Initial commit from kro/examples/aws/eks-cluster-mgmt

2026-04-21 09:55:53 -03:00
parent 0585444299
commit 7d11fd5889
66 changed files with 3667 additions and 0 deletions
@@ -0,0 +1,63 @@
+{{- $cluster := .Values.clusterName -}}
+{{- $namespace := .Values.piNamespace -}}
+{{- $name := .Values.name -}}
+{{- $root := . -}}
+{{- $serviceAccounts := .Values.serviceAccounts -}}
+{{- $policyDocument := .Values.policyDocument -}}
+{{- range $serviceAccounts }}
+apiVersion: kro.run/v1alpha1
+kind: PodIdentity
+metadata:
+  name: "{{ include "kro-pi-instance.name" $root }}-{{ . }}"
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+    argocd.argoproj.io/sync-wave: "-5"
+spec:
+  name: {{$name}}
+  values:
+    aws:
+      clusterName: {{ $cluster }}
+    policy:
+      policyDocument: |
+        {
+          "Version": "2012-10-17",
+          "Statement": [
+            {{- range $index, $policy := $policyDocument }}
+            {
+              "Effect": "Allow",
+              "Action": [
+                {{- range $i, $action := $policy.actions }}
+                "{{ $action }}"{{ if not (eq (add $i 1) (len $policy.actions)) }},{{ end }}
+                {{- end }}
+              ],
+              "Resource": [
+                {{- if $policy.customArn }}
+                "{{ $policy.customArn }}"
+                {{- else if eq $policy.resourceName "*" }}
+                "*"
+                {{- else }}
+                "arn:aws:{{ $policy.resourceType }}:{{ $.Values.region }}:{{ $.Values.accountId }}:{{ $policy.resourceName }}"
+                {{- end }}
+              ]
+              {{- if $policy.conditions }}
+              ,"Condition": {
+                {{- range $j, $condition := $policy.conditions }}
+                "{{ $condition.test }}": {
+                  "{{ $condition.variable }}": [
+                    {{- range $k, $value := $condition.values }}
+                    "{{ $value }}"{{ if not (eq (add $k 1) (len $condition.values)) }},{{ end }}
+                    {{- end }}
+                  ]
+                }
+                {{- end }}
+              }
+              {{- end }}
+            }{{ if not (eq (add $index 1) (len $.Values.policyDocument)) }},{{ end }}
+            {{- end }}
+          ]
+        }
+    piAssociation:
+      serviceAccount: {{ . }}
+      piNamespace: {{ $namespace }}
+---
+{{- end}}