Skip to content

Commit 8ea10c0

Browse files
maxsxumaxsxu
authored
feat: add iam submodule for managing applications iam (#162)
<!-- ~ Copyright 2023 StreamNative, Inc. ~ ~ Licensed under the Apache License, Version 2.0 (the "License"); ~ you may not use this file except in compliance with the License. ~ You may obtain a copy of the License at ~ ~ http://www.apache.org/licenses/LICENSE-2.0 ~ ~ Unless required by applicable law or agreed to in writing, software ~ distributed under the License is distributed on an "AS IS" BASIS, ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. ~ See the License for the specific language governing permissions and ~ limitations under the License. --> <!-- ### Contribution Checklist - Fill out the template below to describe the changes contributed by the pull request. That will give reviewers the context they need to do the review. - Each pull request should address only one issue, not mix up code from multiple issues. - Each commit in the pull request has a meaningful commit message - Once all items of the checklist are addressed, remove the above text and this checklist, leaving only the filled out template below. **(The sections below can be removed for hotfixes of typos)** --> ### Motivation Provide a unified iam module to managing all the IAM roles, policies required by StreamNative Cloud Infra applications. ### Modifications - `aws_load_balancer_controller_arn` - `cert_manager_arn` - `cluster_autoscaler_arn` - `csi_arn` - `external_dns_arn` - `karpenter_arn` - `velero_arn` ### Verifying this change - [x] Make sure that the change passes the CI checks. *(Please pick either of the following options)* This change is a trivial rework / code cleanup without any test coverage. *(or)* This change is already covered by existing tests, such as *(please describe tests)*. *(or)* This change added tests and can be verified as follows: *(example:)* - *Added integration tests for end-to-end deployment with large payloads (10MB)* - *Extended integration test for recovery after broker failure* ### Documentation - [x] `doc` --------- Signed-off-by: Max Xu <[email protected]>
1 parent 9e5a88b commit 8ea10c0

File tree

12 files changed

+834
-0
lines changed

12 files changed

+834
-0
lines changed

‎modules/iam/README.md‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
!--
2+
~ Copyright 2025 StreamNative, Inc.
3+
~
4+
~ Licensed under the Apache License, Version 2.0 (the "License");
5+
~ you may not use this file except in compliance with the License.
6+
~ You may obtain a copy of the License at
7+
~
8+
~ http://www.apache.org/licenses/LICENSE-2.0
9+
~
10+
~ Unless required by applicable law or agreed to in writing, software
11+
~ distributed under the License is distributed on an "AS IS" BASIS,
12+
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
~ See the License for the specific language governing permissions and
14+
~ limitations under the License.
15+
-->
16+
17+
# IAM Module
18+
A basic module used to create IAM Roles, Policies for StreamNative Cloud Applications.
19+
20+
<!-- BEGIN_TF_DOCS -->
21+
## Requirements
22+
23+
| Name | Version |
24+
|------|---------|
25+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >=1.2.0 |
26+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.64.2 |
27+
28+
## Providers
29+
30+
| Name | Version |
31+
|------|---------|
32+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.64.2 |
33+
34+
## Modules
35+
36+
No modules.
37+
38+
## Resources
39+
40+
| Name | Type |
41+
|------|------|
42+
| [aws_iam_role.aws_load_balancer_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
43+
| [aws_iam_role.cert_manager](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
44+
| [aws_iam_role.cluster_autoscaler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
45+
| [aws_iam_role.csi](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
46+
| [aws_iam_role.external_dns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
47+
| [aws_iam_role.karpenter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
48+
| [aws_iam_role.velero](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
49+
| [aws_iam_role_policy.karpenter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
50+
| [aws_iam_role_policy_attachment.aws_load_balancer_controller](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
51+
| [aws_iam_role_policy_attachment.cert_manager](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
52+
| [aws_iam_role_policy_attachment.cluster_autoscaler](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
53+
| [aws_iam_role_policy_attachment.csi](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
54+
| [aws_iam_role_policy_attachment.csi_managed](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
55+
| [aws_iam_role_policy_attachment.external_dns](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
56+
| [aws_iam_role_policy_attachment.velero](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
57+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
58+
| [aws_iam_policy_document.aws_load_balancer_controller_sts](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
59+
| [aws_iam_policy_document.cert_manager_sts](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
60+
| [aws_iam_policy_document.cluster_autoscaler_sts](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
61+
| [aws_iam_policy_document.csi_sts](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
62+
| [aws_iam_policy_document.external_dns_sts](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
63+
| [aws_iam_policy_document.karpenter](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
64+
| [aws_iam_policy_document.karpenter_sts](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
65+
| [aws_iam_policy_document.velero_sts](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
66+
| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
67+
68+
## Inputs
69+
70+
| Name | Description | Type | Default | Required |
71+
|------|-------------|------|---------|:--------:|
72+
| <a name="input_backup_bucket"></a> [backup\_bucket](#input\_backup\_bucket) | The name of the s3 bucket to use for backups | `string` | n/a | yes |
73+
| <a name="input_cluster_name"></a> [cluster\_name](#input\_cluster\_name) | The name of the cluster | `string` | n/a | yes |
74+
| <a name="input_cluster_node_group_iam_role_arn"></a> [cluster\_node\_group\_iam\_role\_arn](#input\_cluster\_node\_group\_iam\_role\_arn) | n/a | `string` | n/a | yes |
75+
| <a name="input_enable_karpenter"></a> [enable\_karpenter](#input\_enable\_karpenter) | Enable karpenter for autoscaling. If set to false, no karpenter resources will be created. | `bool` | `false` | no |
76+
| <a name="input_enable_velero"></a> [enable\_velero](#input\_enable\_velero) | Enable velero for backups. If set to false, no velero resources will be created. | `bool` | `true` | no |
77+
| <a name="input_extra_aws_tags"></a> [extra\_aws\_tags](#input\_extra\_aws\_tags) | extra aws tags to add to any resources | `map(string)` | `{}` | no |
78+
| <a name="input_load_balancer_policy_arn_override"></a> [load\_balancer\_policy\_arn\_override](#input\_load\_balancer\_policy\_arn\_override) | Override the runtime policy arn, otherwise will construct an arn | `string` | `""` | no |
79+
| <a name="input_oidc_issuer"></a> [oidc\_issuer](#input\_oidc\_issuer) | The oidc issuer for the cluster | `string` | n/a | yes |
80+
| <a name="input_permissions_boundary_arn_override"></a> [permissions\_boundary\_arn\_override](#input\_permissions\_boundary\_arn\_override) | Override the permission boundary arn, otherwise will construct an arn | `string` | `""` | no |
81+
| <a name="input_region"></a> [region](#input\_region) | AWS Region | `string` | n/a | yes |
82+
| <a name="input_runtime_policy_arn_override"></a> [runtime\_policy\_arn\_override](#input\_runtime\_policy\_arn\_override) | Override the runtime policy arn, otherwise will construct an arn | `string` | `""` | no |
83+
| <a name="input_s3_encryption_kms_key_arn"></a> [s3\_encryption\_kms\_key\_arn](#input\_s3\_encryption\_kms\_key\_arn) | KMS key ARN to use for S3 encryption. If not set, the default AWS S3 key will be used. | `string` | `""` | no |
84+
| <a name="input_velero_backup_schedule"></a> [velero\_backup\_schedule](#input\_velero\_backup\_schedule) | The scheduled time for Velero to perform backups. Written in cron expression, defaults to "0 5 * * *" or "at 5:00am every day" | `string` | `"0 5 * * *"` | no |
85+
86+
## Outputs
87+
88+
| Name | Description |
89+
|------|-------------|
90+
| <a name="output_aws_load_balancer_controller_arn"></a> [aws\_load\_balancer\_controller\_arn](#output\_aws\_load\_balancer\_controller\_arn) | n/a |
91+
| <a name="output_cert_manager_arn"></a> [cert\_manager\_arn](#output\_cert\_manager\_arn) | n/a |
92+
| <a name="output_cluster_autoscaler_arn"></a> [cluster\_autoscaler\_arn](#output\_cluster\_autoscaler\_arn) | n/a |
93+
| <a name="output_csi_arn"></a> [csi\_arn](#output\_csi\_arn) | n/a |
94+
| <a name="output_external_dns_arn"></a> [external\_dns\_arn](#output\_external\_dns\_arn) | n/a |
95+
| <a name="output_karpenter_arn"></a> [karpenter\_arn](#output\_karpenter\_arn) | n/a |
96+
| <a name="output_velero_arn"></a> [velero\_arn](#output\_velero\_arn) | n/a |
97+
<!-- END_TF_DOCS -->

‎modules/iam/aws_load_balancer_controller.tf‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
data "aws_iam_policy_document" "aws_load_balancer_controller_sts" {
2+
statement {
3+
actions = [
4+
"sts:AssumeRoleWithWebIdentity"
5+
]
6+
effect = "Allow"
7+
principals {
8+
type = "Federated"
9+
identifiers = [format("arn:%s:iam::%s:oidc-provider/%s", local.aws_partition, local.account_id, local.oidc_issuer)]
10+
}
11+
condition {
12+
test = "StringLike"
13+
values = [format("system:serviceaccount:%s:%s", "kube-system", "aws-load-balancer-controller")]
14+
variable = format("%s:sub", local.oidc_issuer)
15+
}
16+
}
17+
}
18+
19+
resource "aws_iam_role" "aws_load_balancer_controller" {
20+
name = format("%s-lbc-role", var.cluster_name)
21+
description = format("Role used by IRSA and the KSA aws-load-balancer-controller on StreamNative Cloud EKS cluster %s", var.cluster_name)
22+
assume_role_policy = data.aws_iam_policy_document.aws_load_balancer_controller_sts.json
23+
path = "/StreamNative/"
24+
permissions_boundary = local.permissions_boundary_arn
25+
tags = local.tags
26+
}
27+
28+
resource "aws_iam_role_policy_attachment" "aws_load_balancer_controller" {
29+
role = aws_iam_role.aws_load_balancer_controller.name
30+
policy_arn = local.default_lb_policy_arn
31+
}

‎modules/iam/cert_manager.tf‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
data "aws_iam_policy_document" "cert_manager_sts" {
2+
statement {
3+
actions = [
4+
"sts:AssumeRoleWithWebIdentity"
5+
]
6+
effect = "Allow"
7+
principals {
8+
type = "Federated"
9+
identifiers = [format("arn:%s:iam::%s:oidc-provider/%s", local.aws_partition, local.account_id, local.oidc_issuer)]
10+
}
11+
condition {
12+
test = "StringLike"
13+
values = [format("system:serviceaccount:%s:%s", "kube-system", "cert-manager-controller")]
14+
variable = format("%s:sub", local.oidc_issuer)
15+
}
16+
}
17+
}
18+
19+
resource "aws_iam_role" "cert_manager" {
20+
name = format("%s-cm-role", var.cluster_name)
21+
description = format("Role assumed by IRSA and the KSA cert-manager on StreamNative Cloud EKS cluster %s", var.cluster_name)
22+
assume_role_policy = data.aws_iam_policy_document.cert_manager_sts.json
23+
path = "/StreamNative/"
24+
permissions_boundary = local.permissions_boundary_arn
25+
tags = local.tags
26+
}
27+
28+
resource "aws_iam_role_policy_attachment" "cert_manager" {
29+
role = aws_iam_role.cert_manager.name
30+
policy_arn = local.default_service_policy_arn
31+
}

‎modules/iam/cluster_autoscaler.tf‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
data "aws_iam_policy_document" "cluster_autoscaler_sts" {
2+
count = var.enable_karpenter ? 1 : 0
3+
4+
statement {
5+
actions = [
6+
"sts:AssumeRoleWithWebIdentity"
7+
]
8+
effect = "Allow"
9+
principals {
10+
type = "Federated"
11+
identifiers = [format("arn:%s:iam::%s:oidc-provider/%s", local.aws_partition, local.account_id, local.oidc_issuer)]
12+
}
13+
condition {
14+
test = "StringEquals"
15+
values = [format("system:serviceaccount:%s:%s", "kube-system", "cluster-autoscaler")]
16+
variable = format("%s:sub", local.oidc_issuer)
17+
}
18+
condition {
19+
test = "StringEquals"
20+
values = ["sts.amazonaws.com"]
21+
variable = format("%s:aud", local.oidc_issuer)
22+
}
23+
}
24+
}
25+
26+
resource "aws_iam_role" "cluster_autoscaler" {
27+
count = var.enable_karpenter ? 1 : 0
28+
29+
name = format("%s-ca-role", var.cluster_name)
30+
description = format("Role used by IRSA and the KSA cluster-autoscaler on StreamNative Cloud EKS cluster %s", var.cluster_name)
31+
assume_role_policy = data.aws_iam_policy_document.cluster_autoscaler_sts.0.json
32+
path = "/StreamNative/"
33+
permissions_boundary = local.permissions_boundary_arn
34+
tags = local.tags
35+
}
36+
37+
resource "aws_iam_role_policy_attachment" "cluster_autoscaler" {
38+
count = var.enable_karpenter ? 1 : 0
39+
40+
policy_arn = local.default_service_policy_arn
41+
role = aws_iam_role.cluster_autoscaler.0.name
42+
}

‎modules/iam/csi.tf‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
data "aws_iam_policy_document" "csi_sts" {
2+
statement {
3+
actions = [
4+
"sts:AssumeRoleWithWebIdentity"
5+
]
6+
effect = "Allow"
7+
principals {
8+
type = "Federated"
9+
identifiers = [format("arn:%s:iam::%s:oidc-provider/%s", local.aws_partition, local.account_id, local.oidc_issuer)]
10+
}
11+
condition {
12+
test = "StringEquals"
13+
values = [format("system:serviceaccount:%s:%s", "kube-system", "ebs-csi-controller-sa")]
14+
variable = format("%s:sub", local.oidc_issuer)
15+
}
16+
condition {
17+
test = "StringEquals"
18+
values = ["sts.amazonaws.com"]
19+
variable = format("%s:aud", local.oidc_issuer)
20+
}
21+
}
22+
}
23+
24+
resource "aws_iam_role" "csi" {
25+
name = format("%s-csi-role", var.cluster_name)
26+
description = format("Role used by IRSA and the KSA ebs-csi-controller-sa on StreamNative Cloud EKS cluster %s", var.cluster_name)
27+
assume_role_policy = data.aws_iam_policy_document.csi_sts.json
28+
path = "/StreamNative/"
29+
permissions_boundary = local.permissions_boundary_arn
30+
tags = local.tags
31+
}
32+
33+
resource "aws_iam_role_policy_attachment" "csi" {
34+
role = aws_iam_role.csi.name
35+
policy_arn = local.default_service_policy_arn
36+
}
37+
38+
resource "aws_iam_role_policy_attachment" "csi_managed" {
39+
role = aws_iam_role.csi.name
40+
policy_arn = "arn:${local.aws_partition}:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
41+
}

‎modules/iam/external_dns.tf‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
data "aws_iam_policy_document" "external_dns_sts" {
2+
statement {
3+
actions = [
4+
"sts:AssumeRoleWithWebIdentity"
5+
]
6+
effect = "Allow"
7+
principals {
8+
type = "Federated"
9+
identifiers = [format("arn:%s:iam::%s:oidc-provider/%s", local.aws_partition, local.account_id, local.oidc_issuer)]
10+
}
11+
condition {
12+
test = "StringLike"
13+
values = [format("system:serviceaccount:%s:%s", "kube-system", "external-dns")]
14+
variable = format("%s:sub", local.oidc_issuer)
15+
}
16+
}
17+
}
18+
19+
resource "aws_iam_role" "external_dns" {
20+
name = format("%s-extdns-role", var.cluster_name)
21+
description = format("Role used by IRSA and the KSA external-dns on StreamNative Cloud EKS cluster %s", var.cluster_name)
22+
assume_role_policy = data.aws_iam_policy_document.external_dns_sts.json
23+
path = "/StreamNative/"
24+
permissions_boundary = local.permissions_boundary_arn
25+
tags = local.tags
26+
}
27+
28+
resource "aws_iam_role_policy_attachment" "external_dns" {
29+
role = aws_iam_role.external_dns.name
30+
policy_arn = local.default_service_policy_arn
31+
}

0 commit comments

Comments
 (0)