young-ook / terraform-aws-eks Goto Github PK

## default vpc
data "aws_vpc" "default" {
  default = true
}

data "aws_subnet_ids" "default" {
  vpc_id = data.aws_vpc.default.id
}

locals {
  subnet_ids = var.subnets == null ? data.aws_subnet_ids.default.ids : var.subnets
}

module "helm-addons" {
  depends_on = [module.eks-addons]
  source     = "Young-ook/eks/aws//modules/helm-addons"
  version    = "2.0.3"
  tags       = local.tags
  addons = [
    {
      repository     = "https://aws.github.io/eks-charts"
      name           = "aws-load-balancer-controller"
      chart_name     = "aws-load-balancer-controller"
      namespace      = "kube-system"
      serviceaccount = "aws-load-balancer-controller"
      values = module.eks.features.fargate_enabled ? {
        "vpcId"       = var.vpc_id
        "clusterName" = module.eks.cluster.name
        } : {
        "clusterName" = module.eks.cluster.name
      }
      oidc        = module.eks.oidc
      policy_arns = [aws_iam_policy.lbc.arn]
    },
    {
      repository = "https://kubernetes-sigs.github.io/aws-efs-csi-driver/"
      name = "aws-efs-csi-driver"
      chart_name = "aws-efs-csi-driver"
      namespace = "kube-system"
      serviceaccount = "aws-efs-csi-driver"
      oidc = module.eks.oidc
      policy_arns = [aws_iam_policy.efsc.arn]
    }
  ]
}

$ kubectl describe serviceaccount efs-csi-controller-sa --namespace kube-system
Name:                efs-csi-controller-sa
Namespace:           kube-system
Labels:              app.kubernetes.io/managed-by=Helm
                     app.kubernetes.io/name=aws-efs-csi-driver
Annotations:         meta.helm.sh/release-name: aws-efs-csi-driver
                     meta.helm.sh/release-namespace: kube-system
Image pull secrets:  <none>
Mountable secrets:   <none>
Tokens:              <none>
Events:              <none>

$ kubectl describe serviceaccount aws-load-balancer-controller --namespace kube-system
Name:                aws-load-balancer-controller
Namespace:           kube-system
Labels:              app.kubernetes.io/instance=aws-load-balancer-controller
                     app.kubernetes.io/managed-by=Helm
                     app.kubernetes.io/name=aws-load-balancer-controller
                     app.kubernetes.io/version=v2.4.7
                     helm.sh/chart=aws-load-balancer-controller-1.4.8
Annotations:         eks.amazonaws.com/role-arn: arn:aws:iam::111111111111:role/aws-load-balancer-controller
                     meta.helm.sh/release-name: aws-load-balancer-controller
                     meta.helm.sh/release-namespace: kube-system
Image pull secrets:  <none>
Mountable secrets:   <none>
Tokens:              <none>
Events:              <none>

helm upgrade -i aws-efs-csi-driver aws-efs-csi-driver/aws-efs-csi-driver \
    --namespace kube-system \
    --set image.repository=602401143452.dkr.ecr.region-code.amazonaws.com/eks/aws-efs-csi-driver \
    --set controller.serviceAccount.create=false \
    --set controller.serviceAccount.name=efs-csi-controller-sa

Normal   ExternalProvisioning  3m15s (x25 over 8m52s)  persistentvolume-controller                                                               waiting for a volume to be created, either by external provisioner "ebs.csi.aws.com" or manually created by system administrator
  Normal   Provisioning          20s (x11 over 8m52s)    ebs.csi.aws.com_ebs-csi-controller-7546dc6bf4-khsl9_720fd23f-e9a5-46d1-affa-753d0928b5db  External provisioner is provisioning volume for claim "cornerstone-dev/data-mysql-0"
  Warning  ProvisioningFailed    20s (x2 over 3m12s)     ebs.csi.aws.com_ebs-csi-controller-7546dc6bf4-khsl9_720fd23f-e9a5-46d1-affa-753d0928b5db  (combined from similar events): failed to provision volume with StorageClass "gp2": rpc error: code = Internal desc = Could not create volume "pvc-fa19888f-1e4e-4b73-8279-1b20526d2861": could not create volume in EC2: UnauthorizedOperation: You are not authorized to perform this operation. Encoded authorization failure message: 8Wtkt8RKjXJXPBvQYXO429ukRzMZLs24YVEz7h6wMMn56DnOFnyuWPFzAgTRge2I5w2sBfRK8zOCJodF7c5jtFpp1-AIuRu5sDoilDM22d3lkw7BTfDZ9EZF0_SG0VtLP9CLdIATnJzS9I5zOl_vJBPJDVp42u-k0HuGKGJ7TaokFBmfiFMGtaV2dUSEa4oXRc-rvl8Ty5iKVLjrnV65-OlCtVDR1YCd-O9FXM9mKI7ttvup8GOkIbV5PUaJFLiwgql3ypk-CMdT22QTzv1_8OZ2CFcAQGbpgebtSrM_FD1fdnOwIIFzp0DYkYm-hlmQ0EDO_clGg8CR55hF-SuvKdaDXRIj3rgTSwzQedbLkJqJf3sNJjnqiPjGTnKnFG3kAGLF6pcpIsi5d6jng3yc88dFIXVWLNzzVEt5v-WrKR-_J2QbysXbWqvrsGxsEK_da7DHixtDfylnuaOi41XBetysjAGZb4Dg1vGHpDgE8K4Wg4j8dkX0fPGHZAMfGHYhH9n0nEOlc-NJnYUEn9G6ej97yy9sMF88paK87KdObxmmzziMkVec9umJUiDv0tHaJkWmFsWVIkSSeK0FQKt2tuVtEr_uo8Tq6hUhEpX9Qs1hzH78RCqWFOxNtw9qUp4l5A
           status code: 403, request id: ab9443fa-1df9-42a1-a671-5d98bbe720dd

│ Error: error creating IAM Role (irsa-ew2-stack-eks01-eks_cluster): AccessDenied: User: arn:aws:sts::xxxxxxx:assumed-role/User-eu-west-2/xxxxxxx is not authorized to perform: iam:CreateRole on resource: arn:aws:iam::xxxxxxx:role/irsa-ew2-stack-eks01-eks_cluster with an explicit deny
│ status code: 403, request id: xxxx-xxxxx

│ on .terraform\modules\container-insights\modules\iam-role-for-serviceaccount\main.tf line 6, in resource "aws_iam_role" "irsa":
│ 6: resource "aws_iam_role" "irsa" {

  Type     Reason            Age                     From               Message
  ----     ------            ----                    ----               -------
  Warning  FailedScheduling  3m48s (x122 over 124m)  default-scheduler  no nodes available to schedule pods

$ kubectl get nodes -o wide --kubeconfig ./kubeconfig
No resources found

Error: could not download chart: failed to download "https://aws.github.io/eks-charts/aws-for-fluent-bit-0.1.22.tgz"
│
│   with module.helm-addons.helm_release.chart["aws-for-fluent-bit"],
│   on .terraform\modules\helm-addons\modules\helm-addons\main.tf line 2, in resource "helm_release" "chart":
│    2: resource "helm_release" "chart" {
│
╵
╷
│ Error: could not download chart: failed to download "https://aws.github.io/eks-charts/aws-load-balancer-controller-1.4.7.tgz"
│
│   with module.helm-addons.helm_release.chart["aws-load-balancer-controller"],
│   on .terraform\modules\helm-addons\modules\helm-addons\main.tf line 2, in resource "helm_release" "chart":
│    2: resource "helm_release" "chart" {
│
╵
╷
│ Error: could not download chart: failed to download "https://aws.github.io/eks-charts/aws-node-termination-handler-0.21.0.tgz"
│
│   with module.helm-addons.helm_release.chart["aws-node-termination-handler"],
│   on .terraform\modules\helm-addons\modules\helm-addons\main.tf line 2, in resource "helm_release" "chart":
│    2: resource "helm_release" "chart" {
│
╵
╷
│ Error: could not download chart: failed to download "https://aws.github.io/eks-charts/appmesh-controller-1.10.0.tgz"
│
│   with module.helm-addons.helm_release.chart["appmesh-controller"],
│   on .terraform\modules\helm-addons\modules\helm-addons\main.tf line 2, in resource "helm_release" "chart":
│    2: resource "helm_release" "chart" {
│
╵
╷
│ Error: could not download chart: failed to download "https://github.com/kubernetes-sigs/metrics-server/releases/download/metrics-server-helm-chart-3.8.3/metrics-server-3.8.3.tgz"
│
│   with module.helm-addons.helm_release.chart["metrics-server"],
│   on .terraform\modules\helm-addons\modules\helm-addons\main.tf line 2, in resource "helm_release" "chart":
│    2: resource "helm_release" "chart" {
│
╵

curl -LO https://eksworkshop.com/beginner/110_irsa/deploy.files/iam-pod.yaml

module "irsa" {
  version = "1.7.0"
  source  = "Young-ook/eks/aws//modules/iam-role-for-serviceaccount"

  serviceaccount = "postbox-sa"
  oidc_url       = data.aws_eks_cluster.this.identity[0].oidc[0].issuer
  oidc_arn       = data.aws_eks_cluster.this.role_arn
  policy_arns    = ["${aws_iam_policy.this.arn}"]
  namespace      = "postbox"
}

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.irsa.aws_iam_role.irsa[0] will be created
  + resource "aws_iam_role" "irsa" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRoleWithWebIdentity"
                      + Condition = {
                          + StringEquals = {
                              + https://oidc.eks.eu-west-2.amazonaws.com/id/40ABF36466C599FF69A257B2ACB9E5E4:sub = "system:serviceaccount:postbox:postbox-sa"
                            }
                        }
                      + Effect    = "Allow"
                      + Principal = {
                          + Federated = "arn:aws:iam::602828293775:role/dev-cluster-cluster-20220222151120373900000003"
                        }
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "irsa-71nu2859ufoy"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + tags                  = {
          + "Name"         = "irsa-71nu2859ufoy"
          + "terraform.io" = "managed"
        }
      + tags_all              = {
          + "Name"                = "irsa-71nu2859ufoy"
          + "gitrepo"             = "postbox"
          + "service"             = "postbox"
          + "terraform"           = "true"
          + "terraform.io"        = "managed"
          + "terraform_workspace" = "infra"
        }
      + unique_id             = (known after apply)

      + inline_policy {
          + name   = (known after apply)
          + policy = (known after apply)
        }
    }

  # module.irsa.aws_iam_role_policy_attachment.irsa["0"] will be created
  + resource "aws_iam_role_policy_attachment" "irsa" {
      + id         = (known after apply)
      + policy_arn = "arn:aws:iam::xxx:policy/postbox-s3-irsa"
      + role       = "irsa-71nu2859ufoy"
    }

Plan: 2 to add, 0 to change, 0 to destroy.
module.irsa.aws_iam_role.irsa[0]: Creating...
╷
│ Error: failed creating IAM Role (irsa-71nu2859ufoy): MalformedPolicyDocument: Federated principals must be valid domain names or SAML metadata ARNs
│       status code: 400, request id: bead670a-4e36-45a0-a8e9-fced6a649a95
│ 
│   with module.irsa.aws_iam_role.irsa[0],
│   on .terraform/modules/irsa/modules/iam-role-for-serviceaccount/main.tf line 6, in resource "aws_iam_role" "irsa":
│    6: resource "aws_iam_role" "irsa" {
│ 
╵
ERRO[0012] 1 error occurred:
        * exit status 1

[error]: #0 unexpected error error_class=Aws::Errors::MissingRegionError error="missing region; use :region option or export region name to ENV['AWS_REGION']"

        - name: AWS_REGION
          valueFrom:
            configMapKeyRef:
              key: logs.region
              name: cluster-info

Warning: Argument is deprecated
│
│   with module.kubernetes-addons.module.eks-addons.aws_eks_addon.addon["amazon-cloudwatch-observability"],
│   on .terraform/modules/kubernetes-addons.eks-addons/modules/eks-addons/main.tf line 8, in resource "aws_eks_addon" "addon":
│    8:   resolve_conflicts        = lookup(each.value, "resolve_conflicts", local.default_addon_config["resolve_conflicts"])
│
│ The "resolve_conflicts" attribute can't be set to "PRESERVE" on initial resource creation. Use "resolve_conflicts_on_create" and/or "resolve_conflicts_on_update" instead
╵

 launch_template_specification {
    launch_template_id = aws_launch_template.ng[each.key].id
    version            = aws_launch_template.ng[each.key].latest_version
    network_interface_id = [A ZERO-BASED INTEGER ID VALUE]
  }