Initial commit from kro/examples/aws/eks-cluster-mgmt

charts/pod-identity/templates/_helpers.tpl

@@ -0,0 +1,74 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "pod-identity.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "pod-identity.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "pod-identity.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "pod-identity.labels" -}}
+helm.sh/chart: {{ include "pod-identity.chart" . }}
+{{ include "pod-identity.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "pod-identity.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "pod-identity.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "pod-identity.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "pod-identity.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+{{/*
+Construct a dynamic ARN based on the values passed from ArgoCD or values.yaml.
+*/}}
+{{- define "pod-identity.resourceArn" -}}
+arn:aws:{{ .resourceType }}:{{ .region }}:{{ .accountId }}:{{ .resourceName }}
+{{- end }}
+{{- define "pod-identity.accountID" -}}
+{{ .accountId }}
+{{- end }}
+{{- define "pod-identity.region" -}}
+{{ .region }}
+{{- end }}

charts/pod-identity/templates/pod-identity-association.yaml

@@ -0,0 +1,27 @@
+{{- if .Values.create | default false }}
+{{- $cluster := .Values.podIdentityAssociation.clusterName -}}
+{{- $namespace := .Values.podIdentityAssociation.namespace -}}
+{{- $tags := .Values.podIdentityAssociation.tags -}}
+{{- $root := . -}}
+{{- $serviceAccounts := .Values.podIdentityAssociation.serviceAccounts -}}
+{{- range $serviceAccounts }}
+apiVersion: eks.services.k8s.aws/v1alpha1
+kind: PodIdentityAssociation
+metadata:
+  name: "{{ include "pod-identity.fullname" $root }}-{{ . }}"
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+spec:
+  clusterName: {{ $cluster }}
+  roleRef: 
+    from: 
+      name: "{{ include "pod-identity.fullname" $root }}"
+  namespace: {{ $namespace }}
+  serviceAccount: {{ . }}
+  {{- if $tags}}
+  tags:
+    {{- $tags| toYaml | nindent 10  }}
+  {{- end }}
+---
+{{- end }}
+{{- end }}

charts/pod-identity/templates/pod-identity-policy.yaml

@@ -0,0 +1,56 @@
+{{- if and (.Values.create | default false) (.Values.podIdentityPolicyCreate | default false) }}
+apiVersion: iam.services.k8s.aws/v1alpha1
+kind: Policy
+metadata:
+  name: {{ include "pod-identity.fullname" . }}
+  annotations:
+    argocd.argoproj.io/sync-wave: "-3"
+spec:
+  name: {{ include "pod-identity.fullname" . }}
+  description: {{ .Values.podIdentityPolicy.description }}
+  {{- if .Values.podIdentityPolicy.path }}
+  path: {{ .Values.podIdentityPolicy.path }}
+  {{- end }}
+  policyDocument: |
+    {
+      "Version": "2012-10-17",
+      "Statement": [
+        {{- range $index, $policy := .Values.podIdentityPolicy.policies }}
+        {
+          "Effect": "Allow",
+          "Action": [
+            {{- range $i, $action := $policy.actions }}
+            "{{ $action }}"{{ if not (eq (add $i 1) (len $policy.actions)) }},{{ end }}
+            {{- end }}
+          ],
+          "Resource": [
+            {{- if $policy.customArn }}
+            "{{ $policy.customArn }}"
+            {{- else if eq $policy.resourceName "*" }}
+            "*"
+            {{- else }}
+            "arn:aws:{{ $policy.resourceType }}:{{ $.Values.region }}:{{ $.Values.accountId }}:{{ $policy.resourceName }}"
+            {{- end }}
+          ]
+          {{- if $policy.conditions }}
+          ,"Condition": {
+            {{- range $j, $condition := $policy.conditions }}
+            "{{ $condition.test }}": {
+              "{{ $condition.variable }}": [
+                {{- range $k, $value := $condition.values }}
+                "{{ $value }}"{{ if not (eq (add $k 1) (len $condition.values)) }},{{ end }}
+                {{- end }}
+              ]
+            }
+            {{- end }}
+          }
+          {{- end }}
+        }{{ if not (eq (add $index 1) (len $.Values.podIdentityPolicy.policies)) }},{{ end }}
+        {{- end }}
+      ]
+    }
+  {{- if .Values.podIdentityPolicy.tags }}
+  tags:
+    {{- .Values.podIdentityPolicy.tags | toYaml | nindent 10 }}
+  {{- end }}
+{{- end }}

charts/pod-identity/templates/pod-identity-role.yaml

@@ -0,0 +1,66 @@
+{{- if .Values.create | default false }}
+apiVersion: iam.services.k8s.aws/v1alpha1
+kind: Role
+metadata:
+  name: {{ include "pod-identity.fullname" . }}
+  annotations:
+    argocd.argoproj.io/sync-wave: "-2"
+spec:
+  name: {{ include "pod-identity.fullname" . }}
+  assumeRolePolicyDocument: |
+    {
+      "Version": "2012-10-17",
+      "Statement": [
+        {
+          "Effect": "Allow",
+          "Principal": {
+            "Service": "pods.eks.amazonaws.com"
+          },
+          "Action": [
+            "sts:TagSession",
+            "sts:AssumeRole"
+          ]
+        }
+      ]
+    }
+  description: {{ .Values.podIdentityRole.description }}
+
+  {{- if .Values.podIdentityRole.managedPolicies }}
+  policies:
+    {{- if and (.Values.podIdentityPolicyCreate | default false) .Values.podIdentityRole.managedPolicies }}
+    - "arn:aws:iam::{{ $.Values.accountId }}:policy/{{ include "pod-identity.fullname" . }}"
+    {{- end }}
+    {{- range .Values.podIdentityRole.managedPolicies }}
+    - "{{ . }}"
+    {{- end }}
+  
+  {{- else if .Values.podIdentityRole.policyRefs }}
+  policyRefs:
+    {{- if .Values.podIdentityPolicyCreate | default true }}
+    - from:
+        name: "{{ include "pod-identity.fullname" . }}"
+    {{- end }}
+    {{- range .Values.podIdentityRole.policyRefs }}
+    - from:
+        name: "{{ .name }}"
+        {{- if .namespace }}
+        namespace: "{{ .namespace }}"
+        {{- end }}
+    {{- end }}
+
+  {{- else }}
+  policyRefs:
+    - from:
+        name: "{{ include "pod-identity.fullname" . }}"
+  {{- end }}
+
+  {{- if .Values.podIdentityRole.inlinePolicies }}
+  inlinePolicies:
+    {{ .Values.podIdentityRole.inlinePolicies | toYaml | nindent 4 }}
+  {{- end }}
+
+  {{- if .Values.podIdentityRole.tags }}
+  tags:
+    {{ .Values.podIdentityRole.tags | toYaml | nindent 4 }}
+  {{- end }}
+{{- end }}