Skip to content

Commit bcbff9f

Browse files
ns-squareopsns-squareops
authored
Merge pull request #100 from squareops/release-4.1.0
Release 4.1.0
2 parents bdc660e + 4a1f9e3 commit bcbff9f

File tree

7 files changed

+237
-17
lines changed

7 files changed

+237
-17
lines changed

‎examples/complete/config/kubernetes-dashboard.yaml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
## Number of replicas
2+
replicaCount: 1
3+
4+
affinity:
5+
nodeAffinity:
6+
requiredDuringSchedulingIgnoredDuringExecution:
7+
nodeSelectorTerms:
8+
- matchExpressions:
9+
- key: "Addons-Services"
10+
operator: In
11+
values:
12+
- "true"
13+
14+
resources:
15+
requests:
16+
cpu: 100m
17+
memory: 200Mi
18+
limits:
19+
cpu: 2
20+
memory: 400Mi
21+
22+

‎examples/complete/main.tf

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ locals {
2323

2424
module "eks-addons" {
2525
source = "squareops/eks-addons/aws"
26-
version = "4.0.2"
26+
version = "4.1.0"
2727
name = local.name
2828
tags = local.additional_tags
2929
vpc_id = local.vpc_id
@@ -38,7 +38,7 @@ module "eks-addons" {
3838
eks_cluster_name = data.aws_eks_cluster.cluster.name
3939

4040
#VPC-CNI-DRIVER
41-
amazon_eks_vpc_cni_enabled = true # enable VPC-CNI
41+
amazon_eks_vpc_cni_enabled = false # enable VPC-CNI
4242
vpc_cni_version = "v1.19.2-eksbuild.1"
4343

4444
#EBS-CSI-DRIVER
@@ -168,11 +168,13 @@ module "eks-addons" {
168168
kubernetes_dashboard_enabled = false
169169
kubernetes_dashboard_version = "6.0.8"
170170
kubernetes_dashboard_config = {
171+
values_yaml = file("${path.module}/config/kubernetes-dashboard.yaml")
171172
k8s_dashboard_ingress_load_balancer = "nlb" # Pass either "nlb/alb" to choose load balancer controller as ingress-nginx controller or ALB controller
172173
private_alb_enabled = false # to enable Internal (Private) ALB , set this and aws_load_balancer_controller_enabled "true" together
173174
alb_acm_certificate_arn = "" # If using ALB in above parameter, ensure you provide the ACM certificate ARN for SSL.
174175
k8s_dashboard_hostname = "k8s-dashboard.rnd.squareops.in" # Enter Hostname
175176
ingress_class_name = "nginx" # For public nlb use "nginx", for private NLB use "private-nginx", For ALB, use "alb"
177+
enable_service_monitor = false
176178
}
177179

178180
## ArgoCD
@@ -256,4 +258,4 @@ module "eks-addons" {
256258
falco_enabled = false # to enable falco
257259
falco_version = "4.0.0"
258260
slack_webhook = "xoxb-379541400966-iibMHnnoaPzVl"
259-
}
261+
}

‎main.tf

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -239,13 +239,17 @@ module "kubernetes-dashboard" {
239239
source = "./modules/kubernetes-dashboard"
240240
count = var.kubernetes_dashboard_enabled ? 1 : 0
241241
depends_on = [module.cert-manager-le-http-issuer, module.ingress-nginx, module.private-ingress-nginx, module.aws-load-balancer-controller]
242+
addon_version = var.kubernetes_dashboard_version
243+
kubernetes_dashboard_config = {
244+
values_yaml = var.kubernetes_dashboard_config.values_yaml
242245
k8s_dashboard_hostname = var.kubernetes_dashboard_config.k8s_dashboard_hostname
243246
alb_acm_certificate_arn = var.kubernetes_dashboard_config.alb_acm_certificate_arn
244247
k8s_dashboard_ingress_load_balancer = var.kubernetes_dashboard_config.k8s_dashboard_ingress_load_balancer
245248
private_alb_enabled = var.kubernetes_dashboard_config.private_alb_enabled
246249
ingress_class_name = var.kubernetes_dashboard_config.ingress_class_name
247250
subnet_ids = var.kubernetes_dashboard_config.private_alb_enabled == true ? var.private_subnet_ids : var.public_subnet_ids
248-
addon_version = var.kubernetes_dashboard_version
251+
enable_service_monitor = var.kubernetes_dashboard_config.enable_service_monitor
252+
}
249253
}
250254

251255
## KEDA

‎modules/kubernetes-dashboard/config/values.yaml

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
## Number of replicas
2+
replicaCount: 1
3+
4+
annotations: {}
5+
## Here labels can be added to the kubernetes dashboard deployment
6+
7+
securityContext:
8+
runAsNonRoot: true
9+
seccompProfile:
10+
type: RuntimeDefault
11+
12+
## SecurityContext defaults for the kubernetes dashboard container and metrics scraper container
13+
## To disable set the following configuration to null:
14+
# containerSecurityContext: null
15+
containerSecurityContext:
16+
allowPrivilegeEscalation: false
17+
readOnlyRootFilesystem: true
18+
runAsUser: 1001
19+
runAsGroup: 2001
20+
capabilities:
21+
drop: ["ALL"]
22+
23+
## @param podLabels Extra labels for OAuth2 Proxy pods
24+
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
25+
##
26+
podLabels: {}
27+
## @param podAnnotations Annotations for OAuth2 Proxy pods
28+
## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
29+
##
30+
podAnnotations:
31+
co.elastic.logs/enabled: "true"
32+
33+
## Node labels for pod assignment
34+
## Ref: https://kubernetes.io/docs/user-guide/node-selection/
35+
##
36+
nodeSelector:
37+
kubernetes.io/os: linux
38+
39+
## List of node taints to tolerate (requires Kubernetes >= 1.6)
40+
tolerations: []
41+
42+
## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
43+
affinity:
44+
nodeAffinity:
45+
requiredDuringSchedulingIgnoredDuringExecution:
46+
nodeSelectorTerms:
47+
- matchExpressions:
48+
- key: "Addons-Services"
49+
operator: In
50+
values:
51+
- "true"
52+
53+
## Name of Priority Class of pods
54+
# priorityClassName: ""
55+
56+
## Pod resource requests & limits
57+
resources:
58+
requests:
59+
cpu: 100m
60+
memory: 200Mi
61+
limits:
62+
cpu: 2
63+
memory: 200Mi
64+
65+
## Serve application over HTTP without TLS
66+
##
67+
## Note: If set to true, you may want to add --enable-insecure-login to extraArgs
68+
protocolHttp: false
69+
70+
service:
71+
type: ClusterIP
72+
# Dashboard service port
73+
externalPort: 443
74+
annotations: {}
75+
76+
## Here labels can be added to the Kubernetes Dashboard service
77+
labels: {}
78+
79+
## Enable or disable the kubernetes.io/cluster-service label. Should be disabled for GKE clusters >=1.15.
80+
## Otherwise, the addon manager will presume ownership of the service and try to delete it.
81+
clusterServiceLabel:
82+
enabled: true
83+
key: "kubernetes.io/cluster-service"
84+
85+
ingress:
86+
enabled: true
87+
annotations: {}
88+
ingressClassName: ${ingress_class_name}
89+
hostname: ${hostname}
90+
91+
paths:
92+
- /
93+
# - /*
94+
95+
## Custom Kubernetes Dashboard Ingress paths. Will override default paths.
96+
##
97+
customPaths: []
98+
99+
settings:
100+
{}
101+
102+
## Pinned CRDs that will be displayed in dashboard's menu
103+
metricsScraper:
104+
## Wether to enable dashboard-metrics-scraper
105+
enabled: false
106+
image:
107+
repository: kubernetesui/metrics-scraper
108+
tag: v1.0.9
109+
resources: {}
110+
111+
metrics-server:
112+
enabled: false
113+
## Example for additional args
114+
# args:
115+
# - --kubelet-preferred-address-types=InternalIP
116+
# - --kubelet-insecure-tls
117+
118+
rbac:
119+
# Specifies whether namespaced RBAC resources (Role, Rolebinding) should be created
120+
create: true
121+
122+
# Specifies whether cluster-wide RBAC resources (ClusterRole, ClusterRolebinding) to access metrics should be created
123+
# Independent from rbac.create parameter.
124+
clusterRoleMetrics: true
125+
clusterReadOnlyRole: false
126+
127+
128+
serviceAccount:
129+
# Specifies whether a service account should be created
130+
create: true
131+
# The name of the service account to use.
132+
# If not set and create is true, a name is generated using the fullname template
133+
name:
134+
135+
livenessProbe:
136+
# Number of seconds to wait before sending first probe
137+
initialDelaySeconds: 30
138+
# Number of seconds to wait for probe response
139+
timeoutSeconds: 30
140+
141+
## podDisruptionBudget
142+
## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
143+
podDisruptionBudget:
144+
enabled: false
145+
## Minimum available instances; ignored if there is no PodDisruptionBudget
146+
minAvailable:
147+
## Maximum unavailable instances; ignored if there is no PodDisruptionBudget
148+
maxUnavailable:
149+
150+
151+
networkPolicy:
152+
# Whether to create a network policy that allows/restricts access to the service
153+
enabled: false
154+
155+
# Whether to set network policy to deny all ingress traffic for the kubernetes-dashboard
156+
ingressDenyAll: false
157+
158+
podSecurityPolicy:
159+
# Specifies whether a pod security policy should be created
160+
enabled: false
161+
162+
serviceMonitor:
163+
# Whether or not to create a Prometheus Operator service monitor.
164+
enabled: ${enable_service_monitor}
165+
## Here labels can be added to the serviceMonitor
166+
labels: {}
167+
## Here annotations can be added to the serviceMonitor
168+
annotations: {}
169+

‎modules/kubernetes-dashboard/main.tf

Lines changed: 17 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
locals {
2-
alb_scheme = var.private_alb_enabled ? "internal" : "internet-facing"
2+
alb_scheme = var.kubernetes_dashboard_config.private_alb_enabled ? "internal" : "internet-facing"
33
}
44

55
resource "kubernetes_namespace" "k8s-dashboard" {
@@ -16,6 +16,14 @@ resource "helm_release" "kubernetes-dashboard" {
1616
repository = "https://kubernetes.github.io/dashboard/"
1717
timeout = 600
1818
version = var.addon_version
19+
values = [
20+
templatefile("${path.module}/config/values.yaml", {
21+
hostname = var.kubernetes_dashboard_config.k8s_dashboard_hostname
22+
ingress_class_name = var.kubernetes_dashboard_config.ingress_class_name
23+
enable_service_monitor = var.kubernetes_dashboard_config.enable_service_monitor
24+
}),
25+
var.kubernetes_dashboard_config.values_yaml
26+
]
1927
}
2028

2129
resource "kubernetes_ingress_v1" "k8s-ingress" {
@@ -28,17 +36,17 @@ resource "kubernetes_ingress_v1" "k8s-ingress" {
2836
"kubernetes.io/ingress.class" = "alb"
2937
"alb.ingress.kubernetes.io/scheme" = local.alb_scheme
3038
"alb.ingress.kubernetes.io/target-type" = "ip"
31-
"alb.ingress.kubernetes.io/certificate-arn" = var.alb_acm_certificate_arn,
39+
"alb.ingress.kubernetes.io/certificate-arn" = var.kubernetes_dashboard_config.alb_acm_certificate_arn,
3240
"alb.ingress.kubernetes.io/healthcheck-path" = "/"
3341
"alb.ingress.kubernetes.io/healthcheck-protocol" = "HTTPS"
3442
"alb.ingress.kubernetes.io/backend-protocol" = "HTTPS"
3543
"alb.ingress.kubernetes.io/listen-ports" = "[{\"HTTPS\":443}]"
3644
"alb.ingress.kubernetes.io/ssl-redirect" = "443"
3745
"alb.ingress.kubernetes.io/group.name" = local.alb_scheme == "internet-facing" ? "public-alb-ingress" : "private-alb-ingress"
38-
"alb.ingress.kubernetes.io/subnets" = join(",", var.subnet_ids)
46+
"alb.ingress.kubernetes.io/subnets" = join(",", var.kubernetes_dashboard_config.subnet_ids)
3947
} : {
4048
"cert-manager.io/cluster-issuer" = "letsencrypt-prod"
41-
"kubernetes.io/ingress.class" = var.ingress_class_name
49+
"kubernetes.io/ingress.class" = var.kubernetes_dashboard_config.ingress_class_name
4250
"kubernetes.io/tls-acme" = "false"
4351
"nginx.ingress.kubernetes.io/backend-protocol" = "HTTPS"
4452
"nginx.ingress.kubernetes.io/rewrite-target" = "/$2"
@@ -50,13 +58,12 @@ resource "kubernetes_ingress_v1" "k8s-ingress" {
5058
}
5159
}
5260
spec {
53-
ingress_class_name = var.ingress_class_name
61+
ingress_class_name = var.kubernetes_dashboard_config.ingress_class_name
5462
rule {
55-
host = var.k8s_dashboard_hostname
63+
host = var.kubernetes_dashboard_config.k8s_dashboard_hostname
5664
http {
5765
path {
58-
path = var.k8s_dashboard_ingress_load_balancer == "alb" ? "/" : "/dashboard(/|$)(.*)"
59-
path_type = var.k8s_dashboard_ingress_load_balancer == "alb" ? "Prefix" : "ImplementationSpecific"
66+
path = var.kubernetes_dashboard_config.k8s_dashboard_ingress_load_balancer == "alb" ? "/" : "/dashboard(/|$)(.*)"
6067
backend {
6168
service {
6269
name = "kubernetes-dashboard"
@@ -69,8 +76,8 @@ resource "kubernetes_ingress_v1" "k8s-ingress" {
6976
}
7077
}
7178
tls {
72-
secret_name = var.k8s_dashboard_ingress_load_balancer == "alb" ? "" : "tls-k8s-dashboard"
73-
hosts = var.k8s_dashboard_ingress_load_balancer == "alb" ? [] : [var.k8s_dashboard_hostname]
79+
secret_name = var.kubernetes_dashboard_config.k8s_dashboard_ingress_load_balancer == "alb" ? "" : "tls-k8s-dashboard"
80+
hosts = var.kubernetes_dashboard_config.k8s_dashboard_ingress_load_balancer == "alb" ? [] : [var.kubernetes_dashboard_config.k8s_dashboard_hostname]
7481
}
7582
}
7683
}

‎modules/kubernetes-dashboard/variables.tf

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,18 @@ variable "subnet_ids" {
3636

3737
variable "addon_version" {
3838
description = "Helm Chart version for Kubernetes-dashboard"
39-
default = ""
39+
default = "6.0.8"
4040
type = string
4141
}
42+
43+
variable "kubernetes_dashboard_config" {
44+
type = any
45+
default = {
46+
hostname = ""
47+
values_yaml = ""
48+
ingress_class_name = ""
49+
enable_service_monitor = ""
50+
subnet_ids = []
51+
}
52+
description = "Specify the configuration settings for kubernetes-dashboard , including the hostname, and custom YAML values."
53+
}

‎variables.tf

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -520,17 +520,21 @@ variable "kubernetes_dashboard_enabled" {
520520
variable "kubernetes_dashboard_config" {
521521
description = "Specify all the configuration setup here"
522522
type = object({
523+
k8s_dashboard_hostname = string
524+
values_yaml = any
525+
enable_service_monitor = bool
523526
k8s_dashboard_ingress_load_balancer = string
524527
alb_acm_certificate_arn = string
525-
k8s_dashboard_hostname = string
526528
private_alb_enabled = bool
527529
ingress_class_name = string
528530
})
529531

530532
default = {
533+
k8s_dashboard_hostname = ""
534+
values_yaml = {}
535+
enable_service_monitor = false
531536
k8s_dashboard_ingress_load_balancer = ""
532537
alb_acm_certificate_arn = ""
533-
k8s_dashboard_hostname = ""
534538
private_alb_enabled = false
535539
ingress_class_name = ""
536540
}

0 commit comments

Comments
 (0)