-
Notifications
You must be signed in to change notification settings - Fork 0
/
ingress.tf
97 lines (80 loc) · 2.74 KB
/
ingress.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
# See https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.6/deploy/installation
################################################################################
# IAM Policy allowing Nodes access to AWS ALB and NLB
#
# See https://github.com/kubernetes-sigs/aws-load-balancer-controller/blob/main/docs/install/iam_policy.json
# See https://github.com/terraform-aws-modules/terraform-aws-iam/blob/v5.33.0/modules/iam-role-for-service-accounts-eks/policies.tf
################################################################################
module "aws_alb_irsa_role" {
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
role_name = "${module.shared.eks_cluster_id}-aws-alb-${module.shared_private.region}"
# Auto attach required IAM Policy
attach_load_balancer_controller_policy = true
oidc_providers = {
main = {
provider_arn = module.shared.eks_cluster_oidc_provider_arn
namespace_service_accounts = ["kube-system:aws-load-balancer-controller"]
}
}
tags = var.default_resource_tags
}
################################################################################
# Helm Provider
################################################################################
provider "helm" {
kubernetes {
config_path = "~/.kube/config"
config_context = module.shared.eks_cluster_arn
}
}
################################################################################
# Deploy aws-load-balancer-controller
################################################################################
resource "helm_release" "aws_load_balancer_controller" {
name = "aws-load-balancer-controller"
repository = "https://aws.github.io/eks-charts"
chart = "aws-load-balancer-controller"
version = "1.6.2"
namespace = "kube-system"
set {
name = "nodeSelector.instancegroup"
value = "vendorcorp-core"
}
set {
name = "tolerations[0].key"
value = "dedicated"
}
set {
name = "tolerations[0].value"
value = "vendorcorp-core"
}
set {
name = "tolerations[0].operator"
value = "Equal"
}
set {
name = "tolerations[0].effect"
value = "NoSchedule"
}
set {
name = "clusterName"
value = module.shared.eks_cluster_id
}
set {
name = "serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn"
value = module.aws_alb_irsa_role.iam_role_arn
}
set {
name = "serviceAccount.create"
value = true
}
set {
name = "serviceAccount.name"
value = "aws-load-balancer-controller"
}
# See https://docs.aws.amazon.com/elasticloadbalancing/latest/application/create-https-listener.html#describe-ssl-policies
set {
name = "defaultSSLPolicy"
value = "ELBSecurityPolicy-TLS13-1-2-2021-06"
}
}