rework terraform-aws-modules#866 and add suggested reviews

fargate.tf

@@ -3,7 +3,19 @@ module "fargate" {
  cluster_name = coalescelist(aws_eks_cluster.this[*].name, [""])[0]
  create_eks = var.create_eks
  create_fargate_pod_execution_role = var.create_fargate_pod_execution_role
+ fargate_pod_execution_role_name = var.fargate_pod_execution_role_name
  fargate_profiles = var.fargate_profiles
+ iam_path = var.iam_path
  subnets = var.subnets
  tags = var.tags
+
+ # Hack to ensure ordering of resource creation.
+ # This is a homemade `depends_on` https://discuss.hashicorp.com/t/tips-howto-implement-module-depends-on-emulation/2305/2
+ # Do not create node_groups before other resources are ready and removes race conditions
+ # Ensure these resources are created before "unlocking" the data source.
+ # Will be removed in Terraform 0.13
+ eks_depends_on = [
+ aws_eks_cluster.this,
+ kubernetes_config_map.aws_auth
+ ]
 }

modules/fargate/data.tf

@@ -0,0 +1,18 @@
+data "aws_iam_policy_document" "eks_fargate_pod_assume_role" {
+ count = local.create_eks && var.create_fargate_pod_execution_role ? 1 : 0
+ statement {
+ effect = "Allow"
+ actions = ["sts:AssumeRole"]
+
+ principals {
+ type = "Service"
+ identifiers = ["eks-fargate-pods.amazonaws.com"]
+ }
+ }
+}
+
+data "aws_iam_role" "custom_fargate_iam_role" {
+ count = local.create_eks && ! var.create_fargate_pod_execution_role ? 1 : 0
+ name = var.fargate_pod_execution_role_name
+}
+

modules/fargate/fargate.tf

@@ -1,44 +1,39 @@
-# EKS Fargate Pod Execution Role
-
-data "aws_iam_policy_document" "eks_fargate_pod_assume_role" {
- count = var.create_eks && var.create_fargate_pod_execution_role ? 1 : 0
- statement {
- effect = "Allow"
- actions = ["sts:AssumeRole"]
-
- principals {
- type = "Service"
- identifiers = ["eks-fargate-pods.amazonaws.com"]
- }
- }
+locals {
+ create_eks = var.create_eks && length(var.fargate_profiles) > 0
+ pod_execution_role_arn = var.create_fargate_pod_execution_role ? element(concat(aws_iam_role.eks_fargate_pod.*.arn, list("")), 0) : element(concat(data.aws_iam_role.custom_fargate_iam_role.*.arn, list("")), 0)
+ pod_execution_role_name = var.create_fargate_pod_execution_role ? element(concat(aws_iam_role.eks_fargate_pod.*.name, list("")), 0) : element(concat(data.aws_iam_role.custom_fargate_iam_role.*.name, list("")), 0)
 }
 
 resource "aws_iam_role" "eks_fargate_pod" {
- count = var.create_eks && var.create_fargate_pod_execution_role ? 1 : 0
- name  = format("%s-fargate", var.cluster_name)
+ count = local.create_eks && var.create_fargate_pod_execution_role ? 1 : 0
+ name_prefix = format("%s-fargate", var.cluster_name)
  assume_role_policy = data.aws_iam_policy_document.eks_fargate_pod_assume_role[0].json
  tags = var.tags
+ path = var.iam_path
+
+ depends_on = [var.eks_depends_on]
 }
 
 resource "aws_iam_role_policy_attachment" "eks_fargate_pod" {
- count = var.create_eks && var.create_fargate_pod_execution_role ? 1 : 0
- policy_arn = "arn:aws:iam::aws:policy/AmazonEKSFargatePodExecutionRolePolicy"
+ count = local.create_eks && var.create_fargate_pod_execution_role ? 1 : 0
+ policy_arn = "${local.policy_arn_prefix}/AmazonEKSFargatePodExecutionRolePolicy"
  role = aws_iam_role.eks_fargate_pod[0].name
-}
-
 
-# EKS Fargate profiles
+ depends_on = [var.eks_depends_on]
+}
 
 resource "aws_eks_fargate_profile" "this" {
- for_each = var.create_eks ? var.fargate_profiles : {}
+ for_each = local.create_eks ? var.fargate_profiles : {}
  cluster_name = var.cluster_name
  fargate_profile_name = lookup(each.value, "name", format("%s-fargate-%s", var.cluster_name, replace(each.key, "_", "-")))
- pod_execution_role_arn = aws_iam_role.eks_fargate_pod[0].arn
+ pod_execution_role_arn = local.pod_execution_role_arn
  subnet_ids = var.subnets
  tags = var.tags
 
  selector {
  namespace = each.value.namespace
  labels = each.value.labels
  }
+
+ depends_on = [var.eks_depends_on]
 }

modules/fargate/outputs.tf

@@ -1,11 +1,21 @@
+output "fargate_profile_ids" {
+ description = "EKS Cluster name and EKS Fargate Profile names separated by a colon (:)."
+ value = [for f in aws_eks_fargate_profile.this : f.id]
+}
+
+output "fargate_profile_arns" {
+ description = "Amazon Resource Name (ARN) of the EKS Fargate Profiles."
+ value = [for f in aws_eks_fargate_profile.this : f.arn]
+}
+
 output "iam_role_name" {
  description = "IAM role name for EKS Fargate pods"
- value = element(concat(aws_iam_role.eks_fargate_pod.*.name, list("")), 0)
+ value = local.pod_execution_role_name
 }
 
 output "iam_role_arn" {
  description = "IAM role ARN for EKS Fargate pods"
- value = element(concat(aws_iam_role.eks_fargate_pod.*.arn, list("")), 0)
+ value = local.pod_execution_role_arn
 }
 
 output "aws_auth_roles" {

modules/fargate/variables.tf

@@ -1,5 +1,5 @@
 variable "cluster_name" {
- description = "Name of parent cluster."
+ description = "Name of the EKS cluster."
  type = string
 }
 
@@ -10,11 +10,17 @@ variable "create_eks" {
 }
 
 variable "create_fargate_pod_execution_role" {
- description = "Controls if the EKS Fargate pod execution IAM role should be created."
+ description = "Controls if the the IAM Role that provides permissions for the EKS Fargate Profile should be created."
  type = bool
  default = true
 }
 
+variable "fargate_pod_execution_role_name" {
+ description = "The IAM Role that provides permissions for the EKS Fargate Profile."
+ type = string
+ default = null
+}
+
 variable "fargate_profiles" {
  description = "Fargate profiles to create."
  type = map(object({
@@ -33,3 +39,11 @@ variable "tags" {
  description = "A map of tags to add to all resources."
  type = map(string)
 }
+
+# Hack for a homemade `depends_on` https://discuss.hashicorp.com/t/tips-howto-implement-module-depends-on-emulation/2305/2
+# Will be removed in Terraform 0.13 with the support of module's `depends_on` https:/hashicorp/terraform/issues/10462
+variable "eks_depends_on" {
+ description = "List of references to other resources this submodule depends on."
+ type = any
+ default = null
+}

outputs.tf

@@ -161,6 +161,16 @@ output "worker_iam_role_arn" {
  )[0]
 }
 
+output "fargate_profile_ids" {
+ description = "EKS Cluster name and EKS Fargate Profile names separated by a colon (:)."
+ value = module.fargate.fargate_profile_ids
+}
+
+output "fargate_profile_arns" {
+ description = "Amazon Resource Name (ARN) of the EKS Fargate Profiles."
+ value = module.fargate.fargate_profile_arns
+}
+
 output "fargate_iam_role_name" {
  description = "IAM role name for EKS Fargate pods"
  value = module.fargate.iam_role_name