v0.6.0

Update Terraform cloudposse/iam-policy/aws to v0.4.0 @renovate (#32)

This PR contains the following updates:

Package	Type	Update	Change
cloudposse/iam-policy/aws (source)	module	minor	0.3.0 -> 0.4.0

---

v0.5.0

feat: Add permission boundary to IAM role @topikachu (#30)

what

• add permissions_boundary to aws_iam_role

why

• Our org requires all IAM role has permissions_boundary

references

• https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role#permissions_boundary
• cloudposse/terraform-aws-eks-iam-role#29

git.io->cloudposse.tools update @dylanbannon (#29)

what and why

Change all references to git.io/build-harness into cloudposse.tools/build-harness, since git.io redirects will stop working on April 29th, 2022.

References

• DEV-143

v0.4.3

🚀 Enhancements

Override the Release name @nitrocode (#25)

what

• Override the release name

why

• Deploy multiple of the same chart to the same namespace

references

• Closes #22

v0.4.2

🚀 Enhancements

Fix: Make `eks_cluster_oidc_issuer_url` Non-optional and Add Validation Rule @korenyoni (#27)

what

• Make eks_cluster_oidc_issuer_url non-optional and add validation rule.

why

• eks_cluster_oidc_issuer_url is currently optional, except it supplies the same value directly to cloudposse/eks-iam-role/aws, which has a validation rule on it not being empty. This results in a run-time error if eks_cluster_oidc_issuer_url is empty.

╷
│ Error: Invalid value for variable
│ 
│   on .terraform/modules/ocean_controller/main.tf line 28, in module "eks_iam_role":
│   28:   eks_cluster_oidc_issuer_url = var.eks_cluster_oidc_issuer_url
│ 
│ The eks_cluster_oidc_issuer_url value must have a value.
│ 
│ This was checked by the validation rule at .terraform/modules/ocean_controller.eks_iam_role/variables.tf:38,3-13.
╵
Releasing state lock. This may take a few moments...
exit status 1

See: https://github.com/cloudposse/terraform-aws-eks-iam-role/blob/7fbf1965f71d6897ec583c30fac2875a6582a8d2/variables.tf#L34-L42

references

• Closes #26

🐛 Bug Fixes

Fix: Make `eks_cluster_oidc_issuer_url` Non-optional and Add Validation Rule @korenyoni (#27)

what

• Make eks_cluster_oidc_issuer_url non-optional and add validation rule.

why

• eks_cluster_oidc_issuer_url is currently optional, except it supplies the same value directly to cloudposse/eks-iam-role/aws, which has a validation rule on it not being empty. This results in a run-time error if eks_cluster_oidc_issuer_url is empty.

╷
│ Error: Invalid value for variable
│ 
│   on .terraform/modules/ocean_controller/main.tf line 28, in module "eks_iam_role":
│   28:   eks_cluster_oidc_issuer_url = var.eks_cluster_oidc_issuer_url
│ 
│ The eks_cluster_oidc_issuer_url value must have a value.
│ 
│ This was checked by the validation rule at .terraform/modules/ocean_controller.eks_iam_role/variables.tf:38,3-13.
╵
Releasing state lock. This may take a few moments...
exit status 1

See: https://github.com/cloudposse/terraform-aws-eks-iam-role/blob/7fbf1965f71d6897ec583c30fac2875a6582a8d2/variables.tf#L34-L42

references

• Closes #26

v0.4.1

🚀 Enhancements

Bump eks iam to 0.11.1 @nitrocode (#23)

what

• Bump eks iam to 0.11.1

why

• Prevent iam role creation without eks oidc set

references

• Depends on cloudposse/terraform-aws-eks-iam-role#24
• Closes PR #24

v0.4.0

Annotation override @nitrocode (#21)

what

• Annotation override

why

Ran into an issue where the annotation couldn't be either of these

serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn
rbac.serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn

and instead needed to be

annotations.serviceAccount.eks\\.amazonaws\\.com/role-arn

The closest I could come to this was by setting service_account_set_key_path = "annotations.serviceAccount" which resulted in

annotations.serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn

Easiest thing is to replace the whole thing

references

• https://github.com/gravitational/teleport/blob/c250d087441ce4e9155e9e9d894c099142dd4596/examples/chart/teleport-kube-agent/values.yaml#L140-L150

v0.3.2

🚀 Enhancements

This brings the repo out of pre-release because this re-enables policy statements sent in as a map

Bump iam_role and iam_policy modules @nitrocode (#19)

what

• Bump iam_role and iam_policy modules

why

• Bring in a fix for the for_each bug from upstream modules

references

• cloudposse/terraform-aws-iam-policy#9
• cloudposse/terraform-aws-eks-iam-role#23

v0.3.1

🚀 Enhancements

Set to pre-release because this broke policy statements sent in as a map

Bump iam policy module to 0.2.3 @nitrocode (#13)

what

• Bump iam policy module to 0.2.3

why

• Otherwise an error will be thrown when iam policy statements is empty

references

• Depends on PR cloudposse/terraform-aws-iam-policy#7

v0.3.0

Make service account key path as variable @goruha (#12)

what

• Made service account key path as variable

why

• Different charts use different variables.yaml structure,
  for some you use serviceAccount key path for annotations but other use rbac.serviceAccount.

v0.2.1

🚀 Enhancements

Feat: allow `var.name` to be set to empty @korenyoni (#11)

what

• Allow var.name to be set to empty by coalescing var.name with var.chart for the helm_release resource.
• Update README.

why

• var.name is optional in eks-iam-role. Omitting it results in shorter names for IAM Roles created for ServiceAccounts, if var.service_account_name is supplied. However, the name attribute for the helm_release resource is not optional, so it should be coalesced with var.chart.

references

• https://github.com/cloudposse/terraform-aws-eks-iam-role/blob/5022028bfd192101929a9df64adf849101a81ab7/main.tf#L8-L25