Skip to content

Commit bea39e7

Browse files
author
Kevin Jayne
authored
Merge pull request #49 from pluralsh/kevin/eng-2023-flesh-out-remaining-existing-cluster-setups
Kevin/eng 2023 flesh out remaining existing cluster setups
2 parents b3c797e + 982a79c commit bea39e7

File tree

6 files changed

+133
-9
lines changed

6 files changed

+133
-9
lines changed

‎charts/runtime/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ apiVersion: v2
22
name: runtime
33
description: Sets up the basic dependencies needed to get a network stack running
44
type: application
5-
version: 0.1.21
5+
version: 0.1.22
66
appVersion: "0.1.0"
77
dependencies:
88
- name: external-dns

‎charts/runtime/values.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,12 @@ ingress-nginx-private:
8080
networking.gke.io/load-balancer-type: "Internal"
8181
service.beta.kubernetes.io/azure-load-balancer-internal: "true"
8282
service.beta.kubernetes.io/aws-load-balancer-scheme: internal
83+
service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
84+
service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: 'true'
85+
service.beta.kubernetes.io/aws-load-balancer-type: external
86+
service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
87+
service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*"
88+
service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: '3600'
8389
admissionWebhooks:
8490
enabled: false
8591
config:
@@ -156,7 +162,14 @@ ingress-nginx:
156162
enabled: false
157163
service:
158164
annotations:
165+
service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
159166
service.beta.kubernetes.io/azure-load-balancer-health-probe-request-path: /healthz
167+
service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
168+
service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: 'true'
169+
service.beta.kubernetes.io/aws-load-balancer-type: external
170+
service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
171+
service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*"
172+
service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: '3600'
160173
config:
161174
worker-shutdown-timeout: 240s
162175
proxy-body-size: '0'

‎existing/terraform/aws/iam.tf‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
module "assumable_role_certmanager" {
2+
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
3+
version = "3.14.0"
4+
create_role = true
5+
role_name = "${var.cluster_name}-certmanager-extdns"
6+
provider_url = var.cluster_oidc_issuer_arn
7+
role_policy_arns = [aws_iam_policy.certmanager.arn]
8+
oidc_fully_qualified_subjects = [
9+
"system:serviceaccount:${var.externaldns_namespace}:${var.externaldns_serviceaccount}",
10+
"system:serviceaccount:${var.namespace}:${var.certmanager_serviceaccount}"
11+
]
12+
}
13+
14+
resource "aws_iam_policy" "certmanager" {
15+
name_prefix = "certmanager"
16+
description = "certmanager permissions for ${var.cluster_name}"
17+
policy = <<-POLICY
18+
{
19+
"Version": "2012-10-17",
20+
"Statement": [
21+
{
22+
"Effect": "Allow",
23+
"Action": "route53:GetChange",
24+
"Resource": "arn:aws:route53:::change/*"
25+
},
26+
{
27+
"Effect": "Allow",
28+
"Action": [
29+
"route53:ChangeResourceRecordSets",
30+
"route53:ListResourceRecordSets",
31+
"route53:ListHostedZones"
32+
],
33+
"Resource": "arn:aws:route53:::hostedzone/*"
34+
},
35+
{
36+
"Effect": "Allow",
37+
"Action": "route53:ListHostedZones",
38+
"Resource": "*"
39+
}
40+
]
41+
}
42+
POLICY
43+
}

‎existing/terraform/aws/variables.tf‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
2+
3+
variable "cluster_name" {
4+
description = "The name of the EKS cluster"
5+
type = string
6+
}
7+
8+
variable "cluster_oidc_issuer_arn" {
9+
type = string
10+
description = "The OIDC issuer URL of the EKS cluster"
11+
}
12+
13+
variable "certmanager_serviceaccount" {
14+
type = string
15+
default = "certmanager"
16+
description = "name of the certmanager service account"
17+
}
18+
19+
variable "namespace" {
20+
type = string
21+
default = "bootstrap"
22+
}
23+
24+
variable "externaldns_serviceaccount" {
25+
type = string
26+
default = "externaldns"
27+
description = "name of the external dns service account"
28+
}
29+
30+
variable "externaldns_namespace" {
31+
type = string
32+
default = "plrl-runtime"
33+
description = "name of the external dns namespace"
34+
}

‎helm/certmanager.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,8 @@ serviceAccount:
33
name: cert-manager
44
annotations:
55
plural.sh/dummy: 'ignore'
6-
# azure.workload.identity/client-id: 027c5496-d46b-40d3-8f92-a0f44dcf3500 # uncomment and update for azure
6+
# eks.amazonaws.com/role-arn: "arn:aws:iam::ACCOUNT-ID:role/plrl-console-eks-certmanager-extdns" # uncomment and update for aws
7+
# azure.workload.identity/client-id: XXXXXXXX-XXX-XXXX-XXXX-XXXXXXXXXXXX # uncomment and update for azure
78

89
securityContext:
910
fsGroup: 1000

‎helm/runtime.yaml‎

Lines changed: 40 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,8 @@ external-dns:
2121
name: externaldns
2222
annotations:
2323
plural.sh/dummy: ignore
24-
# azure.workload.identity/client-id: 027c5496-d46b-40d3-8f92-a0f44dcf3500 # uncomment and update for azure
24+
# eks.amazonaws.com/role-arn: "arn:aws:iam::ACCOUNT-ID:role/plrl-console-eks-certmanager-extdns" # uncomment and update for aws
25+
# azure.workload.identity/client-id: XXXXXXXX-XXX-XXXX-XXXX-XXXXXXXXXXXX # uncomment and update for azure
2526

2627
podLabels:
2728
azure.workload.identity/use: "true"
@@ -33,9 +34,41 @@ external-dns:
3334
domainFilters:
3435
- az.plural.sh # <- you need to change this
3536

36-
# For azure
37-
# azure:
38-
# useWorkloadIdentityExtension: true
39-
# resourceGroup: <YOUR_RESOURCE_GROUP>
40-
# tenantId: <YOUR_TENANT_ID>
41-
# subscriptionId: <YOUR_SUBSCRIPTION_ID>
37+
# For azure
38+
# azure:
39+
# useWorkloadIdentityExtension: true
40+
# resourceGroup: <YOUR_RESOURCE_GROUP>
41+
# tenantId: <YOUR_TENANT_ID>
42+
# subscriptionId: <YOUR_SUBSCRIPTION_ID>
43+
44+
# For aws
45+
# ingress-nginx:
46+
# controller:
47+
# service:
48+
# annotations:
49+
# service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
50+
# service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
51+
# service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: 'true'
52+
# service.beta.kubernetes.io/aws-load-balancer-type: external
53+
# service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
54+
# service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*"
55+
# service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: '3600'
56+
# config:
57+
# compute-full-forwarded-for: 'true'
58+
# use-forwarded-headers: 'true'
59+
# use-proxy-protocol: 'true'
60+
61+
# ingress-nginx-private:
62+
# controller:
63+
# service:
64+
# annotations:
65+
# service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
66+
# service.beta.kubernetes.io/aws-load-balancer-cross-zone-load-balancing-enabled: 'true'
67+
# service.beta.kubernetes.io/aws-load-balancer-type: external
68+
# service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip
69+
# service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*"
70+
# service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: '3600'
71+
# config:
72+
# compute-full-forwarded-for: 'true'
73+
# use-forwarded-headers: 'true'
74+
# use-proxy-protocol: 'true'

0 commit comments

Comments
 (0)