+
namespace = "amazon-cloudwatch"
131+
service_account = "cloudwatch-agent"
132+
}
133+
}
134+
103135
tags = {
104136
Environment = "dev"
105137
}
106138
}
107139
```
108140

109-
110141
### [Cluster Autoscaler](https://github.com/kubernetes/autoscaler)
111142

112143
```hcl
@@ -118,6 +149,14 @@ module "cluster_autoscaler_pod_identity" {
118149
attach_cluster_autoscaler_policy = true
119150
cluster_autoscaler_cluster_names = ["foo"]
120151
152+
associations = {
153+
this = {
154+
cluster_name = "example"
155+
namespace = "kube-system"
156+
service_account = "cluster-autoscaler-sa"
157+
}
158+
}
159+
121160
tags = {
122161
Environment = "dev"
123162
}
@@ -135,6 +174,14 @@ module "aws_ebs_csi_pod_identity" {
135174
attach_aws_ebs_csi_policy = true
136175
aws_ebs_csi_kms_arns = ["arn:aws:kms:*:*:key/1234abcd-12ab-34cd-56ef-1234567890ab"]
137176
177+
associations = {
178+
this = {
179+
cluster_name = "example"
180+
namespace = "kube-system"
181+
service_account = "ebs-csi-controller-sa"
182+
}
183+
}
184+
138185
tags = {
139186
Environment = "dev"
140187
}
@@ -151,6 +198,14 @@ module "aws_efs_csi_pod_identity" {
151198
152199
attach_aws_efs_csi_policy = true
153200
201+
associations = {
202+
this = {
203+
cluster_name = "example"
204+
namespace = "kube-system"
205+
service_account = "efs-csi-controller-sa"
206+
}
207+
}
208+
154209
tags = {
155210
Environment = "dev"
156211
}
@@ -168,6 +223,14 @@ module "external_dns_pod_identity" {
168223
attach_external_dns_policy = true
169224
external_dns_hosted_zone_arns = ["arn:aws:route53:::hostedzone/IClearlyMadeThisUp"]
170225
226+
associations = {
227+
this = {
228+
cluster_name = "example"
229+
namespace = "external-dns"
230+
service_account = "external-dns-sa"
231+
}
232+
}
233+
171234
tags = {
172235
Environment = "dev"
173236
}
@@ -188,6 +251,14 @@ module "external_secrets_pod_identity" {
188251
external_secrets_kms_key_arns = ["arn:aws:kms:*:*:key/1234abcd-12ab-34cd-56ef-1234567890ab"]
189252
external_secrets_create_permission = true
190253
254+
associations = {
255+
this = {
256+
cluster_name = "example"
257+
namespace = "external-secrets"
258+
service_account = "external-secrets-sa"
259+
}
260+
}
261+
191262
tags = {
192263
Environment = "dev"
193264
}
@@ -205,6 +276,14 @@ module "aws_fsx_lustre_csi_pod_identity" {
205276
attach_aws_fsx_lustre_csi_policy = true
206277
aws_fsx_lustre_csi_service_role_arns = ["arn:aws:iam::*:role/aws-service-role/s3.data-source.lustre.fsx.amazonaws.com/*"]
207278
279+
associations = {
280+
this = {
281+
cluster_name = "example"
282+
namespace = "kube-system"
283+
service_account = "fsx-csi-controller-sa"
284+
}
285+
}
286+
208287
tags = {
209288
Environment = "dev"
210289
}
@@ -221,6 +300,14 @@ module "aws_lb_controller_pod_identity" {
221300
222301
attach_aws_lb_controller_policy = true
223302
303+
associations = {
304+
this = {
305+
cluster_name = "example"
306+
namespace = "kube-system"
307+
service_account = "aws-load-balancer-controller-sa"
308+
}
309+
}
310+
224311
tags = {
225312
Environment = "dev"
226313
}
@@ -238,6 +325,14 @@ module "aws_lb_controller_targetgroup_binding_only_pod_identity" {
238325
attach_aws_lb_controller_targetgroup_binding_only_policy = true
239326
aws_lb_controller_targetgroup_arns = ["arn:aws:elasticloadbalancing:*:*:targetgroup/foo/bar"]
240327
328+
associations = {
329+
this = {
330+
cluster_name = "example"
331+
namespace = "kube-system"
332+
service_account = "aws-load-balancer-controller-tgb-sa"
333+
}
334+
}
335+
241336
tags = {
242337
Environment = "dev"
243338
}
@@ -254,6 +349,14 @@ module "aws_appmesh_controller_pod_identity" {
254349
255350
attach_aws_appmesh_controller_policy = true
256351
352+
associations = {
353+
this = {
354+
cluster_name = "example"
355+
namespace = "appmesh-system"
356+
service_account = "appmesh-controller"
357+
}
358+
}
359+
257360
tags = {
258361
Environment = "dev"
259362
}
@@ -270,6 +373,14 @@ module "aws_appmesh_envoy_proxy_pod_identity" {
270373
271374
attach_aws_appmesh_envoy_proxy_policy = true
272375
376+
associations = {
377+
this = {
378+
cluster_name = "example"
379+
namespace = "appmesh-system"
380+
service_account = "envoy-proxy"
381+
}
382+
}
383+
273384
tags = {
274385
Environment = "dev"
275386
}
@@ -287,6 +398,14 @@ module "amazon_managed_service_prometheus_pod_identity" {
287398
attach_amazon_managed_service_prometheus_policy = true
288399
amazon_managed_service_prometheus_workspace_arns = ["arn:aws:prometheus:*:*:workspace/foo"]
289400
401+
associations = {
402+
this = {
403+
cluster_name = "example"
404+
namespace = "prometheus"
405+
service_account = "prometheus"
406+
}
407+
}
408+
290409
tags = {
291410
Environment = "dev"
292411
}
@@ -305,6 +424,14 @@ module "mountpoint_s3_csi_pod_identity" {
305424
mountpoint_s3_csi_bucket_arns = ["arn:aws:s3:::mountpoint-s3"]
306425
mountpoint_s3_csi_bucket_path_arns = ["arn:aws:s3:::mountpoint-s3/example/*"]
307426
427+
associations = {
428+
this = {
429+
cluster_name = "example"
430+
namespace = "kube-system"
431+
service_account = "s3-csi-driver-sa"
432+
}
433+
}
434+
308435
tags = {
309436
Environment = "dev"
310437
}
@@ -322,11 +449,20 @@ module "aws_node_termination_handler_pod_identity" {
322449
attach_aws_node_termination_handler_policy = true
323450
aws_node_termination_handler_sqs_queue_arns = ["arn:aws:sqs:*:*:eks-node-termination-handler"]
324451
452+
associations = {
453+
this = {
454+
cluster_name = "example"
455+
namespace = "aws-node-termination-handler"
456+
service_account = "aws-node-termination-handler-sa"
457+
}
458+
}
459+
325460
tags = {
326461
Environment = "dev"
327462
}
328463
}
329464
```
465+
330466
### [AWS Private CA Issuer](https://github.com/cert-manager/aws-privateca-issuer)
331467

332468
```hcl
@@ -338,6 +474,38 @@ module "aws_privateca_issuer_pod_identity" {
338474
attach_aws_privateca_issuer_policy = true
339475
aws_privateca_issuer_acmca_arns = ["arn:aws:acm-pca:*:*:certificate-authority/foo"]
340476
477+
associations = {
478+
this = {
479+
cluster_name = "example"
480+
namespace = "cert-manager"
481+
service_account = "aws-privateca-issuer-sa"
482+
}
483+
}
484+
485+
tags = {
486+
Environment = "dev"
487+
}
488+
}
489+
```
490+
491+
### [PGAnalyze](https://pganalyze.com/)
492+
493+
```hcl
494+
module "pganalyze_pod_identity" {
495+
source = "terraform-aws-modules/eks-pod-identity/aws"
496+
497+
name = "pganalyze"
498+
499+
attach_pganalyze_pod_identity_policy = true
500+
501+
associations = {
502+
this = {
503+
cluster_name = "example"
504+
namespace = "default"
505+
service_account = "pganalyze-service-account"
506+
}
507+
}
508+
341509
tags = {
342510
Environment = "dev"
343511
}
@@ -356,6 +524,14 @@ module "velero_pod_identity" {
356524
velero_s3_bucket_arns = ["arn:aws:s3:::velero-backups"]
357525
velero_s3_bucket_path_arns = ["arn:aws:s3:::velero-backups/example/*"]
358526
527+
associations = {
528+
this = {
529+
cluster_name = "example"
530+
namespace = "velero"
531+
service_account = "velero-server"
532+
}
533+
}
534+
359535
tags = {
360536
Environment = "dev"
361537
}
@@ -373,6 +549,14 @@ module "aws_vpc_cni_ipv4_pod_identity" {
373549
attach_aws_vpc_cni_policy = true
374550
aws_vpc_cni_enable_ipv4 = true
375551
552+
associations = {
553+
this = {
554+
cluster_name = "example"
555+
namespace = "kube-system"
556+
service_account = "aws-node"
557+
}
558+
}
559+
376560
tags = {
377561
Environment = "dev"
378562
}
@@ -390,6 +574,14 @@ module "aws_vpc_cni_ipv6_pod_identity" {
390574
attach_aws_vpc_cni_policy = true
391575
aws_vpc_cni_enable_ipv6 = true
392576
577+
associations = {
578+
this = {
579+
cluster_name = "example"
580+
namespace = "kube-system"
581+
service_account = "aws-node"
582+
}
583+
}
584+
393585
tags = {
394586
Environment = "dev"
395587
}
@@ -442,6 +634,7 @@ No modules.
442634
| [aws_iam_policy.lb_controller_targetgroup_only](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
443635
| [aws_iam_policy.mountpoint_s3_csi](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
444636
| [aws_iam_policy.node_termination_handler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
637+
| [aws_iam_policy.pganalyze](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
445638
| [aws_iam_policy.velero](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
446639
| [aws_iam_policy.vpc_cni](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
447640
| [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
@@ -463,9 +656,11 @@ No modules.
463656
| [aws_iam_role_policy_attachment.lb_controller_targetgroup_only](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
464657
| [aws_iam_role_policy_attachment.mountpoint_s3_csi](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
465658
| [aws_iam_role_policy_attachment.node_termination_handler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
659+
| [aws_iam_role_policy_attachment.pganalyze](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
466660
| [aws_iam_role_policy_attachment.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
467661
| [aws_iam_role_policy_attachment.velero](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
468662
| [aws_iam_role_policy_attachment.vpc_cni](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
663+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
469664
| [aws_iam_policy_document.amazon_managed_service_prometheus](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
470665
| [aws_iam_policy_document.appmesh_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
471666
| [aws_iam_policy_document.appmesh_envoy_proxy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
@@ -484,9 +679,11 @@ No modules.
484679
| [aws_iam_policy_document.lb_controller_targetgroup_only](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
485680
| [aws_iam_policy_document.mountpoint_s3_csi](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
486681
| [aws_iam_policy_document.node_termination_handler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
682+
| [aws_iam_policy_document.pganalyze](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
487683
| [aws_iam_policy_document.velero](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
488684
| [aws_iam_policy_document.vpc_cni](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
489685
| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
686+
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
490687

491688
## Inputs
492689

@@ -518,6 +715,7 @@ No modules.
518715
| <a name="input_attach_external_dns_policy"></a> [attach\_external\_dns\_policy](#input\_attach\_external\_dns\_policy) | Determines whether to attach the External DNS IAM policy to the role | `bool` | `false` | no |
519716
| <a name="input_attach_external_secrets_policy"></a> [attach\_external\_secrets\_policy](#input\_attach\_external\_secrets\_policy) | Determines whether to attach the External Secrets policy to the role | `bool` | `false` | no |
520717
| <a name="input_attach_mountpoint_s3_csi_policy"></a> [attach\_mountpoint\_s3\_csi\_policy](#input\_attach\_mountpoint\_s3\_csi\_policy) | Determines whether to attach the Mountpoint S3 CSI IAM policy to the role | `bool` | `false` | no |
718+
| <a name="input_attach_pganalyze_policy"></a> [attach\_pganalyze\_policy](#input\_attach\_pganalyze\_policy) | Determines whether to attach the PGAnalyze IAM policy to the role | `bool` | `false` | no |
521719
| <a name="input_attach_velero_policy"></a> [attach\_velero\_policy](#input\_attach\_velero\_policy) | Determines whether to attach the Velero IAM policy to the role | `bool` | `false` | no |
522720
| <a name="input_aws_ebs_csi_kms_arns"></a> [aws\_ebs\_csi\_kms\_arns](#input\_aws\_ebs\_csi\_kms\_arns) | KMS key ARNs to allow EBS CSI to manage encrypted volumes | `list(string)` | `[]` | no |
523721
| <a name="input_aws_ebs_csi_policy_name"></a> [aws\_ebs\_csi\_policy\_name](#input\_aws\_ebs\_csi\_policy\_name) | Custom name of the EBS CSI IAM policy | `string` | `null` | no |
@@ -558,6 +756,7 @@ No modules.
558756
| <a name="input_override_policy_documents"></a> [override\_policy\_documents](#input\_override\_policy\_documents) | List of IAM policy documents that are merged together into the exported document | `list(string)` | `[]` | no |
559757
| <a name="input_path"></a> [path](#input\_path) | Path of IAM role | `string` | `"/"` | no |
560758
| <a name="input_permissions_boundary_arn"></a> [permissions\_boundary\_arn](#input\_permissions\_boundary\_arn) | Permissions boundary ARN to use for IAM role | `string` | `null` | no |
759+
| <a name="input_pganalyze_policy_name"></a> [pganalyze\_policy\_name](#input\_pganalyze\_policy\_name) | Custom name of the PGAnalyze IAM policy | `string` | `null` | no |
561760
| <a name="input_policy_name_prefix"></a> [policy\_name\_prefix](#input\_policy\_name\_prefix) | IAM policy name prefix | `string` | `"AmazonEKS_"` | no |
562761
| <a name="input_policy_statements"></a> [policy\_statements](#input\_policy\_statements) | A list of IAM policy [statements](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document#statement) for custom permission usage | <pre>list(object({<br/> sid = optional(string)<br/> actions = optional(list(string))<br/> not_actions = optional(list(string))<br/> effect = optional(string)<br/> resources = optional(list(string))<br/> not_resources = optional(list(string))<br/> principals = optional(list(object({<br/> type = string<br/> identifiers = list(string)<br/> })))<br/> not_principals = optional(list(object({<br/> type = string<br/> identifiers = list(string)<br/> })))<br/> condition = optional(list(object({<br/> test = string<br/> values = list(string)<br/> variable = string<br/> })))<br/> }))</pre> | `null` | no |
563762
| <a name="input_region"></a> [region](#input\_region) | Region where the resource(s) will be managed. Defaults to the Region set in the provider configuration | `string` | `null` | no |

0 commit comments

Comments
 (0)