-
Notifications
You must be signed in to change notification settings - Fork 0
/
kube-albc.tf
78 lines (66 loc) · 2.1 KB
/
kube-albc.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
module "irsa_role_load_balancer_controller" {
source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
role_name = "${var.cluster_name}-irsa-load-balancer-controller"
attach_load_balancer_controller_policy = true
oidc_providers = {
kubesys = {
provider_arn = module.eks.oidc_provider_arn
namespace_service_accounts = [
"kube-system:aws-load-balancer-controller",
]
}
}
}
resource "kubernetes_service_account" "aws_load_balancer_controller" {
automount_service_account_token = true
metadata {
name = "aws-load-balancer-controller"
namespace = "kube-system"
annotations = {
# This annotation is only used when running on EKS which can
# use IAM roles for service accounts.
"eks.amazonaws.com/role-arn" = module.irsa_role_load_balancer_controller.iam_role_arn
}
labels = {
"app.kubernetes.io/name" = "aws-load-balancer-controller"
"app.kubernetes.io/managed-by" = "terraform"
}
}
}
resource "helm_release" "aws_load_balancer_controller" {
name = "aws-load-balancer-controller"
chart = "aws-load-balancer-controller"
repository = "https://aws.github.io/eks-charts"
namespace = "kube-system"
cleanup_on_fail = true
set {
name = "clusterName"
value = var.cluster_name
}
set {
name = "serviceAccount.name"
value = "aws-load-balancer-controller"
}
set {
name = "serviceAccount.create"
value = "false"
}
depends_on = [
kubernetes_service_account.aws_load_balancer_controller,
]
}
module "origin_certificate" {
source = "terraform-aws-modules/acm/aws"
version = "~> 3.4.1"
domain_name = "origin.${var.domain_name}"
zone_id = data.aws_route53_zone.zone.id
tags = var.tags
## terraform likes to destroy these before we get a chance to use them to
## destroy the ALB we created that uses this certificate. so prevent destroy
depends_on = [
module.irsa_role_load_balancer_controller,
helm_release.aws_load_balancer_controller,
module.vpc,
module.eks,
]
}