From 2a78efd082a452641f766fb0c2205009bb25a0ab Mon Sep 17 00:00:00 2001 From: Matt Dainty Date: Tue, 20 Apr 2021 10:13:14 +0100 Subject: [PATCH] feat: Allow to override cluster and workers egress CIDRs (#1237) --- README.md | 2 ++ cluster.tf | 2 +- variables.tf | 12 ++++++++++++ workers.tf | 2 +- 4 files changed, 16 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 33e668cb9a..42b1279612 100644 --- a/README.md +++ b/README.md @@ -234,6 +234,7 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | [cluster\_create\_security\_group](#input\_cluster\_create\_security\_group) | Whether to create a security group for the cluster or attach the cluster to `cluster_security_group_id`. | `bool` | `true` | no | | [cluster\_create\_timeout](#input\_cluster\_create\_timeout) | Timeout value when creating the EKS cluster. | `string` | `"30m"` | no | | [cluster\_delete\_timeout](#input\_cluster\_delete\_timeout) | Timeout value when deleting the EKS cluster. | `string` | `"15m"` | no | +| [cluster\_egress\_cidrs](#input\_cluster\_egress\_cidrs) | List of CIDR blocks that are permitted for cluster egress traffic. | `list(string)` | 
[
  "0.0.0.0/0"
]
| no | | [cluster\_enabled\_log\_types](#input\_cluster\_enabled\_log\_types) | A list of the desired control plane logging to enable. For more information, see Amazon EKS Control Plane Logging documentation (https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html) | `list(string)` | `[]` | no | | [cluster\_encryption\_config](#input\_cluster\_encryption\_config) | Configuration block with encryption configuration for the cluster. See examples/secrets\_encryption/main.tf for example format | 
list(object({
    provider_key_arn = string
    resources        = list(string)
  }))
| `[]` | no | | [cluster\_endpoint\_private\_access](#input\_cluster\_endpoint\_private\_access) | Indicates whether or not the Amazon EKS private API server endpoint is enabled. | `bool` | `false` | no | @@ -287,6 +288,7 @@ MIT Licensed. See [LICENSE](https://github.com/terraform-aws-modules/terraform-a | [worker\_security\_group\_id](#input\_worker\_security\_group\_id) | If provided, all workers will be attached to this security group. If not given, a security group will be created with necessary ingress/egress to work with the EKS cluster. | `string` | `""` | no | | [worker\_sg\_ingress\_from\_port](#input\_worker\_sg\_ingress\_from\_port) | Minimum port number from which pods will accept communication. Must be changed to a lower value if some pods in your cluster will expose a port lower than 1025 (e.g. 22, 80, or 443). | `number` | `1025` | no | | [workers\_additional\_policies](#input\_workers\_additional\_policies) | Additional policies to be added to workers | `list(string)` | `[]` | no | +| [workers\_egress\_cidrs](#input\_workers\_egress\_cidrs) | List of CIDR blocks that are permitted for workers egress traffic. | `list(string)` | 
[
  "0.0.0.0/0"
]
| no | | [workers\_group\_defaults](#input\_workers\_group\_defaults) | Override default values for target groups. See workers\_group\_defaults\_defaults in local.tf for valid keys. | `any` | `{}` | no | | [workers\_role\_name](#input\_workers\_role\_name) | User defined workers role name. | `string` | `""` | no | | [write\_kubeconfig](#input\_write\_kubeconfig) | Whether to write a Kubectl config file containing the cluster configuration. Saved to `config_output_path`. | `bool` | `true` | no | diff --git a/cluster.tf b/cluster.tf index 4047a77658..d8ffa66a1e 100644 --- a/cluster.tf +++ b/cluster.tf @@ -99,7 +99,7 @@ resource "aws_security_group_rule" "cluster_egress_internet" { description = "Allow cluster egress access to the Internet." protocol = "-1" security_group_id = local.cluster_security_group_id - cidr_blocks = ["0.0.0.0/0"] + cidr_blocks = var.cluster_egress_cidrs from_port = 0 to_port = 0 type = "egress" diff --git a/variables.tf b/variables.tf index bcec29b2f8..6f904b6354 100644 --- a/variables.tf +++ b/variables.tf @@ -375,3 +375,15 @@ variable "cluster_service_ipv4_cidr" { type = string default = null } + +variable "cluster_egress_cidrs" { + description = "List of CIDR blocks that are permitted for cluster egress traffic." + type = list(string) + default = ["0.0.0.0/0"] +} + +variable "workers_egress_cidrs" { + description = "List of CIDR blocks that are permitted for workers egress traffic." + type = list(string) + default = ["0.0.0.0/0"] +} diff --git a/workers.tf b/workers.tf index 35132b2675..58fa3b23e2 100644 --- a/workers.tf +++ b/workers.tf @@ -360,7 +360,7 @@ resource "aws_security_group_rule" "workers_egress_internet" { description = "Allow nodes all egress to the Internet." protocol = "-1" security_group_id = local.worker_security_group_id - cidr_blocks = ["0.0.0.0/0"] + cidr_blocks = var.workers_egress_cidrs from_port = 0 to_port = 0 type = "egress"