Skip to content

Commit 4ef41d1

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #6517 from richardcase/capa_ami_account_users
feat: added tf infra for AWS ami account
2 parents dd77271 + 9fc1d94 commit 4ef41d1

File tree

6 files changed

+234
-0
lines changed

6 files changed

+234
-0
lines changed

‎infra/aws/terraform/cncf-k8s-infra-aws-capa-ami/README.md

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# AWS Account for CAPA AMI Publication
2+
3+
This contains Terraform used to manage users & permissions for the **cncf-k8s-infra-aws-capa-ami** AWS account (`arn:aws:organizations::348685125169:account/o-kz4vlkihvy/819546954734`).
4+
5+
## Tool Requirements
6+
7+
* [Terraform](https://developer.hashicorp.com/terraform/downloads) v1.6.0 or greater
8+
* AWS CLI
9+
10+
## Pre-reqs
11+
12+
This will need to be run by someone that is an admin in the account or by someone that can assume role to give admin in the account.
13+
14+
## Running
15+
16+
Set the AWS environment variables for the user that has access to the account.
17+
18+
Then run the following to disable the blocking of public AMIs:
19+
20+
```bash
21+
hack/disable-block.sh
22+
```
23+
24+
> NOTE: the script is used to disable the block as it doesn't naturally fit well into Terraform when running it across many regions.
25+
26+
Then do the usual terraform flow:
27+
28+
```bash
29+
terraform init
30+
terraform plan
31+
terraform apply
32+
```

‎infra/aws/terraform/cncf-k8s-infra-aws-capa-ami/hack/disable-block.sh

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
#!/usr/bin/env bash
2+
3+
# Copyright 2024 The Kubernetes Authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
## This script is used to disable the block on public access to AMIs
18+
19+
AMI_REGIONS="ap-south-1,eu-west-3,eu-west-2,eu-west-1,ap-northeast-2,ap-northeast-1,sa-east-1,ca-central-1,ap-southeast-1,ap-southeast-2,eu-central-1,us-east-1,us-east-2,us-west-1,us-west-2"
20+
21+
IFS=','
22+
read -ra arr <<<"$AMI_REGIONS"
23+
24+
for val in "${arr[@]}"; do
25+
aws ec2 disable-image-block-public-access --region "$val"
26+
done

‎infra/aws/terraform/cncf-k8s-infra-aws-capa-ami/iam.tf

+68
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
/*
2+
Copyright 2024 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
18+
# NOTE: this is the standard permissions from the TF docs.
19+
resource "aws_iam_policy" "imagebuilder" {
20+
name = "capa-image-builder-policy"
21+
path = "/"
22+
description = "Recommended policy for image builder"
23+
24+
policy = jsonencode({
25+
"Version": "2012-10-17",
26+
"Statement": [
27+
{
28+
"Effect": "Allow",
29+
"Action": [
30+
"ec2:AttachVolume",
31+
"ec2:AuthorizeSecurityGroupIngress",
32+
"ec2:CopyImage",
33+
"ec2:CreateImage",
34+
"ec2:CreateKeyPair",
35+
"ec2:CreateSecurityGroup",
36+
"ec2:CreateSnapshot",
37+
"ec2:CreateTags",
38+
"ec2:CreateVolume",
39+
"ec2:DeleteKeyPair",
40+
"ec2:DeleteSecurityGroup",
41+
"ec2:DeleteSnapshot",
42+
"ec2:DeleteVolume",
43+
"ec2:DeregisterImage",
44+
"ec2:DescribeImageAttribute",
45+
"ec2:DescribeImages",
46+
"ec2:DescribeInstances",
47+
"ec2:DescribeInstanceStatus",
48+
"ec2:DescribeRegions",
49+
"ec2:DescribeSecurityGroups",
50+
"ec2:DescribeSnapshots",
51+
"ec2:DescribeSubnets",
52+
"ec2:DescribeTags",
53+
"ec2:DescribeVolumes",
54+
"ec2:DetachVolume",
55+
"ec2:GetPasswordData",
56+
"ec2:ModifyImageAttribute",
57+
"ec2:ModifyInstanceAttribute",
58+
"ec2:ModifySnapshotAttribute",
59+
"ec2:RegisterImage",
60+
"ec2:RunInstances",
61+
"ec2:StopInstances",
62+
"ec2:TerminateInstances"
63+
],
64+
"Resource": "*"
65+
}
66+
]
67+
})
68+
}

‎infra/aws/terraform/cncf-k8s-infra-aws-capa-ami/oidc.tf

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
/*
2+
Copyright 2024 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
module "iam_github_oidc_provider" {
18+
source = "terraform-aws-modules/iam/aws//modules/iam-github-oidc-provider"
19+
20+
client_id_list = [
21+
"sts.amazonaws.com",
22+
]
23+
24+
tags = var.tags
25+
}
26+
27+
module "iam_github_oidc_role" {
28+
source = "terraform-aws-modules/iam/aws//modules/iam-github-oidc-role"
29+
30+
name = "gh-image-builder"
31+
subjects = ["kubernetes-sigs/cluster-api-provider-aws:*"]
32+
policies = {
33+
ImageBuilder = aws_iam_policy.imagebuilder.arn
34+
}
35+
36+
tags = var.tags
37+
}

‎infra/aws/terraform/cncf-k8s-infra-aws-capa-ami/providers.tf

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
/*
2+
Copyright 2024 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
terraform {
18+
backend "s3" {
19+
bucket = "cncf-k8s-infra-aws-capa-ami-tf-state"
20+
key = "terraform.tfstate"
21+
region = "us-east-2"
22+
}
23+
24+
required_version = "~> 1.8.0"
25+
26+
required_providers {
27+
aws = {
28+
source = "hashicorp/aws"
29+
version = "~> 5.66"
30+
}
31+
}
32+
}
33+
34+
provider "aws" {
35+
region = var.region
36+
37+
default_tags {
38+
tags = var.tags
39+
}
40+
}

‎infra/aws/terraform/cncf-k8s-infra-aws-capa-ami/variables.tf

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
/*
2+
Copyright 2024 The Kubernetes Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
variable "tags" {
18+
type = map(string)
19+
default = {
20+
"managed-by" = "Terraform",
21+
"group" = "sig-cluster-lifecycle",
22+
"subproject" = "cluster-api-provider-aws"
23+
"githubRepo" = "git.k8s.io/k8s.io"
24+
}
25+
}
26+
27+
variable "region" {
28+
type = string
29+
description = "AWS region for region specific resources"
30+
default = "us-east-2"
31+
}

0 commit comments

Comments
 (0)