Initial commit from kro/examples/aws/eks-cluster-mgmt
This commit is contained in:
@@ -0,0 +1,23 @@
|
||||
# Patterns to ignore when building packages.
|
||||
# This supports shell glob matching, relative path matching, and
|
||||
# negation (prefixed with !). Only one pattern per line.
|
||||
.DS_Store
|
||||
# Common VCS dirs
|
||||
.git/
|
||||
.gitignore
|
||||
.bzr/
|
||||
.bzrignore
|
||||
.hg/
|
||||
.hgignore
|
||||
.svn/
|
||||
# Common backup files
|
||||
*.swp
|
||||
*.bak
|
||||
*.tmp
|
||||
*.orig
|
||||
*~
|
||||
# Various IDEs
|
||||
.project
|
||||
.idea/
|
||||
*.tmproj
|
||||
.vscode/
|
||||
@@ -0,0 +1,24 @@
|
||||
apiVersion: v2
|
||||
name: pod-identity
|
||||
description: A Helm chart for Kubernetes
|
||||
|
||||
# A chart can be either an 'application' or a 'library' chart.
|
||||
#
|
||||
# Application charts are a collection of templates that can be packaged into versioned archives
|
||||
# to be deployed.
|
||||
#
|
||||
# Library charts provide useful utilities or functions for the chart developer. They're included as
|
||||
# a dependency of application charts to inject those utilities and functions into the rendering
|
||||
# pipeline. Library charts do not define any templates and therefore cannot be deployed.
|
||||
type: application
|
||||
|
||||
# This is the chart version. This version number should be incremented each time you make changes
|
||||
# to the chart and its templates, including the app version.
|
||||
# Versions are expected to follow Semantic Versioning (https://semver.org/)
|
||||
version: 0.1.0
|
||||
|
||||
# This is the version number of the application being deployed. This version number should be
|
||||
# incremented each time you make changes to the application. Versions are not expected to
|
||||
# follow Semantic Versioning. They should reflect the version the application is using.
|
||||
# It is recommended to use it with quotes.
|
||||
appVersion: "1.16.0"
|
||||
@@ -0,0 +1,74 @@
|
||||
{{/*
|
||||
Expand the name of the chart.
|
||||
*/}}
|
||||
{{- define "pod-identity.name" -}}
|
||||
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create a default fully qualified app name.
|
||||
We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
|
||||
If release name contains chart name it will be used as a full name.
|
||||
*/}}
|
||||
{{- define "pod-identity.fullname" -}}
|
||||
{{- if .Values.fullnameOverride }}
|
||||
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- $name := default .Chart.Name .Values.nameOverride }}
|
||||
{{- if contains $name .Release.Name }}
|
||||
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
{{- else }}
|
||||
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create chart name and version as used by the chart label.
|
||||
*/}}
|
||||
{{- define "pod-identity.chart" -}}
|
||||
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Common labels
|
||||
*/}}
|
||||
{{- define "pod-identity.labels" -}}
|
||||
helm.sh/chart: {{ include "pod-identity.chart" . }}
|
||||
{{ include "pod-identity.selectorLabels" . }}
|
||||
{{- if .Chart.AppVersion }}
|
||||
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
|
||||
{{- end }}
|
||||
app.kubernetes.io/managed-by: {{ .Release.Service }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Selector labels
|
||||
*/}}
|
||||
{{- define "pod-identity.selectorLabels" -}}
|
||||
app.kubernetes.io/name: {{ include "pod-identity.name" . }}
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
{{- end }}
|
||||
|
||||
{{/*
|
||||
Create the name of the service account to use
|
||||
*/}}
|
||||
{{- define "pod-identity.serviceAccountName" -}}
|
||||
{{- if .Values.serviceAccount.create }}
|
||||
{{- default (include "pod-identity.fullname" .) .Values.serviceAccount.name }}
|
||||
{{- else }}
|
||||
{{- default "default" .Values.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{/*
|
||||
Construct a dynamic ARN based on the values passed from ArgoCD or values.yaml.
|
||||
*/}}
|
||||
{{- define "pod-identity.resourceArn" -}}
|
||||
arn:aws:{{ .resourceType }}:{{ .region }}:{{ .accountId }}:{{ .resourceName }}
|
||||
{{- end }}
|
||||
{{- define "pod-identity.accountID" -}}
|
||||
{{ .accountId }}
|
||||
{{- end }}
|
||||
{{- define "pod-identity.region" -}}
|
||||
{{ .region }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,27 @@
|
||||
{{- if .Values.create | default false }}
|
||||
{{- $cluster := .Values.podIdentityAssociation.clusterName -}}
|
||||
{{- $namespace := .Values.podIdentityAssociation.namespace -}}
|
||||
{{- $tags := .Values.podIdentityAssociation.tags -}}
|
||||
{{- $root := . -}}
|
||||
{{- $serviceAccounts := .Values.podIdentityAssociation.serviceAccounts -}}
|
||||
{{- range $serviceAccounts }}
|
||||
apiVersion: eks.services.k8s.aws/v1alpha1
|
||||
kind: PodIdentityAssociation
|
||||
metadata:
|
||||
name: "{{ include "pod-identity.fullname" $root }}-{{ . }}"
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "-1"
|
||||
spec:
|
||||
clusterName: {{ $cluster }}
|
||||
roleRef:
|
||||
from:
|
||||
name: "{{ include "pod-identity.fullname" $root }}"
|
||||
namespace: {{ $namespace }}
|
||||
serviceAccount: {{ . }}
|
||||
{{- if $tags}}
|
||||
tags:
|
||||
{{- $tags| toYaml | nindent 10 }}
|
||||
{{- end }}
|
||||
---
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,56 @@
|
||||
{{- if and (.Values.create | default false) (.Values.podIdentityPolicyCreate | default false) }}
|
||||
apiVersion: iam.services.k8s.aws/v1alpha1
|
||||
kind: Policy
|
||||
metadata:
|
||||
name: {{ include "pod-identity.fullname" . }}
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "-3"
|
||||
spec:
|
||||
name: {{ include "pod-identity.fullname" . }}
|
||||
description: {{ .Values.podIdentityPolicy.description }}
|
||||
{{- if .Values.podIdentityPolicy.path }}
|
||||
path: {{ .Values.podIdentityPolicy.path }}
|
||||
{{- end }}
|
||||
policyDocument: |
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{{- range $index, $policy := .Values.podIdentityPolicy.policies }}
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
{{- range $i, $action := $policy.actions }}
|
||||
"{{ $action }}"{{ if not (eq (add $i 1) (len $policy.actions)) }},{{ end }}
|
||||
{{- end }}
|
||||
],
|
||||
"Resource": [
|
||||
{{- if $policy.customArn }}
|
||||
"{{ $policy.customArn }}"
|
||||
{{- else if eq $policy.resourceName "*" }}
|
||||
"*"
|
||||
{{- else }}
|
||||
"arn:aws:{{ $policy.resourceType }}:{{ $.Values.region }}:{{ $.Values.accountId }}:{{ $policy.resourceName }}"
|
||||
{{- end }}
|
||||
]
|
||||
{{- if $policy.conditions }}
|
||||
,"Condition": {
|
||||
{{- range $j, $condition := $policy.conditions }}
|
||||
"{{ $condition.test }}": {
|
||||
"{{ $condition.variable }}": [
|
||||
{{- range $k, $value := $condition.values }}
|
||||
"{{ $value }}"{{ if not (eq (add $k 1) (len $condition.values)) }},{{ end }}
|
||||
{{- end }}
|
||||
]
|
||||
}
|
||||
{{- end }}
|
||||
}
|
||||
{{- end }}
|
||||
}{{ if not (eq (add $index 1) (len $.Values.podIdentityPolicy.policies)) }},{{ end }}
|
||||
{{- end }}
|
||||
]
|
||||
}
|
||||
{{- if .Values.podIdentityPolicy.tags }}
|
||||
tags:
|
||||
{{- .Values.podIdentityPolicy.tags | toYaml | nindent 10 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,66 @@
|
||||
{{- if .Values.create | default false }}
|
||||
apiVersion: iam.services.k8s.aws/v1alpha1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: {{ include "pod-identity.fullname" . }}
|
||||
annotations:
|
||||
argocd.argoproj.io/sync-wave: "-2"
|
||||
spec:
|
||||
name: {{ include "pod-identity.fullname" . }}
|
||||
assumeRolePolicyDocument: |
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Principal": {
|
||||
"Service": "pods.eks.amazonaws.com"
|
||||
},
|
||||
"Action": [
|
||||
"sts:TagSession",
|
||||
"sts:AssumeRole"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
description: {{ .Values.podIdentityRole.description }}
|
||||
|
||||
{{- if .Values.podIdentityRole.managedPolicies }}
|
||||
policies:
|
||||
{{- if and (.Values.podIdentityPolicyCreate | default false) .Values.podIdentityRole.managedPolicies }}
|
||||
- "arn:aws:iam::{{ $.Values.accountId }}:policy/{{ include "pod-identity.fullname" . }}"
|
||||
{{- end }}
|
||||
{{- range .Values.podIdentityRole.managedPolicies }}
|
||||
- "{{ . }}"
|
||||
{{- end }}
|
||||
|
||||
{{- else if .Values.podIdentityRole.policyRefs }}
|
||||
policyRefs:
|
||||
{{- if .Values.podIdentityPolicyCreate | default true }}
|
||||
- from:
|
||||
name: "{{ include "pod-identity.fullname" . }}"
|
||||
{{- end }}
|
||||
{{- range .Values.podIdentityRole.policyRefs }}
|
||||
- from:
|
||||
name: "{{ .name }}"
|
||||
{{- if .namespace }}
|
||||
namespace: "{{ .namespace }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
{{- else }}
|
||||
policyRefs:
|
||||
- from:
|
||||
name: "{{ include "pod-identity.fullname" . }}"
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.podIdentityRole.inlinePolicies }}
|
||||
inlinePolicies:
|
||||
{{ .Values.podIdentityRole.inlinePolicies | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.podIdentityRole.tags }}
|
||||
tags:
|
||||
{{ .Values.podIdentityRole.tags | toYaml | nindent 4 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,61 @@
|
||||
# region: us-west-2
|
||||
# accountId: "471112582304"
|
||||
# create: true
|
||||
# podIdentityPolicyCreate: false
|
||||
# podIdentityRole:
|
||||
# description: "Test"
|
||||
# # Only one of the two can be true Managed Policy or Policy Refs
|
||||
# # If Policy is created it will automatically add it on managed Policies or PolicyRefs
|
||||
# managedPolicies:
|
||||
# - "arn:aws:iam::aws:policy/AmazonSSMReadOnlyAccess"
|
||||
# - "arn:aws:iam::aws:policy/Admin"
|
||||
# policyRefs:
|
||||
# - name: "custom-policy-1"
|
||||
# namespace: kube-system
|
||||
# - name: "AmazonSSMReadOnlyAccess"
|
||||
# namespace: kube-system
|
||||
# podIdentityAssociation:
|
||||
# clusterName: control-plane
|
||||
# namespace: default
|
||||
# serviceAccounts:
|
||||
# - serviceAccount1
|
||||
# - serviceAccount2
|
||||
# podIdentityPolicy:
|
||||
# description: "Test"
|
||||
# policies:
|
||||
# - resourceType: ssm
|
||||
# resourceName: "*"
|
||||
# actions:
|
||||
# - "ssm:DescribeParameters"
|
||||
# - resourceType: ssm
|
||||
# resourceName: parameter/*
|
||||
# actions:
|
||||
# - "ssm:GetParameter"
|
||||
# - "ssm:GetParameters"
|
||||
# - resourceType: secretsmanager
|
||||
# resourceName: secret:*
|
||||
# actions:
|
||||
# - "secretsmanager:GetResourcePolicy"
|
||||
# - "secretsmanager:GetSecretValue"
|
||||
# - "secretsmanager:DescribeSecret"
|
||||
# - "secretsmanager:ListSecretVersionIds"
|
||||
# - "secretsmanager:CreateSecret"
|
||||
# - "secretsmanager:PutSecretValue"
|
||||
# - "secretsmanager:TagResource"
|
||||
# - resourceType: secretsmanager
|
||||
# resourceName: secret:*
|
||||
# actions:
|
||||
# - "secretsmanager:DeleteSecret"
|
||||
# conditions:
|
||||
# - test: "StringEquals"
|
||||
# variable: "secretsmanager:ResourceTag/managed-by"
|
||||
# values:
|
||||
# - "external-secrets"
|
||||
# - resourceType: kms
|
||||
# resourceName: "key/*"
|
||||
# actions:
|
||||
# - "kms:Decrypt"
|
||||
# - resourceType: ecr
|
||||
# resourceName: "*"
|
||||
# actions:
|
||||
# - "ecr:GetAuthorizationToken"
|
||||
Reference in New Issue
Block a user