feat(blueprint): attach the ebs control policy to the ebs-csi-addon (#…

…239) * feat(blueprint): attach the ebs control policy to the ebs-csi-addon * feat(eks-addons): service account role mapping
Young-ook · Jan 12, 2023 · 7b05e6b · 7b05e6b
1 parent 6bec3fd
commit 7b05e6b
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 8 deletions.
diff --git a/examples/blueprint/main.tf b/examples/blueprint/main.tf
@@ -83,7 +83,7 @@ module "aws" {
 ### eks-addons
 module "eks-addons" {
   source  = "Young-ook/eks/aws//modules/eks-addons"
-  version = "2.0.0"
+  version = "2.0.3"
   tags    = var.tags
   addons = [
     {
@@ -99,8 +99,14 @@ module "eks-addons" {
       eks_name = module.eks.cluster.name
     },
     {
-      name     = "aws-ebs-csi-driver"
-      eks_name = module.eks.cluster.name
+      name           = "aws-ebs-csi-driver"
+      namespace      = "kube-system"
+      serviceaccount = "ebs-csi-controller-sa"
+      eks_name       = module.eks.cluster.name
+      oidc           = module.eks.oidc
+      policy_arns = [
+        format("arn:%s:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy", module.aws.partition.partition),
+      ]
     },
   ]
 }

diff --git a/modules/eks-addons/main.tf b/modules/eks-addons/main.tf
@@ -1,10 +1,11 @@
 ### application/addons
 resource "aws_eks_addon" "addon" {
-  for_each      = { for addon in var.addons : addon.name => addon }
-  addon_name    = each.key
-  addon_version = lookup(each.value, "version", local.default_addon_config["version"])
-  cluster_name  = lookup(each.value, "eks_name", local.default_addon_config["eks_name"])
-  tags          = merge({ Name = each.key }, local.default-tags, var.tags)
+  for_each                 = { for addon in var.addons : addon.name => addon }
+  addon_name               = each.key
+  addon_version            = lookup(each.value, "version", local.default_addon_config["version"])
+  cluster_name             = lookup(each.value, "eks_name", local.default_addon_config["eks_name"])
+  service_account_role_arn = lookup(module.irsa, each.key, null) == null ? null : module.irsa[each.key].arn
+  tags                     = merge({ Name = each.key }, local.default-tags, var.tags)
 }
 
 ### security/policy