diff --git a/compositions/upbound-aws-provider/eks/cluster-basic/definition.yaml b/compositions/upbound-aws-provider/eks/cluster-basic/definition.yaml new file mode 100644 index 00000000..c67da146 --- /dev/null +++ b/compositions/upbound-aws-provider/eks/cluster-basic/definition.yaml @@ -0,0 +1,94 @@ +apiVersion: apiextensions.crossplane.io/v1 +kind: CompositeResourceDefinition +metadata: + name: xekss.awsblueprints.io +spec: + defaultCompositionRef: + name: xeks.awsblueprints.io + connectionSecretKeys: + - kubeconfig + group: awsblueprints.io + names: + kind: XEks + plural: xekss + claimNames: + kind: Eks + plural: ekss + versions: + - name: v1alpha1 + served: true + referenceable: true + schema: + openAPIV3Schema: + type: object + properties: + spec: + type: object + properties: + id: + type: string + description: ID of this Cluster that other objects will use to refer to it. + providerConfigName: + description: Name of the Crossplane ProviderConfig to use for provisioning resources. + type: string + region: + description: AWS Region where resources will be deployed. + type: string + authenticationMode: + description: Authentication mode for the EKS cluster. + type: string + default: API + bootstrapClusterCreatorAdminPermissions: + description: Whether or not to bootstrap the access config values to the EKS cluster. Default is true. + type: boolean + default: true + enabledClusterLogTypes: + description: List of the desired control plane logging to enable. For more information, see Amazon EKS Control Plane Logging. + type: array + items: + type: string + default: + - api + - audit + - authenticator + - controllerManager + - scheduler + endpointPrivateAccess: + description: Whether the Amazon EKS private API server endpoint is enabled. Default is false. + type: boolean + default: false + endpointPublicAccess: + description: Whether the Amazon EKS public API server endpoint is enabled. Default is true. + type: boolean + default: true + subnets: + description: Subnets for the EKS cluster and node groups. + type: array + items: + type: string + version: + description: Kubernetes version for the EKS cluster. + type: string + default: "1.29" + writeConnectionSecretToRef: + description: Reference to a Secret where connection details should be written. + type: object + properties: + name: + type: string + description: The name of the secret. + deletionPolicy: + description: Deletion policy for the resources. 'Delete' will remove all resources, 'Orphan' will only remove the Kubernetes resource and leave cloud resources. + type: string + enum: + - Delete + - Orphan + default: Delete + status: + description: A Status represents the observed state + properties: + eks: + description: Freeform field containing status information for eks + type: object + x-kubernetes-preserve-unknown-fields: true + type: object diff --git a/compositions/upbound-aws-provider/eks/cluster-basic/eks.yaml b/compositions/upbound-aws-provider/eks/cluster-basic/eks.yaml new file mode 100644 index 00000000..31651919 --- /dev/null +++ b/compositions/upbound-aws-provider/eks/cluster-basic/eks.yaml @@ -0,0 +1,335 @@ +apiVersion: apiextensions.crossplane.io/v1 +kind: Composition +metadata: + name: xeks.awsblueprints.io + labels: + provider: aws +spec: + compositeTypeRef: + apiVersion: awsblueprints.io/v1alpha1 + kind: XEks + patchSets: + - name: common-parameters-global + patches: + - type: FromCompositeFieldPath + fromFieldPath: spec.providerConfigName + toFieldPath: spec.providerConfigRef.name + - type: FromCompositeFieldPath + fromFieldPath: spec.deletionPolicy + toFieldPath: spec.deletionPolicy + - name: common-parameters-regional + patches: + - type: FromCompositeFieldPath + fromFieldPath: spec.providerConfigName + toFieldPath: spec.providerConfigRef.name + - type: FromCompositeFieldPath + fromFieldPath: spec.deletionPolicy + toFieldPath: spec.deletionPolicy + - type: FromCompositeFieldPath + fromFieldPath: spec.region + toFieldPath: spec.forProvider.region + resources: + - name: clusterRole + base: + apiVersion: iam.aws.upbound.io/v1beta1 + kind: Role + metadata: + labels: + role: cluster + spec: + forProvider: + assumeRolePolicy: | + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": { + "Service": "eks.amazonaws.com" + }, + "Action": "sts:AssumeRole" + } + ] + } + patches: + - type: PatchSet + patchSetName: common-parameters-global + - fromFieldPath: "status.atProvider.arn" + toFieldPath: "status.eks.clusterRoleArn" + type: ToCompositeFieldPath + - fromFieldPath: status.atProvider.arn + policy: + fromFieldPath: Required + toFieldPath: status.eks.accountId + transforms: + - string: + regexp: + group: 1 + match: arn:aws:iam::(\d+):.* + type: Regexp + type: string + type: ToCompositeFieldPath + + - name: clusterRolePolicyAttachment + base: + apiVersion: iam.aws.upbound.io/v1beta1 + kind: RolePolicyAttachment + spec: + forProvider: + policyArn: arn:aws:iam::aws:policy/AmazonEKSClusterPolicy + roleSelector: + matchControllerRef: true + matchLabels: + role: cluster + patches: + - type: PatchSet + patchSetName: common-parameters-global + + - name: kubernetesCluster + base: + apiVersion: eks.aws.upbound.io/v1beta1 + kind: Cluster + spec: + forProvider: + enabledClusterLogTypes: [] + region: "" + roleArnSelector: + matchControllerRef: true + matchLabels: + role: cluster + vpcConfig: + - endpointPrivateAccess: false + endpointPublicAccess: true + subnetIds: [] + patches: + - type: PatchSet + patchSetName: common-parameters-regional + - fromFieldPath: "spec.version" + toFieldPath: "spec.forProvider.version" + - fromFieldPath: "spec.authenticationMode" + toFieldPath: "spec.forProvider.accessConfig[0].authenticationMode" + - fromFieldPath: "spec.bootstrapClusterCreatorAdminPermissions" + toFieldPath: "spec.forProvider.accessConfig[0].bootstrapClusterCreatorAdminPermissions" + - fromFieldPath: "spec.enabledClusterLogTypes" + toFieldPath: "spec.forProvider.enabledClusterLogTypes" + - fromFieldPath: "spec.endpointPrivateAccess" + toFieldPath: "spec.forProvider.vpcConfig[0].endpointPrivateAccess" + - fromFieldPath: "spec.endpointPublicAccess" + toFieldPath: "spec.forProvider.vpcConfig[0].endpointPublicAccess" + - fromFieldPath: "spec.subnets" + toFieldPath: "spec.forProvider.vpcConfig[0].subnetIds" + policy: + fromFieldPath: Required + - fromFieldPath: status.atProvider.identity[0].oidc[0].issuer + policy: + fromFieldPath: Optional + toFieldPath: status.eks.oidc + type: ToCompositeFieldPath + - fromFieldPath: status.atProvider.identity[0].oidc[0].issuer + policy: + fromFieldPath: Optional + toFieldPath: status.eks.oidcUri + transforms: + - string: + trim: https:// + type: TrimPrefix + type: string + type: ToCompositeFieldPath + - fromFieldPath: status.atProvider.vpcConfig[0].clusterSecurityGroupId + policy: + fromFieldPath: Optional + toFieldPath: status.eks.clusterSecurityGroupId + type: ToCompositeFieldPath + + - name: clusterSecurityGroupImport + base: + apiVersion: ec2.aws.upbound.io/v1beta1 + kind: SecurityGroup + patches: + - type: PatchSet + patchSetName: common-parameters-regional + - fromFieldPath: status.eks.clusterSecurityGroupId + policy: + fromFieldPath: Required + toFieldPath: metadata.annotations[crossplane.io/external-name] + type: FromCompositeFieldPath + - fromFieldPath: spec.id + toFieldPath: spec.forProvider.tags[eks.aws.platform.upbound.io/discovery] + + - name: kubernetesClusterAuth + base: + apiVersion: eks.aws.upbound.io/v1beta1 + kind: ClusterAuth + spec: + forProvider: + refreshPeriod: "2m0s" + clusterNameSelector: + matchControllerRef: true + connectionDetails: + - fromConnectionSecretKey: kubeconfig + name: kubeconfig + type: FromConnectionSecretKey + patches: + - type: PatchSet + patchSetName: common-parameters-regional + - fromFieldPath: "spec.id" + toFieldPath: "spec.writeConnectionSecretToRef.namespace" + type: FromCompositeFieldPath + - fromFieldPath: "metadata.uid" + toFieldPath: "spec.writeConnectionSecretToRef.name" + transforms: + - type: string + string: + fmt: "%s-ekscluster" + type: Format + type: FromCompositeFieldPath + + - name: nodegroupRole + base: + apiVersion: iam.aws.upbound.io/v1beta1 + kind: Role + metadata: + labels: + role: nodegroup + spec: + forProvider: + assumeRolePolicy: | + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": { + "Service": [ + "ec2.amazonaws.com" + ] + }, + "Action": [ + "sts:AssumeRole" + ] + } + ] + } + patches: + - type: PatchSet + patchSetName: common-parameters-global + - fromFieldPath: "status.atProvider.arn" + toFieldPath: "status.eks.nodeGroupRoleArn" + type: ToCompositeFieldPath + + - name: nodegroupWorkerNodePolicyAttachment + base: + apiVersion: iam.aws.upbound.io/v1beta1 + kind: RolePolicyAttachment + spec: + forProvider: + policyArn: arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy + roleSelector: + matchControllerRef: true + matchLabels: + role: nodegroup + patches: + - type: PatchSet + patchSetName: common-parameters-global + + - name: nodegroupCniPolicyAttachment + base: + apiVersion: iam.aws.upbound.io/v1beta1 + kind: RolePolicyAttachment + spec: + forProvider: + policyArn: arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy + roleSelector: + matchControllerRef: true + matchLabels: + role: nodegroup + patches: + - type: PatchSet + patchSetName: common-parameters-global + + - name: ebsCsiRolePolicyAttachment + base: + apiVersion: iam.aws.upbound.io/v1beta1 + kind: RolePolicyAttachment + spec: + forProvider: + policyArn: arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy + roleSelector: + matchControllerRef: true + matchLabels: + role: nodegroup + patches: + - type: PatchSet + patchSetName: common-parameters-global + + - name: containerRegistryRolePolicyAttachment + base: + apiVersion: iam.aws.upbound.io/v1beta1 + kind: RolePolicyAttachment + spec: + forProvider: + policyArn: arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly + roleSelector: + matchControllerRef: true + matchLabels: + role: nodegroup + patches: + - type: PatchSet + patchSetName: common-parameters-global + + - name: nodegroup + base: + apiVersion: eks.aws.upbound.io/v1beta1 + kind: NodeGroup + spec: + forProvider: + region: "" + clusterNameSelector: + matchControllerRef: true + nodeRoleArnSelector: + matchControllerRef: true + matchLabels: + role: nodegroup + scalingConfig: + - desiredSize: 3 + minSize: 1 + maxSize: 6 + subnetIds: [] + providerConfigRef: + name: "" + patches: + - type: PatchSet + patchSetName: common-parameters-regional + - fromFieldPath: "spec.subnets" + toFieldPath: "spec.forProvider.subnetIds" + policy: + fromFieldPath: Required + - fromFieldPath: status.atProvider.clusterName + policy: + fromFieldPath: Optional + toFieldPath: status.eks.clusterName + type: ToCompositeFieldPath + + - name: oidcProvider + base: + apiVersion: iam.aws.upbound.io/v1beta1 + kind: OpenIDConnectProvider + spec: + forProvider: + clientIdList: + - sts.amazonaws.com + thumbprintList: + - 9e99a48a9960b14926bb7f3b02e22da2b0ab7280 + patches: + - type: PatchSet + patchSetName: common-parameters-global + - fromFieldPath: status.eks.oidc + policy: + fromFieldPath: Required + toFieldPath: spec.forProvider.url + type: FromCompositeFieldPath + - fromFieldPath: status.atProvider.arn + policy: + fromFieldPath: Optional + toFieldPath: status.eks.oidcArn + type: ToCompositeFieldPath diff --git a/compositions/upbound-aws-provider/eks/cluster-basic/kustomization.yaml b/compositions/upbound-aws-provider/eks/cluster-basic/kustomization.yaml new file mode 100644 index 00000000..7eff6b18 --- /dev/null +++ b/compositions/upbound-aws-provider/eks/cluster-basic/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- definition.yaml +- eks.yaml diff --git a/compositions/upbound-aws-provider/eks/cluster-with-extras/definition.yaml b/compositions/upbound-aws-provider/eks/cluster-with-extras/definition.yaml new file mode 100644 index 00000000..0ab55f16 --- /dev/null +++ b/compositions/upbound-aws-provider/eks/cluster-with-extras/definition.yaml @@ -0,0 +1,104 @@ +apiVersion: apiextensions.crossplane.io/v1 +kind: CompositeResourceDefinition +metadata: + name: xekss.awsblueprints.io +spec: + defaultCompositionRef: + name: xeks.awsblueprints.io + connectionSecretKeys: + - kubeconfig + group: awsblueprints.io + names: + kind: XEks + plural: xekss + claimNames: + kind: Eks + plural: ekss + versions: + - name: v1alpha1 + served: true + referenceable: true + schema: + openAPIV3Schema: + type: object + properties: + spec: + type: object + properties: + id: + type: string + description: ID of this Cluster that other objects will use to refer to it. + providerConfigName: + description: Name of the Crossplane ProviderConfig to use for provisioning resources. + type: string + region: + description: AWS Region where resources will be deployed. + type: string + authenticationMode: + description: Authentication mode for the EKS cluster. + type: string + default: API + bootstrapClusterCreatorAdminPermissions: + description: Whether or not to bootstrap the access config values to the EKS cluster. Default is true. + type: boolean + default: true + enabledClusterLogTypes: + description: List of the desired control plane logging to enable. For more information, see Amazon EKS Control Plane Logging. + type: array + items: + type: string + default: + - api + - audit + - authenticator + - controllerManager + - scheduler + endpointPrivateAccess: + description: Whether the Amazon EKS private API server endpoint is enabled. Default is false. + type: boolean + default: false + endpointPublicAccess: + description: Whether the Amazon EKS public API server endpoint is enabled. Default is true. + type: boolean + default: true + iam: + type: object + description: IAM configuration to connect as ClusterAdmin. + properties: + clusterAdminRoleArn: + description: The IAM Role ARN to connect as ClusterAdmin. + type: string + clusterAdminUserArn: + description: The IAM User ARN to connect as ClusterAdmin. + type: string + subnets: + description: Subnets for the EKS cluster and node groups. + type: array + items: + type: string + version: + description: Kubernetes version for the EKS cluster. + type: string + default: "1.29" + writeConnectionSecretToRef: + description: Reference to a Secret where connection details should be written. + type: object + properties: + name: + type: string + description: The name of the secret. + deletionPolicy: + description: Deletion policy for the resources. 'Delete' will remove all resources, 'Orphan' will only remove the Kubernetes resource and leave cloud resources. + type: string + enum: + - Delete + - Orphan + default: Delete + status: + description: A Status represents the observed state + properties: + eks: + description: Freeform field containing status information for eks + type: object + x-kubernetes-preserve-unknown-fields: true + type: object diff --git a/compositions/upbound-aws-provider/eks/cluster-with-extras/eks.yaml b/compositions/upbound-aws-provider/eks/cluster-with-extras/eks.yaml new file mode 100644 index 00000000..4e573be1 --- /dev/null +++ b/compositions/upbound-aws-provider/eks/cluster-with-extras/eks.yaml @@ -0,0 +1,1188 @@ +apiVersion: apiextensions.crossplane.io/v1 +kind: Composition +metadata: + name: xeks.awsblueprints.io + labels: + provider: aws +spec: + compositeTypeRef: + apiVersion: awsblueprints.io/v1alpha1 + kind: XEks + patchSets: + - name: common-parameters-global + patches: + - type: FromCompositeFieldPath + fromFieldPath: spec.providerConfigName + toFieldPath: spec.providerConfigRef.name + - type: FromCompositeFieldPath + fromFieldPath: spec.deletionPolicy + toFieldPath: spec.deletionPolicy + - name: common-parameters-regional + patches: + - type: FromCompositeFieldPath + fromFieldPath: spec.providerConfigName + toFieldPath: spec.providerConfigRef.name + - type: FromCompositeFieldPath + fromFieldPath: spec.deletionPolicy + toFieldPath: spec.deletionPolicy + - type: FromCompositeFieldPath + fromFieldPath: spec.region + toFieldPath: spec.forProvider.region + resources: + - name: clusterRole + base: + apiVersion: iam.aws.upbound.io/v1beta1 + kind: Role + metadata: + labels: + role: cluster + spec: + forProvider: + assumeRolePolicy: | + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": { + "Service": "eks.amazonaws.com" + }, + "Action": "sts:AssumeRole" + } + ] + } + patches: + - type: PatchSet + patchSetName: common-parameters-global + - fromFieldPath: "status.atProvider.arn" + toFieldPath: "status.eks.clusterRoleArn" + type: ToCompositeFieldPath + - fromFieldPath: status.atProvider.arn + policy: + fromFieldPath: Required + toFieldPath: status.eks.accountId + transforms: + - string: + regexp: + group: 1 + match: arn:aws:iam::(\d+):.* + type: Regexp + type: string + type: ToCompositeFieldPath + + - name: clusterRolePolicyAttachment + base: + apiVersion: iam.aws.upbound.io/v1beta1 + kind: RolePolicyAttachment + spec: + forProvider: + policyArn: arn:aws:iam::aws:policy/AmazonEKSClusterPolicy + roleSelector: + matchControllerRef: true + matchLabels: + role: cluster + patches: + - type: PatchSet + patchSetName: common-parameters-global + + - name: clusterEncriptionKey + base: + apiVersion: kms.aws.upbound.io/v1beta1 + kind: Key + spec: + forProvider: + region: "" + description: "KMS key used to encrypt the EKS cluster" + customerMasterKeySpec: SYMMETRIC_DEFAULT + enableKeyRotation: true + policy: "" + patches: + - type: PatchSet + patchSetName: common-parameters-regional + - combine: + strategy: string + string: + fmt: | + { + "Version": "2012-10-17", + "Id": "key-default-1", + "Statement": [ + { + "Sid": "Enable IAM User Permissions", + "Effect": "Allow", + "Principal": { + "AWS": "arn:aws:iam::%s:root" + }, + "Action": "kms:*", + "Resource": "*" + }, + { + "Sid": "Allow access for Key Administrators", + "Effect": "Allow", + "Principal": { + "AWS": [ + "%s" + ] + }, + "Action": [ + "kms:Create*", + "kms:Describe*", + "kms:Enable*", + "kms:List*", + "kms:Put*", + "kms:Update*", + "kms:Revoke*", + "kms:Disable*", + "kms:Get*", + "kms:Delete*", + "kms:ScheduleKeyDeletion", + "kms:CancelKeyDeletion" + ], + "Resource": "*" + }, + { + "Sid": "Allow use of the key", + "Effect": "Allow", + "Principal": { + "AWS": "%s" + }, + "Action": [ + "kms:Encrypt", + "kms:Decrypt", + "kms:ReEncrypt*", + "kms:GenerateDataKey*", + "kms:DescribeKey" + ], + "Resource": "*" + } + ] + } + variables: + - fromFieldPath: status.eks.accountId + - fromFieldPath: spec.iam.clusterAdminRoleArn + - fromFieldPath: status.eks.clusterRoleArn + policy: + fromFieldPath: Required + toFieldPath: spec.forProvider.policy + type: CombineFromComposite + - fromFieldPath: status.atProvider.arn + toFieldPath: status.eks.clusterKeyArn + type: ToCompositeFieldPath + + - name: clusterEncriptionKeyAlias + base: + apiVersion: kms.aws.upbound.io/v1beta1 + kind: Alias + spec: + forProvider: + region: "" + targetKeyId: "" + patches: + - type: PatchSet + patchSetName: common-parameters-regional + - fromFieldPath: status.eks.clusterKeyArn + toFieldPath: spec.forProvider.targetKeyId + type: FromCompositeFieldPath + + - name: kubernetesCluster + base: + apiVersion: eks.aws.upbound.io/v1beta1 + kind: Cluster + spec: + forProvider: + enabledClusterLogTypes: [] + encryptionConfig: + - resources: + - secrets + provider: + - keyArn: "" + region: "" + roleArnSelector: + matchControllerRef: true + matchLabels: + role: cluster + vpcConfig: + - endpointPrivateAccess: false + endpointPublicAccess: true + subnetIds: [] + patches: + - type: PatchSet + patchSetName: common-parameters-regional + - fromFieldPath: "spec.version" + toFieldPath: "spec.forProvider.version" + - fromFieldPath: "spec.authenticationMode" + toFieldPath: "spec.forProvider.accessConfig[0].authenticationMode" + - fromFieldPath: "spec.bootstrapClusterCreatorAdminPermissions" + toFieldPath: "spec.forProvider.accessConfig[0].bootstrapClusterCreatorAdminPermissions" + - fromFieldPath: "spec.enabledClusterLogTypes" + toFieldPath: "spec.forProvider.enabledClusterLogTypes" + - fromFieldPath: "spec.endpointPrivateAccess" + toFieldPath: "spec.forProvider.vpcConfig[0].endpointPrivateAccess" + - fromFieldPath: "spec.endpointPublicAccess" + toFieldPath: "spec.forProvider.vpcConfig[0].endpointPublicAccess" + - fromFieldPath: "spec.subnets" + toFieldPath: "spec.forProvider.vpcConfig[0].subnetIds" + policy: + fromFieldPath: Required + - fromFieldPath: status.atProvider.identity[0].oidc[0].issuer + policy: + fromFieldPath: Optional + toFieldPath: status.eks.oidc + type: ToCompositeFieldPath + - fromFieldPath: status.atProvider.identity[0].oidc[0].issuer + policy: + fromFieldPath: Optional + toFieldPath: status.eks.oidcUri + transforms: + - string: + trim: https:// + type: TrimPrefix + type: string + type: ToCompositeFieldPath + - fromFieldPath: status.atProvider.vpcConfig[0].clusterSecurityGroupId + policy: + fromFieldPath: Optional + toFieldPath: status.eks.clusterSecurityGroupId + type: ToCompositeFieldPath + - fromFieldPath: "status.eks.clusterKeyArn" + policy: + fromFieldPath: Required + toFieldPath: spec.forProvider.encryptionConfig[0].provider[0].keyArn + type: FromCompositeFieldPath + + - name: clusterSecurityGroupImport + base: + apiVersion: ec2.aws.upbound.io/v1beta1 + kind: SecurityGroup + patches: + - type: PatchSet + patchSetName: common-parameters-regional + - fromFieldPath: status.eks.clusterSecurityGroupId + policy: + fromFieldPath: Required + toFieldPath: metadata.annotations[crossplane.io/external-name] + type: FromCompositeFieldPath + - fromFieldPath: spec.id + toFieldPath: spec.forProvider.tags[eks.aws.platform.upbound.io/discovery] + + - name: kubernetesClusterAuth + base: + apiVersion: eks.aws.upbound.io/v1beta1 + kind: ClusterAuth + spec: + forProvider: + refreshPeriod: "2m0s" + clusterNameSelector: + matchControllerRef: true + connectionDetails: + - fromConnectionSecretKey: kubeconfig + name: kubeconfig + type: FromConnectionSecretKey + patches: + - type: PatchSet + patchSetName: common-parameters-regional + - fromFieldPath: "spec.id" + toFieldPath: "spec.writeConnectionSecretToRef.namespace" + type: FromCompositeFieldPath + - fromFieldPath: "metadata.uid" + toFieldPath: "spec.writeConnectionSecretToRef.name" + transforms: + - type: string + string: + fmt: "%s-ekscluster" + type: Format + type: FromCompositeFieldPath + + - name: nodegroupRole + base: + apiVersion: iam.aws.upbound.io/v1beta1 + kind: Role + metadata: + labels: + role: nodegroup + spec: + forProvider: + assumeRolePolicy: | + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": { + "Service": [ + "ec2.amazonaws.com" + ] + }, + "Action": [ + "sts:AssumeRole" + ] + } + ] + } + patches: + - type: PatchSet + patchSetName: common-parameters-global + - fromFieldPath: "status.atProvider.arn" + toFieldPath: "status.eks.nodeGroupRoleArn" + type: ToCompositeFieldPath + + - name: nodegroupWorkerNodePolicyAttachment + base: + apiVersion: iam.aws.upbound.io/v1beta1 + kind: RolePolicyAttachment + spec: + forProvider: + policyArn: arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy + roleSelector: + matchControllerRef: true + matchLabels: + role: nodegroup + patches: + - type: PatchSet + patchSetName: common-parameters-global + + - name: nodegroupCniPolicyAttachment + base: + apiVersion: iam.aws.upbound.io/v1beta1 + kind: RolePolicyAttachment + spec: + forProvider: + policyArn: arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy + roleSelector: + matchControllerRef: true + matchLabels: + role: nodegroup + patches: + - type: PatchSet + patchSetName: common-parameters-global + + - name: ebsCsiRolePolicyAttachment + base: + apiVersion: iam.aws.upbound.io/v1beta1 + kind: RolePolicyAttachment + spec: + forProvider: + policyArn: arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy + roleSelector: + matchControllerRef: true + matchLabels: + role: nodegroup + patches: + - type: PatchSet + patchSetName: common-parameters-global + + - name: containerRegistryRolePolicyAttachment + base: + apiVersion: iam.aws.upbound.io/v1beta1 + kind: RolePolicyAttachment + spec: + forProvider: + policyArn: arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly + roleSelector: + matchControllerRef: true + matchLabels: + role: nodegroup + patches: + - type: PatchSet + patchSetName: common-parameters-global + + - name: nodegroup + base: + apiVersion: eks.aws.upbound.io/v1beta1 + kind: NodeGroup + spec: + forProvider: + region: "" + clusterNameSelector: + matchControllerRef: true + nodeRoleArnSelector: + matchControllerRef: true + matchLabels: + role: nodegroup + scalingConfig: + - desiredSize: 3 + minSize: 1 + maxSize: 6 + subnetIds: [] + providerConfigRef: + name: "" + patches: + - type: PatchSet + patchSetName: common-parameters-regional + - fromFieldPath: "spec.subnets" + toFieldPath: "spec.forProvider.subnetIds" + policy: + fromFieldPath: Required + - fromFieldPath: status.atProvider.clusterName + policy: + fromFieldPath: Optional + toFieldPath: status.eks.clusterName + type: ToCompositeFieldPath + + - name: ebsCsiAddonRole + base: + apiVersion: iam.aws.upbound.io/v1beta1 + kind: Role + metadata: + labels: + role: ebsCsiAddon + spec: + forProvider: + assumeRolePolicy: "" + patches: + - type: PatchSet + patchSetName: common-parameters-global + - combine: + strategy: string + string: + fmt: | + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": { + "Federated": "%s" + }, + "Action": "sts:AssumeRoleWithWebIdentity", + "Condition": { + "StringEquals": { + "%s:sub": "system:serviceaccount:kube-system:ebs-csi-controller-sa", + "%s:aud": "sts.amazonaws.com" + } + } + } + ] + } + variables: + - fromFieldPath: status.eks.oidcArn + - fromFieldPath: status.eks.oidcUri + - fromFieldPath: status.eks.oidcUri + policy: + fromFieldPath: Required + toFieldPath: spec.forProvider.assumeRolePolicy + type: CombineFromComposite + + - name: ebsCsiAddonRolePolicyAttachment + base: + apiVersion: iam.aws.upbound.io/v1beta1 + kind: RolePolicyAttachment + spec: + forProvider: + policyArn: arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy + roleSelector: + matchControllerRef: true + matchLabels: + role: ebsCsiAddon + patches: + - type: PatchSet + patchSetName: common-parameters-global + + - name: ebsCsiAddon + base: + apiVersion: eks.aws.upbound.io/v1beta1 + kind: Addon + spec: + forProvider: + addonName: aws-ebs-csi-driver + clusterNameSelector: + matchControllerRef: true + serviceAccountRoleArnSelector: + matchControllerRef: true + matchLabels: + role: ebsCsiAddon + patches: + - type: PatchSet + patchSetName: common-parameters-regional + - fromFieldPath: status.eks.clusterName + policy: + fromFieldPath: Required + toFieldPath: metadata.annotations[crossplane.io/external-name] + transforms: + - string: + fmt: "%s:aws-ebs-csi-driver" + type: Format + type: string + type: FromCompositeFieldPath + + - name: cniAddon + base: + apiVersion: eks.aws.upbound.io/v1beta1 + kind: Addon + spec: + forProvider: + addonName: vpc-cni + clusterNameSelector: + matchControllerRef: true + preserve: false + patches: + - type: PatchSet + patchSetName: common-parameters-regional + - fromFieldPath: status.eks.clusterName + policy: + fromFieldPath: Required + toFieldPath: metadata.annotations[crossplane.io/external-name] + transforms: + - string: + fmt: "%s:vpc-cni" + type: Format + type: string + type: FromCompositeFieldPath + + - name: corednsAddon + base: + apiVersion: eks.aws.upbound.io/v1beta1 + kind: Addon + spec: + forProvider: + addonName: coredns + clusterNameSelector: + matchControllerRef: true + preserve: false + patches: + - type: PatchSet + patchSetName: common-parameters-regional + - fromFieldPath: status.eks.clusterName + policy: + fromFieldPath: Required + toFieldPath: metadata.annotations[crossplane.io/external-name] + transforms: + - string: + fmt: "%s:coredns" + type: Format + type: string + type: FromCompositeFieldPath + + - name: kubeProxyAddon + base: + apiVersion: eks.aws.upbound.io/v1beta1 + kind: Addon + spec: + forProvider: + addonName: kube-proxy + clusterNameSelector: + matchControllerRef: true + preserve: false + patches: + - type: PatchSet + patchSetName: common-parameters-regional + - fromFieldPath: status.eks.clusterName + policy: + fromFieldPath: Required + toFieldPath: metadata.annotations[crossplane.io/external-name] + transforms: + - string: + fmt: "%s:kube-proxy" + type: Format + type: string + type: FromCompositeFieldPath + + - name: podIdentityAgentAddon + base: + apiVersion: eks.aws.upbound.io/v1beta1 + kind: Addon + spec: + forProvider: + addonName: eks-pod-identity-agent + clusterNameSelector: + matchControllerRef: true + preserve: false + patches: + - type: PatchSet + patchSetName: common-parameters-regional + - fromFieldPath: status.eks.clusterName + policy: + fromFieldPath: Required + toFieldPath: metadata.annotations[crossplane.io/external-name] + transforms: + - string: + fmt: "%s:eks-pod-identity-agent" + type: Format + type: string + type: FromCompositeFieldPath + + - name: csiSnapshotControllerAddon + base: + apiVersion: eks.aws.upbound.io/v1beta1 + kind: Addon + spec: + forProvider: + addonName: snapshot-controller + clusterNameSelector: + matchControllerRef: true + preserve: false + patches: + - type: PatchSet + patchSetName: common-parameters-regional + - fromFieldPath: status.eks.clusterName + policy: + fromFieldPath: Required + toFieldPath: metadata.annotations[crossplane.io/external-name] + transforms: + - string: + fmt: "%s:snapshot-controller" + type: Format + type: string + type: FromCompositeFieldPath + + - name: s3MountpointAddon + base: + apiVersion: eks.aws.upbound.io/v1beta1 + kind: Addon + spec: + forProvider: + addonName: aws-mountpoint-s3-csi-driver + clusterNameSelector: + matchControllerRef: true + preserve: false + patches: + - type: PatchSet + patchSetName: common-parameters-regional + - fromFieldPath: status.eks.clusterName + policy: + fromFieldPath: Required + toFieldPath: metadata.annotations[crossplane.io/external-name] + transforms: + - string: + fmt: "%s:aws-mountpoint-s3-csi-driver" + type: Format + type: string + type: FromCompositeFieldPath + + - name: efsCsiAddon + base: + apiVersion: eks.aws.upbound.io/v1beta1 + kind: Addon + spec: + forProvider: + addonName: aws-efs-csi-driver + clusterNameSelector: + matchControllerRef: true + preserve: false + patches: + - type: PatchSet + patchSetName: common-parameters-regional + - fromFieldPath: status.eks.clusterName + policy: + fromFieldPath: Required + toFieldPath: metadata.annotations[crossplane.io/external-name] + transforms: + - string: + fmt: "%s:aws-efs-csi-driver" + type: Format + type: string + type: FromCompositeFieldPath + + - name: oidcProvider + base: + apiVersion: iam.aws.upbound.io/v1beta1 + kind: OpenIDConnectProvider + spec: + forProvider: + clientIdList: + - sts.amazonaws.com + thumbprintList: + - 9e99a48a9960b14926bb7f3b02e22da2b0ab7280 + patches: + - type: PatchSet + patchSetName: common-parameters-global + - fromFieldPath: status.eks.oidc + policy: + fromFieldPath: Required + toFieldPath: spec.forProvider.url + type: FromCompositeFieldPath + - fromFieldPath: status.atProvider.arn + policy: + fromFieldPath: Optional + toFieldPath: status.eks.oidcArn + type: ToCompositeFieldPath + + - name: providerConfigHelm + base: + apiVersion: helm.crossplane.io/v1beta1 + kind: ProviderConfig + spec: + credentials: + source: Secret + secretRef: + name: "" + namespace: "" + key: kubeconfig + patches: + - fromFieldPath: spec.id + toFieldPath: spec.credentials.secretRef.namespace + - fromFieldPath: spec.id + toFieldPath: metadata.name + type: FromCompositeFieldPath + - fromFieldPath: metadata.uid + toFieldPath: spec.credentials.secretRef.name + transforms: + - string: + fmt: "%s-ekscluster" + type: Format + type: string + type: FromCompositeFieldPath + readinessChecks: + - type: None + + - name: providerConfigKubernetes + base: + apiVersion: kubernetes.crossplane.io/v1alpha1 + kind: ProviderConfig + spec: + credentials: + secretRef: + key: kubeconfig + source: Secret + patches: + - fromFieldPath: spec.id + toFieldPath: metadata.name + type: FromCompositeFieldPath + - fromFieldPath: spec.id + toFieldPath: spec.credentials.secretRef.namespace + - fromFieldPath: metadata.uid + toFieldPath: spec.credentials.secretRef.name + transforms: + - string: + fmt: "%s-ekscluster" + type: Format + type: string + type: FromCompositeFieldPath + readinessChecks: + - type: None + + - name: awsAuth + base: + apiVersion: kubernetes.crossplane.io/v1alpha2 + kind: Object + spec: + deletionPolicy: Orphan + forProvider: + manifest: + apiVersion: v1 + kind: ConfigMap + metadata: + name: aws-auth + namespace: kube-system + patches: + - fromFieldPath: spec.id + toFieldPath: spec.providerConfigRef.name + type: FromCompositeFieldPath + - fromFieldPath: spec.id + toFieldPath: metadata.name + transforms: + - string: + fmt: "%s-aws-auth" + type: Format + type: string + type: FromCompositeFieldPath + - combine: + strategy: string + string: + fmt: | + - groups: + - system:bootstrappers + - system:nodes + rolearn: %s + username: system:node:{{EC2PrivateDNSName}} + - groups: + - system:masters + rolearn: %s + username: adminrole + variables: + - fromFieldPath: status.eks.nodeGroupRoleArn + - fromFieldPath: spec.iam.clusterAdminRoleArn + policy: + fromFieldPath: Required + toFieldPath: spec.forProvider.manifest.data.mapRoles + type: CombineFromComposite + - combine: + strategy: string + string: + fmt: | + - groups: + - system:masters + userarn: %s + username: adminuser + variables: + - fromFieldPath: spec.iam.clusterAdminUserArn + policy: + fromFieldPath: Optional + toFieldPath: spec.forProvider.manifest.data.mapUsers + type: CombineFromComposite + + - name: awsLoadBalancerControllerAddonPolicy + base: + apiVersion: iam.aws.upbound.io/v1beta1 + kind: Policy + metadata: + labels: + policy: awsLoadBalancerControllerAddon + spec: + forProvider: + policy: | + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "iam:CreateServiceLinkedRole" + ], + "Resource": "*", + "Condition": { + "StringEquals": { + "iam:AWSServiceName": "elasticloadbalancing.amazonaws.com" + } + } + }, + { + "Effect": "Allow", + "Action": [ + "ec2:DescribeAccountAttributes", + "ec2:DescribeAddresses", + "ec2:DescribeAvailabilityZones", + "ec2:DescribeInternetGateways", + "ec2:DescribeVpcs", + "ec2:DescribeVpcPeeringConnections", + "ec2:DescribeSubnets", + "ec2:DescribeSecurityGroups", + "ec2:DescribeInstances", + "ec2:DescribeNetworkInterfaces", + "ec2:DescribeTags", + "ec2:GetCoipPoolUsage", + "ec2:DescribeCoipPools", + "elasticloadbalancing:DescribeLoadBalancers", + "elasticloadbalancing:DescribeLoadBalancerAttributes", + "elasticloadbalancing:DescribeListeners", + "elasticloadbalancing:DescribeListenerCertificates", + "elasticloadbalancing:DescribeSSLPolicies", + "elasticloadbalancing:DescribeRules", + "elasticloadbalancing:DescribeTargetGroups", + "elasticloadbalancing:DescribeTargetGroupAttributes", + "elasticloadbalancing:DescribeTargetHealth", + "elasticloadbalancing:DescribeTags", + "elasticloadbalancing:DescribeTrustStores" + ], + "Resource": "*" + }, + { + "Effect": "Allow", + "Action": [ + "cognito-idp:DescribeUserPoolClient", + "acm:ListCertificates", + "acm:DescribeCertificate", + "iam:ListServerCertificates", + "iam:GetServerCertificate", + "waf-regional:GetWebACL", + "waf-regional:GetWebACLForResource", + "waf-regional:AssociateWebACL", + "waf-regional:DisassociateWebACL", + "wafv2:GetWebACL", + "wafv2:GetWebACLForResource", + "wafv2:AssociateWebACL", + "wafv2:DisassociateWebACL", + "shield:GetSubscriptionState", + "shield:DescribeProtection", + "shield:CreateProtection", + "shield:DeleteProtection" + ], + "Resource": "*" + }, + { + "Effect": "Allow", + "Action": [ + "ec2:AuthorizeSecurityGroupIngress", + "ec2:RevokeSecurityGroupIngress" + ], + "Resource": "*" + }, + { + "Effect": "Allow", + "Action": [ + "ec2:CreateSecurityGroup" + ], + "Resource": "*" + }, + { + "Effect": "Allow", + "Action": [ + "ec2:CreateTags" + ], + "Resource": "arn:aws:ec2:*:*:security-group/*", + "Condition": { + "StringEquals": { + "ec2:CreateAction": "CreateSecurityGroup" + }, + "Null": { + "aws:RequestTag/elbv2.k8s.aws/cluster": "false" + } + } + }, + { + "Effect": "Allow", + "Action": [ + "ec2:CreateTags", + "ec2:DeleteTags" + ], + "Resource": "arn:aws:ec2:*:*:security-group/*", + "Condition": { + "Null": { + "aws:RequestTag/elbv2.k8s.aws/cluster": "true", + "aws:ResourceTag/elbv2.k8s.aws/cluster": "false" + } + } + }, + { + "Effect": "Allow", + "Action": [ + "ec2:AuthorizeSecurityGroupIngress", + "ec2:RevokeSecurityGroupIngress", + "ec2:DeleteSecurityGroup" + ], + "Resource": "*", + "Condition": { + "Null": { + "aws:ResourceTag/elbv2.k8s.aws/cluster": "false" + } + } + }, + { + "Effect": "Allow", + "Action": [ + "elasticloadbalancing:CreateLoadBalancer", + "elasticloadbalancing:CreateTargetGroup" + ], + "Resource": "*", + "Condition": { + "Null": { + "aws:RequestTag/elbv2.k8s.aws/cluster": "false" + } + } + }, + { + "Effect": "Allow", + "Action": [ + "elasticloadbalancing:CreateListener", + "elasticloadbalancing:DeleteListener", + "elasticloadbalancing:CreateRule", + "elasticloadbalancing:DeleteRule" + ], + "Resource": "*" + }, + { + "Effect": "Allow", + "Action": [ + "elasticloadbalancing:AddTags", + "elasticloadbalancing:RemoveTags" + ], + "Resource": [ + "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*", + "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*", + "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*" + ], + "Condition": { + "Null": { + "aws:RequestTag/elbv2.k8s.aws/cluster": "true", + "aws:ResourceTag/elbv2.k8s.aws/cluster": "false" + } + } + }, + { + "Effect": "Allow", + "Action": [ + "elasticloadbalancing:AddTags", + "elasticloadbalancing:RemoveTags" + ], + "Resource": [ + "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*", + "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*", + "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*", + "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*" + ] + }, + { + "Effect": "Allow", + "Action": [ + "elasticloadbalancing:ModifyLoadBalancerAttributes", + "elasticloadbalancing:SetIpAddressType", + "elasticloadbalancing:SetSecurityGroups", + "elasticloadbalancing:SetSubnets", + "elasticloadbalancing:DeleteLoadBalancer", + "elasticloadbalancing:ModifyTargetGroup", + "elasticloadbalancing:ModifyTargetGroupAttributes", + "elasticloadbalancing:DeleteTargetGroup" + ], + "Resource": "*", + "Condition": { + "Null": { + "aws:ResourceTag/elbv2.k8s.aws/cluster": "false" + } + } + }, + { + "Effect": "Allow", + "Action": [ + "elasticloadbalancing:AddTags" + ], + "Resource": [ + "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*", + "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*", + "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*" + ], + "Condition": { + "StringEquals": { + "elasticloadbalancing:CreateAction": [ + "CreateTargetGroup", + "CreateLoadBalancer" + ] + }, + "Null": { + "aws:RequestTag/elbv2.k8s.aws/cluster": "false" + } + } + }, + { + "Effect": "Allow", + "Action": [ + "elasticloadbalancing:RegisterTargets", + "elasticloadbalancing:DeregisterTargets" + ], + "Resource": "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*" + }, + { + "Effect": "Allow", + "Action": [ + "elasticloadbalancing:SetWebAcl", + "elasticloadbalancing:ModifyListener", + "elasticloadbalancing:AddListenerCertificates", + "elasticloadbalancing:RemoveListenerCertificates", + "elasticloadbalancing:ModifyRule" + ], + "Resource": "*" + } + ] + } + patches: + - type: PatchSet + patchSetName: common-parameters-global + + - name: awsLoadBalancerControllerAddonRole + base: + apiVersion: iam.aws.upbound.io/v1beta1 + kind: Role + metadata: + labels: + role: awsLoadBalancerControllerAddon + spec: + forProvider: + assumeRolePolicy: "" + patches: + - type: PatchSet + patchSetName: common-parameters-global + - fromFieldPath: "status.atProvider.arn" + toFieldPath: "status.eks.awsLoadBalancerControllerAddonRoleArn" + type: ToCompositeFieldPath + - combine: + strategy: string + string: + fmt: | + { + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": { + "Federated": "%s" + }, + "Action": "sts:AssumeRoleWithWebIdentity", + "Condition": { + "StringEquals": { + "%s:sub": "system:serviceaccount:kube-system:aws-load-balancer-controller-sa", + "%s:aud": "sts.amazonaws.com" + } + } + } + ] + } + variables: + - fromFieldPath: status.eks.oidcArn + - fromFieldPath: status.eks.oidcUri + - fromFieldPath: status.eks.oidcUri + policy: + fromFieldPath: Required + toFieldPath: spec.forProvider.assumeRolePolicy + type: CombineFromComposite + + - name: awsLoadBalancerControllerAddonRolePolicyAttachment + base: + apiVersion: iam.aws.upbound.io/v1beta1 + kind: RolePolicyAttachment + spec: + forProvider: + policyArnSelector: + matchControllerRef: true + matchLabels: + policy: awsLoadBalancerControllerAddon + roleSelector: + matchControllerRef: true + matchLabels: + role: awsLoadBalancerControllerAddon + patches: + - type: PatchSet + patchSetName: common-parameters-global + + - name: awsLoadBalancerControllerAddonServiceAccount + base: + apiVersion: kubernetes.crossplane.io/v1alpha2 + kind: Object + spec: + deletionPolicy: Orphan + forProvider: + manifest: + apiVersion: v1 + kind: ServiceAccount + metadata: + name: aws-load-balancer-controller-sa + namespace: kube-system + patches: + - fromFieldPath: spec.id + toFieldPath: spec.providerConfigRef.name + type: FromCompositeFieldPath + - fromFieldPath: status.eks.awsLoadBalancerControllerAddonRoleArn + toFieldPath: spec.forProvider.manifest.metadata.annotations[eks.amazonaws.com/role-arn] + type: FromCompositeFieldPath + policy: + fromFieldPath: Required + + - name: awsLoadBalancerControllerAddon + base: + apiVersion: helm.crossplane.io/v1beta1 + kind: Release + metadata: + annotations: + crossplane.io/external-name: aws-load-balancer-controller + spec: + forProvider: + chart: + name: aws-load-balancer-controller + repository: https://aws.github.io/eks-charts + version: 1.7.1 + namespace: kube-system + set: + - name: clusterName + value: "" + - name: serviceAccount.create + value: "false" + - name: serviceAccount.name + value: aws-load-balancer-controller-sa + values: + image: + pullPolicy: IfNotPresent + patches: + - fromFieldPath: spec.id + toFieldPath: spec.providerConfigRef.name + type: FromCompositeFieldPath + - fromFieldPath: status.eks.clusterName + toFieldPath: spec.forProvider.set[0].value + type: FromCompositeFieldPath diff --git a/compositions/upbound-aws-provider/eks/cluster-with-extras/kustomization.yaml b/compositions/upbound-aws-provider/eks/cluster-with-extras/kustomization.yaml new file mode 100644 index 00000000..7eff6b18 --- /dev/null +++ b/compositions/upbound-aws-provider/eks/cluster-with-extras/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- definition.yaml +- eks.yaml diff --git a/examples/upbound-aws-provider/composite-resources/eks/cluster-basic/README.md b/examples/upbound-aws-provider/composite-resources/eks/cluster-basic/README.md new file mode 100644 index 00000000..ce584c34 --- /dev/null +++ b/examples/upbound-aws-provider/composite-resources/eks/cluster-basic/README.md @@ -0,0 +1,77 @@ +# Example to deploy a basic EKS cluster with one nodegroup +This example provides a Claim that deploys an EKS Cluster with no Addons and a single Nodegroup. First, it applies the Crossplane XRDs and Composition. Then it applies an ArgoCD app that contains the Crossplane Claim. The Crossplane creates the EKS Cluster and Nodegroup resources. + +As the Claim requires some input parameters from the target environment, to use it it's first required to fork the repository to your own account or copy it to a private repository. +Then edit the `eks-cluster-basic.yaml` file, providing the following informations: + - The Subnet IDs on `spec.subnets` to provision the EKS Cluster control-plane private endpoints and the Nodegroup hosts. + - The ProviderConfig name on `spec.providerConfigName` that should be used to create the EKS Cluster. + +In addition to that, it's also required to edit the `argocd-eks-app.yaml` file, editing the following information: + - `spec.source.repoURL` to point to your fork or private copy of the repository. + +## Pre-requisites + - [Upbound AWS Provider Crossplane Blueprint Examples](../../README.md) + + +### Deploy XRDs and Compositions +```shell +kubectl apply -k . +``` + +Verify the XRDs +```shell +kubectl get xrds +``` + +Expected output +``` +NAME ESTABLISHED OFFERED AGE +xekss.awsblueprints.io True True 5m4s +``` + +Verify the Compositions +```shell +kubectl get compositions +``` + +Expected output. Note: the output might contain more compositions but these are the ones uses by the claim in the next step +``` +NAME XR-KIND XR-APIVERSION AGE +xeks.awsblueprints.io XEks awsblueprints.io/v1alpha1 5m12s +``` + +### Validate `EnvironmentConfig` + +Crossplane `environmentconfig` named `cluster` is created by the bootstrap terraform code. Validate it exists and contains proper values +``` +kubectl get environmentconfig cluster -o yaml +``` +Expected output +``` +apiVersion: apiextensions.crossplane.io/v1alpha1 +kind: EnvironmentConfig +metadata: + name: cluster +data: + awsAccountID: + eksOIDC: +``` + +### Apply ArgoCD application +The applications contains the claim and the deployment. +``` +kubectl apply -f argocd-eks-app.yaml +``` + +### Navigate to the ArgoCD UI +Find the ArgoCD URL: +``` +kubectl -n argocd get svc argo-cd-argocd-server -o jsonpath='{.status.loadBalancer.ingress[0].hostname}' +``` +The username is `admin` and the password can be obtained by executing: +``` +kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d +``` + +### Sync the ArgoCD app and watch the eks-app come up. +![EKS App ArgoCD](../../../diagrams/argocd-eks-app-sync.png) diff --git a/examples/upbound-aws-provider/composite-resources/eks/cluster-basic/argocd-eks-app.yaml b/examples/upbound-aws-provider/composite-resources/eks/cluster-basic/argocd-eks-app.yaml new file mode 100644 index 00000000..742d0957 --- /dev/null +++ b/examples/upbound-aws-provider/composite-resources/eks/cluster-basic/argocd-eks-app.yaml @@ -0,0 +1,17 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: eks-app + namespace: argocd +spec: + destination: + namespace: default + server: https://kubernetes.default.svc + project: default + source: + path: examples/upbound-aws-provider/composite-resources/eks/cluster-basic/ + directory: + include: "eks-cluster-basic.yaml" + repoURL: https://github.com/awslabs/crossplane-on-eks.git + targetRevision: HEAD + syncPolicy: {} diff --git a/examples/upbound-aws-provider/composite-resources/eks/cluster-basic/eks-cluster-basic.yaml b/examples/upbound-aws-provider/composite-resources/eks/cluster-basic/eks-cluster-basic.yaml new file mode 100644 index 00000000..33524bd3 --- /dev/null +++ b/examples/upbound-aws-provider/composite-resources/eks/cluster-basic/eks-cluster-basic.yaml @@ -0,0 +1,33 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: crossplane-bootstrap +--- +apiVersion: awsblueprints.io/v1alpha1 +kind: Eks +metadata: + name: crossplane-bootstrap + namespace: crossplane-bootstrap +spec: + id: crossplane-bootstrap + region: us-east-1 + authenticationMode: API + bootstrapClusterCreatorAdminPermissions: true + enabledClusterLogTypes: + - api + - audit + - authenticator + - controllerManager + - scheduler + endpointPrivateAccess: true + endpointPublicAccess: true + deletionPolicy: "Delete" + providerConfigName: crossplane-provider-config + version: "1.30" + subnets: + - subnet-aaaaaaaaaaaaaaaaa + - subnet-bbbbbbbbbbbbbbbbb + - subnet-ccccccccccccccccc + writeConnectionSecretToRef: + name: crossplane-bootstrap-kubeconfig diff --git a/examples/upbound-aws-provider/composite-resources/eks/cluster-basic/kustomization.yaml b/examples/upbound-aws-provider/composite-resources/eks/cluster-basic/kustomization.yaml new file mode 100644 index 00000000..4b9c5eef --- /dev/null +++ b/examples/upbound-aws-provider/composite-resources/eks/cluster-basic/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../../../../../compositions/upbound-aws-provider/eks/cluster-basic diff --git a/examples/upbound-aws-provider/composite-resources/eks/cluster-with-extras/README.md b/examples/upbound-aws-provider/composite-resources/eks/cluster-with-extras/README.md new file mode 100644 index 00000000..b18a3909 --- /dev/null +++ b/examples/upbound-aws-provider/composite-resources/eks/cluster-with-extras/README.md @@ -0,0 +1,91 @@ +# Example to deploy an EKS cluster with one nodegroup and extra features +This example provides a Claim that deploys an EKS Cluster with some Addons and a single Nodegroup. First, it applies the Crossplane XRDs and Composition. Then it applies an ArgoCD app that contains the Crossplane Claim. The Crossplane creates the EKS Cluster, the Addons and Nodegroup resources. + +In addition to the EKS Cluster control-plane and the Nodegroup, the following resources, Addons and features are also deployed: + - A KMS Key to be used on the cluster encryption for secrets. + - VPC CNI Addon + - EBS CSI Driver Addon + - CoreDNS Addon + - KubeProxyAddon + - Pod Identity Agent Addon + - CSI Snapshot Controller Addon + - S3 Mountpoint CSI Driver Addon + - EFS CSI Driver Addon + - AWS Load Balancer Controller + +As the Claim requires some input parameters from the target environment, to use it it's first required to fork the repository to your own account or copy it to a private repository. +Then edit the `eks-cluster-with-extras.yaml` file, providing the following informations: + - The Subnet IDs on `spec.subnets` to provision the EKS Cluster control-plane private endpoints and the Nodegroup hosts. + - The ProviderConfig name on `spec.providerConfigName` that should be used to create the EKS Cluster. + +If using the `authenticationMode` as 'CONFIG_MAP' or 'API_AND_CONFIG_MAP', it's also possible to provide `iam.clusterAdminRoleArn` and/or `iam.clusterAdminUserArn`. Those role/user should already exist (or be created manually) and will be given cluster administrator rigths in the `aws-auth` ConfigMap. + +In addition to that, it's also required to edit the `argocd-eks-app.yaml` file, editing the following information: + - `spec.source.repoURL` to point to your fork or private copy of the repository. + +## Pre-requisites + - [Upbound AWS Provider Crossplane Blueprint Examples](../../README.md) + + +### Deploy XRDs and Compositions +```shell +kubectl apply -k . +``` + +Verify the XRDs +```shell +kubectl get xrds +``` + +Expected output +``` +NAME ESTABLISHED OFFERED AGE +xekss.awsblueprints.io True True 5m4s +``` + +Verify the Compositions +```shell +kubectl get compositions +``` + +Expected output. Note: the output might contain more compositions but these are the ones uses by the claim in the next step +``` +NAME XR-KIND XR-APIVERSION AGE +xeks.awsblueprints.io XEks awsblueprints.io/v1alpha1 5m12s +``` + +### Validate `EnvironmentConfig` + +Crossplane `environmentconfig` named `cluster` is created by the bootstrap terraform code. Validate it exists and contains proper values +``` +kubectl get environmentconfig cluster -o yaml +``` +Expected output +``` +apiVersion: apiextensions.crossplane.io/v1alpha1 +kind: EnvironmentConfig +metadata: + name: cluster +data: + awsAccountID: + eksOIDC: +``` + +### Apply ArgoCD application +The applications contains the claim and the deployment. +``` +kubectl apply -f argocd-eks-app.yaml +``` + +### Navigate to the ArgoCD UI +Find the ArgoCD URL: +``` +kubectl -n argocd get svc argo-cd-argocd-server -o jsonpath='{.status.loadBalancer.ingress[0].hostname}' +``` +The username is `admin` and the password can be obtained by executing: +``` +kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d +``` + +### Sync the ArgoCD app and watch the eks-app come up. +![EKS App ArgoCD](../../../diagrams/argocd-eks-app-sync.png) diff --git a/examples/upbound-aws-provider/composite-resources/eks/cluster-with-extras/argocd-eks-app.yaml b/examples/upbound-aws-provider/composite-resources/eks/cluster-with-extras/argocd-eks-app.yaml new file mode 100644 index 00000000..482c21ff --- /dev/null +++ b/examples/upbound-aws-provider/composite-resources/eks/cluster-with-extras/argocd-eks-app.yaml @@ -0,0 +1,17 @@ +apiVersion: argoproj.io/v1alpha1 +kind: Application +metadata: + name: eks-app + namespace: argocd +spec: + destination: + namespace: default + server: https://kubernetes.default.svc + project: default + source: + path: examples/upbound-aws-provider/composite-resources/eks/cluster-with-extras/ + directory: + include: "eks-cluster-with-extras.yaml" + repoURL: https://github.com/awslabs/crossplane-on-eks.git + targetRevision: HEAD + syncPolicy: {} diff --git a/examples/upbound-aws-provider/composite-resources/eks/cluster-with-extras/eks-cluster-with-extras.yaml b/examples/upbound-aws-provider/composite-resources/eks/cluster-with-extras/eks-cluster-with-extras.yaml new file mode 100644 index 00000000..1ef7352d --- /dev/null +++ b/examples/upbound-aws-provider/composite-resources/eks/cluster-with-extras/eks-cluster-with-extras.yaml @@ -0,0 +1,36 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: crossplane-bootstrap +--- +apiVersion: awsblueprints.io/v1alpha1 +kind: Eks +metadata: + name: crossplane-bootstrap + namespace: crossplane-bootstrap +spec: + id: crossplane-bootstrap + region: us-east-1 + authenticationMode: API_AND_CONFIG_MAP + bootstrapClusterCreatorAdminPermissions: true + enabledClusterLogTypes: + - api + - audit + - authenticator + - controllerManager + - scheduler + endpointPrivateAccess: true + endpointPublicAccess: true + iam: + clusterAdminRoleArn: "arn:aws:iam::123456789012:role/eks-admin-role" + clusterAdminUserArn: "arn:aws:iam::123456789012:user/eks-admin-user" + deletionPolicy: "Delete" + providerConfigName: crossplane-provider-config + version: "1.30" + subnets: + - subnet-aaaaaaaaaaaaaaaaa + - subnet-bbbbbbbbbbbbbbbbb + - subnet-ccccccccccccccccc + writeConnectionSecretToRef: + name: crossplane-bootstrap-kubeconfig diff --git a/examples/upbound-aws-provider/composite-resources/eks/cluster-with-extras/kustomization.yaml b/examples/upbound-aws-provider/composite-resources/eks/cluster-with-extras/kustomization.yaml new file mode 100644 index 00000000..fba0e721 --- /dev/null +++ b/examples/upbound-aws-provider/composite-resources/eks/cluster-with-extras/kustomization.yaml @@ -0,0 +1,4 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +bases: +- ../../../../../compositions/upbound-aws-provider/eks/cluster-with-extras diff --git a/examples/upbound-aws-provider/diagrams/argocd-eks-app-sync.png b/examples/upbound-aws-provider/diagrams/argocd-eks-app-sync.png new file mode 100644 index 00000000..0bad520d Binary files /dev/null and b/examples/upbound-aws-provider/diagrams/argocd-eks-app-sync.png differ