-
Notifications
You must be signed in to change notification settings - Fork 32
/
main.tf
79 lines (65 loc) · 3.44 KB
/
main.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
locals {
# The "count" value should not rely on data source outputs that are undetermined during
# the planning stage (at first apply).
# Therefore, the "operator_roles_count" local variable introduced with a hardcoded value.
# Validation within the "rhcs_rosa_operator_roles.operator_roles" data source ensures that this
# value matches the actual length returned from the data source.
operator_roles_count = 6
operator_role_prefix = (var.operator_role_prefix != null && var.operator_role_prefix != "") ? var.operator_role_prefix : var.account_role_prefix
path = coalesce(var.path, "/")
}
resource "aws_iam_role" "operator_role" {
count = local.operator_roles_count
name = data.rhcs_rosa_operator_roles.operator_roles.operator_iam_roles[count.index].role_name
path = local.path
permissions_boundary = var.permissions_boundary
assume_role_policy = data.aws_iam_policy_document.custom_trust_policy[count.index].json
tags = merge(var.tags, {
red-hat-managed = true
operator_namespace = data.rhcs_rosa_operator_roles.operator_roles.operator_iam_roles[count.index].operator_namespace
operator_name = data.rhcs_rosa_operator_roles.operator_roles.operator_iam_roles[count.index].operator_name
})
}
resource "aws_iam_role_policy_attachment" "operator_role_policy_attachment" {
count = local.operator_roles_count
role = aws_iam_role.operator_role[count.index].name
policy_arn = "arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:policy${local.path}${data.rhcs_rosa_operator_roles.operator_roles.operator_iam_roles[count.index].policy_name}"
}
data "aws_iam_policy_document" "custom_trust_policy" {
count = local.operator_roles_count
statement {
effect = "Allow"
actions = ["sts:AssumeRoleWithWebIdentity"]
principals {
type = "Federated"
identifiers = ["arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.current.account_id}:oidc-provider/${var.oidc_endpoint_url}"]
}
condition {
test = "ForAnyValue:StringEquals"
variable = "${var.oidc_endpoint_url}:sub"
values = data.rhcs_rosa_operator_roles.operator_roles.operator_iam_roles[count.index].service_accounts
}
}
}
data "rhcs_rosa_operator_roles" "operator_roles" {
operator_role_prefix = local.operator_role_prefix
account_role_prefix = var.account_role_prefix
lifecycle {
# The operator_iam_roles should contains 6 elements
postcondition {
condition = length(self.operator_iam_roles) == local.operator_roles_count
error_message = "The operator roles list returned has a length of ${length(self.operator_iam_roles)}, which differs from the expected value of ${local.operator_roles_count}. To solve this, you need to update \"local.operator_roles_count\" value to ${length(self.operator_iam_roles)} and apply again."
}
}
}
data "aws_caller_identity" "current" {}
# Wait 20 seconds after the operator role is created in order to avoid error in cluster create
resource "time_sleep" "role_resources_propagation" {
create_duration = "20s"
triggers = {
operator_role_prefix = local.operator_role_prefix
operator_role_arns = jsonencode([for value in aws_iam_role.operator_role : value.arn])
operator_policy_arns = jsonencode([for value in aws_iam_role_policy_attachment.operator_role_policy_attachment : value.policy_arn])
}
}
data "aws_partition" "current" {}