Added EKS Automode Feature

aws-auth-auto-mode.tf

@@ -0,0 +1,41 @@
+################################################################################
+# Access Entry
+################################################################################
+
+data "aws_iam_session_context" "current" {
+
+  # This data source provides information on the IAM source role of an STS assumed role
+  # For non-role ARNs, this data source simply passes the ARN through issuer ARN
+  arn = try(data.aws_caller_identity.current.arn, "")
+}
+
+
+resource "aws_eks_access_entry" "this" {
+  for_each = { for k, v in local.merged_access_entries : k => v if var.create }
+
+  cluster_name      = aws_eks_cluster.default[0].id
+  kubernetes_groups = try(each.value.kubernetes_groups, null)
+  principal_arn     = each.value.principal_arn
+  type              = try(each.value.type, "STANDARD")
+  user_name         = try(each.value.user_name, null)
+
+  tags = merge(var.tags, try(each.value.tags, {}))
+}
+
+resource "aws_eks_access_policy_association" "this" {
+  for_each = { for k, v in local.flattened_access_entries : "${v.entry_key}_${v.pol_key}" => v if var.create }
+
+  access_scope {
+    namespaces = try(each.value.association_access_scope_namespaces, [])
+    type       = each.value.association_access_scope_type
+  }
+
+  cluster_name = aws_eks_cluster.default[0].id
+
+  policy_arn    = each.value.association_policy_arn
+  principal_arn = each.value.principal_arn
+
+  depends_on = [
+    aws_eks_access_entry.this,
+  ]
+}

aws_auth.tf

@@ -27,28 +27,7 @@
 # https://docs.aws.amazon.com/cli/latest/userguide/install-bundle.html
 # https://docs.aws.amazon.com/cli/latest/userguide/install-cliv1.html
 
-
-locals {
-  certificate_authority_data_list          = coalescelist(aws_eks_cluster.default.*.certificate_authority, [[{ data : "" }]])
-  certificate_authority_data_list_internal = local.certificate_authority_data_list[0]
-  certificate_authority_data_map           = local.certificate_authority_data_list_internal[0]
-  certificate_authority_data               = local.certificate_authority_data_map["data"]
-
-  # Add worker nodes role ARNs (could be from many un-managed worker groups) to the ConfigMap
-  # Note that we don't need to do this for managed Node Groups since EKS adds their roles to the ConfigMap automatically
-  map_worker_roles = [
-    {
-      rolearn : aws_iam_role.node_groups.0.arn
-      username : "system:node:{{EC2PrivateDNSName}}"
-      groups : [
-        "system:bootstrappers",
-        "system:nodes"
-      ]
-    }
-  ]
-}
-
 data "template_file" "kubeconfig" {
   count    = var.enabled ? 1 : 0
   template = file("${path.module}/kubeconfig.tpl")
 
@@ -88,9 +67,9 @@
 }
 
 provider "kubernetes" {
-  token                  = data.aws_eks_cluster_auth.eks[0].token
-  host                   = data.aws_eks_cluster.eks[0].endpoint
-  cluster_ca_certificate = base64decode(data.aws_eks_cluster.eks[0].certificate_authority.0.data)
+  token                  = var.apply_config_map_aws_auth ? data.aws_eks_cluster_auth.eks[0].token : ""
+  host                   = var.apply_config_map_aws_auth ? data.aws_eks_cluster.eks[0].endpoint : ""
+  cluster_ca_certificate = var.apply_config_map_aws_auth ? base64decode(data.aws_eks_cluster.eks[0].certificate_authority[0].data) : ""
 }
 
 resource "kubernetes_config_map" "aws_auth_ignore_changes" {

examples/eks-auto-mode/deployment.yaml

@@ -0,0 +1,33 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: inflate
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: inflate
+  template:
+    metadata:
+      labels:
+        app: inflate
+    spec:
+      terminationGracePeriodSeconds: 0
+      containers:
+        - name: inflate
+          image: nginx
+          resources:
+            requests:
+              cpu: 1
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: inflate
+spec:
+  selector:
+    app: inflate
+  ports:
+  - port: 80
+    targetPort: 80
+  type: LoadBalancer