Skip to content

Commit 1b024d4

Browse files
RohitSquareopsRohitSquareops
authored
Merge pull request #22 from Ajay-sops/main
added support for k8s dashboard
2 parents cf2d945 + 0bd08d6 commit 1b024d4

9 files changed

Lines changed: 281 additions & 5 deletions

File tree

‎README.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ module "eks_addons" {
2424
private_subnet_ids = [""]
2525
single_az_sc_config = [{ name = "infra-service-sc", zone = "zone-name" }]
2626
coredns_hpa_enabled = true
27+
kubernetes_dashboard_enabled = true
28+
k8s_dashboard_hostname = "dashboard.prod.in"
2729
kubeclarity_enabled = true
2830
kubeclarity_hostname = "kubeclarity.prod.in"
2931
kubecost_enabled = true
@@ -265,15 +267,25 @@ Before enabling the **Kubecost** addon for your Amazon EKS cluster, please make
265267
| [helm_release.falco](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
266268
| [helm_release.internal_nginx](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
267269
| [helm_release.kubeclarity](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
270+
| [helm_release.kubernetes-dashboard](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
268271
| [helm_release.metrics-server-vpa](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
269272
| [helm_release.vpa-crds](https://registry.terraform.io/providers/hashicorp/helm/latest/docs/resources/release) | resource |
273+
| [kubernetes_cluster_role.eks_read_only_role](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/cluster_role) | resource |
274+
| [kubernetes_cluster_role_binding.eks_read_only_role_binding](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/cluster_role_binding) | resource |
275+
| [kubernetes_cluster_role_binding_v1.admin-user](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/cluster_role_binding_v1) | resource |
276+
| [kubernetes_ingress_v1.k8s-ingress](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/ingress_v1) | resource |
270277
| [kubernetes_ingress_v1.kubecost](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/ingress_v1) | resource |
271278
| [kubernetes_namespace.defectdojo](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource |
272279
| [kubernetes_namespace.falco](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource |
273280
| [kubernetes_namespace.internal_nginx](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource |
281+
| [kubernetes_namespace.k8s-dashboard](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource |
274282
| [kubernetes_namespace.kube_clarity](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace) | resource |
275283
| [kubernetes_secret.kube_clarity](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource |
276284
| [kubernetes_secret.kubecost](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret) | resource |
285+
| [kubernetes_secret_v1.admin-user](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret_v1) | resource |
286+
| [kubernetes_secret_v1.dashboard_read_only_sa_token](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/secret_v1) | resource |
287+
| [kubernetes_service_account.dashboard_admin_sa](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/service_account) | resource |
288+
| [kubernetes_service_account.dashboard_read_only_sa](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/service_account) | resource |
277289
| [random_password.kube_clarity](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource |
278290
| [random_password.kubecost](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource |
279291
| [aws_eks_addon_version.kubecost](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_addon_version) | data source |
@@ -316,6 +328,7 @@ Before enabling the **Kubecost** addon for your Amazon EKS cluster, please make
316328
| <a name="input_ipv6_enabled"></a> [ipv6\_enabled](#input\_ipv6\_enabled) | whether IPv6 enabled or not | `bool` | `false` | no |
317329
| <a name="input_istio_config"></a> [istio\_config](#input\_istio\_config) | Configuration to provide settings for Istio | <pre>object({<br> ingress_gateway_enabled = bool<br> ingress_gateway_namespace = optional(string, "istio-ingressgateway")<br> egress_gateway_enabled = bool<br> egress_gateway_namespace = optional(string, "istio-egressgateway")<br> envoy_access_logs_enabled = bool<br> prometheus_monitoring_enabled = bool<br> istio_values_yaml = any<br> })</pre> | <pre>{<br> "egress_gateway_enabled": false,<br> "envoy_access_logs_enabled": true,<br> "ingress_gateway_enabled": true,<br> "istio_values_yaml": "",<br> "prometheus_monitoring_enabled": true<br>}</pre> | no |
318330
| <a name="input_istio_enabled"></a> [istio\_enabled](#input\_istio\_enabled) | Enable istio for service mesh. | `bool` | `false` | no |
331+
| <a name="input_k8s_dashboard_hostname"></a> [k8s\_dashboard\_hostname](#input\_k8s\_dashboard\_hostname) | Specify the hostname for the k8s dashboard. | `string` | `""` | no |
319332
| <a name="input_karpenter_enabled"></a> [karpenter\_enabled](#input\_karpenter\_enabled) | Enable or disable Karpenter, a Kubernetes-native, multi-tenant, and auto-scaling solution for containerized workloads on Kubernetes. | `bool` | `false` | no |
320333
| <a name="input_karpenter_provisioner_config"></a> [karpenter\_provisioner\_config](#input\_karpenter\_provisioner\_config) | Configuration to provide settings for Karpenter, including which private subnet to use, instance capacity types, and excluded instance types. | `any` | <pre>{<br> "excluded_instance_type": [<br> "nano",<br> "micro",<br> "small"<br> ],<br> "instance_capacity_type": [<br> "spot"<br> ],<br> "instance_hypervisor": [<br> "nitro"<br> ],<br> "private_subnet_name": ""<br>}</pre> | no |
321334
| <a name="input_karpenter_provisioner_enabled"></a> [karpenter\_provisioner\_enabled](#input\_karpenter\_provisioner\_enabled) | Enable or disable the installation of Karpenter, which is a Kubernetes cluster autoscaler. | `bool` | `false` | no |
@@ -327,6 +340,7 @@ Before enabling the **Kubecost** addon for your Amazon EKS cluster, please make
327340
| <a name="input_kubeclarity_namespace"></a> [kubeclarity\_namespace](#input\_kubeclarity\_namespace) | Name of the Kubernetes namespace where the kubeclarity deployment will be deployed. | `string` | `"kubeclarity"` | no |
328341
| <a name="input_kubecost_enabled"></a> [kubecost\_enabled](#input\_kubecost\_enabled) | Enable or disable the deployment of an Kubecost for Kubernetes. | `bool` | `false` | no |
329342
| <a name="input_kubecost_hostname"></a> [kubecost\_hostname](#input\_kubecost\_hostname) | Specify the hostname for the kubecsot. | `string` | `""` | no |
343+
| <a name="input_kubernetes_dashboard_enabled"></a> [kubernetes\_dashboard\_enabled](#input\_kubernetes\_dashboard\_enabled) | Determines whether k8s-dashboard is enabled or not | `bool` | `false` | no |
330344
| <a name="input_metrics_server_enabled"></a> [metrics\_server\_enabled](#input\_metrics\_server\_enabled) | Enable or disable the metrics server add-on for EKS cluster. | `bool` | `false` | no |
331345
| <a name="input_metrics_server_helm_version"></a> [metrics\_server\_helm\_version](#input\_metrics\_server\_helm\_version) | Version of the metrics server helm chart | `string` | `"3.11.0"` | no |
332346
| <a name="input_metrics_server_vpa_config"></a> [metrics\_server\_vpa\_config](#input\_metrics\_server\_vpa\_config) | Configuration to provide settings of vpa over metrics server | `any` | <pre>{<br> "maxCPU": "100m",<br> "maxMemory": "500Mi",<br> "metricsServerDeploymentName": "metrics-server",<br> "minCPU": "25m",<br> "minMemory": "150Mi"<br>}</pre> | no |
@@ -355,6 +369,8 @@ Before enabling the **Kubecost** addon for your Amazon EKS cluster, please make
355369
| <a name="output_environment"></a> [environment](#output\_environment) | Environment Name for the EKS cluster |
356370
| <a name="output_internal_nginx_ingress_controller_dns_hostname"></a> [internal\_nginx\_ingress\_controller\_dns\_hostname](#output\_internal\_nginx\_ingress\_controller\_dns\_hostname) | DNS hostname of the NGINX Ingress Controller that can be used to access it from within the cluster. |
357371
| <a name="output_istio_ingressgateway_dns_hostname"></a> [istio\_ingressgateway\_dns\_hostname](#output\_istio\_ingressgateway\_dns\_hostname) | DNS hostname of the Istio Ingress Gateway. |
372+
| <a name="output_k8s-dashboard-admin-token"></a> [k8s-dashboard-admin-token](#output\_k8s-dashboard-admin-token) | n/a |
373+
| <a name="output_k8s-dashboard-read-only-token"></a> [k8s-dashboard-read-only-token](#output\_k8s-dashboard-read-only-token) | n/a |
358374
| <a name="output_kubeclarity"></a> [kubeclarity](#output\_kubeclarity) | Kubeclarity endpoint and credentials |
359375
| <a name="output_kubecost"></a> [kubecost](#output\_kubecost) | Kubecost endpoint and credentials |
360376
| <a name="output_nginx_ingress_controller_dns_hostname"></a> [nginx\_ingress\_controller\_dns\_hostname](#output\_nginx\_ingress\_controller\_dns\_hostname) | DNS hostname of the NGINX Ingress Controller. |

‎examples/complete/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,8 @@ No inputs.
4949
| <a name="output_environment"></a> [environment](#output\_environment) | Environment Name for the EKS cluster |
5050
| <a name="output_internal_nginx_ingress_controller_dns_hostname"></a> [internal\_nginx\_ingress\_controller\_dns\_hostname](#output\_internal\_nginx\_ingress\_controller\_dns\_hostname) | DNS hostname of the NGINX Ingress Controller that can be used to access it from within the cluster. |
5151
| <a name="output_istio_ingressgateway_dns_hostname"></a> [istio\_ingressgateway\_dns\_hostname](#output\_istio\_ingressgateway\_dns\_hostname) | DNS hostname of the Istio Ingress Gateway |
52+
| <a name="output_k8s-dashboard-admin-token"></a> [k8s-dashboard-admin-token](#output\_k8s-dashboard-admin-token) | k8s-dashboard admin token |
53+
| <a name="output_k8s-dashboard-read-only-token"></a> [k8s-dashboard-read-only-token](#output\_k8s-dashboard-read-only-token) | k8s-dashboard read only token |
5254
| <a name="output_kubeclarity"></a> [kubeclarity](#output\_kubeclarity) | Kubeclarity endpoint and credentials |
5355
| <a name="output_kubecost"></a> [kubecost](#output\_kubecost) | Kubecost endpoint and credentials |
5456
| <a name="output_nginx_ingress_controller_dns_hostname"></a> [nginx\_ingress\_controller\_dns\_hostname](#output\_nginx\_ingress\_controller\_dns\_hostname) | DNS hostname of the NGINX Ingress Controller. |

‎examples/complete/main.tf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,8 @@ module "eks-addons" {
2121
kms_policy_arn = "arn:aws:iam::xxxxxxxxxxxx:policy/policy_name" ## eks module will create kms_policy_arn
2222
eks_cluster_name = "cluster_name"
2323
reloader_enabled = true
24+
kubernetes_dashboard_enabled = true
25+
k8s_dashboard_hostname = "dashboard.prod.in"
2426
karpenter_enabled = true
2527
private_subnet_ids = ["subnet-xxxxxxxxxxxx", "subnet-xxxxxxxxxxxx"]
2628
single_az_ebs_gp3_storage_class_enabled = true

‎examples/complete/output.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,3 +42,13 @@ output "istio_ingressgateway_dns_hostname" {
4242
value = module.eks-addons.istio_ingressgateway_dns_hostname
4343
description = "DNS hostname of the Istio Ingress Gateway"
4444
}
45+
46+
output "k8s-dashboard-admin-token" {
47+
description = "k8s-dashboard admin token"
48+
value = module.eks-addons.k8s-dashboard-admin-token
49+
}
50+
51+
output "k8s-dashboard-read-only-token" {
52+
description = "k8s-dashboard read only token"
53+
value = module.eks-addons.k8s-dashboard-read-only-token
54+
}

‎main.tf‎

Lines changed: 223 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -486,3 +486,226 @@ resource "helm_release" "falco" {
486486
})
487487
]
488488
}
489+
490+
resource "kubernetes_namespace" "k8s-dashboard" {
491+
count = var.kubernetes_dashboard_enabled ? 1 : 0
492+
metadata {
493+
name = "kubernetes-dashboard"
494+
}
495+
}
496+
497+
resource "helm_release" "kubernetes-dashboard" {
498+
count = var.kubernetes_dashboard_enabled ? 1 : 0
499+
depends_on = [kubernetes_namespace.k8s-dashboard]
500+
name = "kubernetes-dashboard"
501+
namespace = "kubernetes-dashboard"
502+
chart = "kubernetes-dashboard"
503+
repository = "https://kubernetes.github.io/dashboard/"
504+
timeout = 600
505+
version = "6.0.8"
506+
}
507+
508+
509+
resource "kubernetes_ingress_v1" "k8s-ingress" {
510+
count = var.kubernetes_dashboard_enabled ? 1 : 0
511+
depends_on = [helm_release.kubernetes-dashboard]
512+
wait_for_load_balancer = true
513+
metadata {
514+
name = "k8s-dashboard-ingress"
515+
namespace = "kubernetes-dashboard"
516+
annotations = {
517+
"cert-manager.io/cluster-issuer" : "letsencrypt-prod"
518+
"kubernetes.io/ingress.class" : "nginx"
519+
"kubernetes.io/tls-acme" : "false"
520+
"nginx.ingress.kubernetes.io/backend-protocol" : "HTTPS"
521+
"nginx.ingress.kubernetes.io/rewrite-target" : "/$2"
522+
"nginx.ingress.kubernetes.io/configuration-snippet" : <<-EOF
523+
if ($uri = "/dashboard") {
524+
rewrite ^(/dashboard)$ $1/ redirect;
525+
}
526+
EOF
527+
}
528+
}
529+
spec {
530+
rule {
531+
host = var.k8s_dashboard_hostname
532+
http {
533+
path {
534+
path = "/dashboard(/|$)(.*)"
535+
backend {
536+
service {
537+
name = "kubernetes-dashboard"
538+
port {
539+
number = 443
540+
}
541+
}
542+
}
543+
}
544+
}
545+
}
546+
tls {
547+
secret_name = "tls-k8s-dashboard"
548+
hosts = [var.k8s_dashboard_hostname]
549+
}
550+
}
551+
}
552+
553+
resource "kubernetes_service_account" "dashboard_admin_sa" {
554+
count = var.kubernetes_dashboard_enabled ? 1 : 0
555+
depends_on = [helm_release.kubernetes-dashboard]
556+
metadata {
557+
name = "kubernetes-dashboard-admin-sa"
558+
namespace = "kube-system"
559+
}
560+
}
561+
562+
resource "kubernetes_secret_v1" "admin-user" {
563+
count = var.kubernetes_dashboard_enabled ? 1 : 0
564+
metadata {
565+
name = "admin-user-token"
566+
namespace = "kube-system"
567+
annotations = {
568+
"kubernetes.io/service-account.name" = kubernetes_service_account.dashboard_admin_sa[0].metadata[0].name
569+
}
570+
}
571+
type = "kubernetes.io/service-account-token"
572+
depends_on = [
573+
kubernetes_service_account.dashboard_admin_sa,
574+
kubernetes_cluster_role_binding_v1.admin-user
575+
]
576+
}
577+
578+
resource "kubernetes_cluster_role_binding_v1" "admin-user" {
579+
count = var.kubernetes_dashboard_enabled ? 1 : 0
580+
metadata {
581+
name = "admin-user"
582+
}
583+
role_ref {
584+
api_group = "rbac.authorization.k8s.io"
585+
kind = "ClusterRole"
586+
name = "cluster-admin"
587+
}
588+
subject {
589+
kind = "ServiceAccount"
590+
name = kubernetes_service_account.dashboard_admin_sa[0].metadata[0].name
591+
namespace = "kube-system"
592+
}
593+
depends_on = [
594+
kubernetes_service_account.dashboard_admin_sa
595+
]
596+
}
597+
598+
resource "kubernetes_cluster_role" "eks_read_only_role" {
599+
count = var.kubernetes_dashboard_enabled ? 1 : 0
600+
601+
metadata {
602+
name = "dashboard-viewonly"
603+
}
604+
605+
rule {
606+
api_groups = [""]
607+
resources = [
608+
"configmaps",
609+
"endpoints",
610+
"persistentvolumeclaims",
611+
"pods",
612+
"replicationcontrollers",
613+
"replicationcontrollers/scale",
614+
"serviceaccounts",
615+
"services",
616+
"nodes",
617+
"persistentvolumes",
618+
"bindings",
619+
"events",
620+
"limitranges",
621+
"namespaces/status",
622+
"pods/log",
623+
"pods/status",
624+
"replicationcontrollers/status",
625+
"resourcequotas",
626+
"resourcequotas/status",
627+
"namespaces",
628+
"apps/daemonsets",
629+
"apps/deployments",
630+
"apps/deployments/scale",
631+
"apps/replicasets",
632+
"apps/replicasets/scale",
633+
"apps/statefulsets",
634+
"autoscaling/horizontalpodautoscalers",
635+
"batch/cronjobs",
636+
"batch/jobs",
637+
"extensions/daemonsets",
638+
"extensions/deployments",
639+
"extensions/deployments/scale",
640+
"extensions/ingresses",
641+
"extensions/networkpolicies",
642+
"extensions/replicasets",
643+
"extensions/replicasets/scale",
644+
"extensions/replicationcontrollers/scale",
645+
"policy/poddisruptionbudgets",
646+
"networking.k8s.io/networkpolicies",
647+
"storage.k8s.io/storageclasses",
648+
"storage.k8s.io/volumeattachments",
649+
"rbac.authorization.k8s.io/clusterrolebindings",
650+
"rbac.authorization.k8s.io/clusterroles",
651+
"rbac.authorization.k8s.io/roles",
652+
"rbac.authorization.k8s.io/rolebindings",
653+
]
654+
verbs = ["get", "list", "watch"]
655+
}
656+
}
657+
658+
# Add more rules as needed for read-only access to other Kubernetes resources
659+
660+
resource "kubernetes_service_account" "dashboard_read_only_sa" {
661+
count = var.kubernetes_dashboard_enabled ? 1 : 0
662+
663+
metadata {
664+
name = "dashboard-read-only-sa"
665+
namespace = "kube-system"
666+
}
667+
}
668+
669+
resource "kubernetes_cluster_role_binding" "eks_read_only_role_binding" {
670+
count = var.kubernetes_dashboard_enabled ? 1 : 0
671+
672+
metadata {
673+
name = "eks-read-only-role-binding"
674+
}
675+
676+
role_ref {
677+
api_group = "rbac.authorization.k8s.io"
678+
kind = "ClusterRole"
679+
name = kubernetes_cluster_role.eks_read_only_role[0].metadata[0].name
680+
}
681+
682+
subject {
683+
kind = "ServiceAccount"
684+
name = kubernetes_service_account.dashboard_read_only_sa[0].metadata[0].name
685+
namespace = "kube-system"
686+
}
687+
688+
depends_on = [
689+
kubernetes_cluster_role.eks_read_only_role,
690+
kubernetes_service_account.dashboard_read_only_sa
691+
]
692+
}
693+
694+
resource "kubernetes_secret_v1" "dashboard_read_only_sa_token" {
695+
count = var.kubernetes_dashboard_enabled ? 1 : 0
696+
697+
metadata {
698+
name = "dashboard-read-only-sa-token"
699+
namespace = "kube-system"
700+
annotations = {
701+
"kubernetes.io/service-account.name" = kubernetes_service_account.dashboard_read_only_sa[0].metadata[0].name
702+
}
703+
}
704+
705+
type = "kubernetes.io/service-account-token"
706+
707+
depends_on = [
708+
kubernetes_service_account.dashboard_read_only_sa,
709+
kubernetes_cluster_role_binding.eks_read_only_role_binding
710+
]
711+
}

‎modules/karpenter/karpenter.yaml‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
nodeSelector:
22
kubernetes.io/os: linux
3-
clusterName: ${eks_cluster_id}
4-
clusterEndpoint: ${eks_cluster_endpoint}
5-
aws:
6-
defaultInstanceProfile: ${node_iam_instance_profile}
3+
4+
settings:
5+
aws:
6+
defaultInstanceProfile: ${node_iam_instance_profile}
7+
clusterName: ${eks_cluster_id}
8+
clusterEndpoint: ${eks_cluster_endpoint}
79

810
controller:
911
resources:

‎modules/kubernetes-addons/karpenter/locals.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ locals {
1717
name = local.name
1818
chart = local.name
1919
repository = "oci://public.ecr.aws/karpenter"
20-
version = "v0.18.1"
20+
version = "v0.30.0"
2121
namespace = local.name
2222
values = [
2323
<<-EOT

‎outputs.tf‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,3 +55,11 @@ output "defectdojo" {
5555
url = var.defectdojo_hostname
5656
} : null
5757
}
58+
59+
output "k8s-dashboard-admin-token" {
60+
value = var.kubernetes_dashboard_enabled ? nonsensitive(kubernetes_secret_v1.admin-user[0].data.token) : null
61+
}
62+
63+
output "k8s-dashboard-read-only-token" {
64+
value = var.kubernetes_dashboard_enabled ? nonsensitive(kubernetes_secret_v1.dashboard_read_only_sa_token[0].data.token) : null
65+
}

‎variables.tf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -372,3 +372,16 @@ variable "coredns_hpa_enabled" {
372372
default = false
373373
type = bool
374374
}
375+
376+
variable "kubernetes_dashboard_enabled" {
377+
description = "Determines whether k8s-dashboard is enabled or not"
378+
default = false
379+
type = bool
380+
}
381+
382+
383+
variable "k8s_dashboard_hostname" {
384+
description = "Specify the hostname for the k8s dashboard. "
385+
default = ""
386+
type = string
387+
}

0 commit comments

Comments
 (0)