>`
module "irsa_external_dns" {
- count = var.irsa_external_dns != null && var.irsa_external_dns.enabled ? 1 : 0
source = "./../../../../modules/irsa"
use_cluster_odc_idp = local.is_eks_account_same
eks_info = module.eks.info
@@ -55,8 +60,12 @@ module "irsa_external_dns" {
}
}
+moved {
+ from = module.irsa_policies[0]
+ to = module.irsa_policies
+}
+
module "irsa_policies" {
- count = var.irsa_policies != null ? 1 : 0
source = "./../../../../modules/irsa"
use_cluster_odc_idp = true
eks_info = module.eks.info
@@ -73,6 +82,7 @@ provider "aws" {
ignore_tags {
keys = local.infra.ignore_tags
}
+ use_fips_endpoint = var.use_fips_endpoint
}
provider "aws" {
@@ -80,6 +90,7 @@ provider "aws" {
ignore_tags {
keys = local.infra.ignore_tags
}
+ use_fips_endpoint = var.use_fips_endpoint
}
terraform {
required_version = ">= 1.4.0"
diff --git a/examples/deploy/terraform/cluster/variables.tf b/examples/deploy/terraform/cluster/variables.tf
index 581fea2f..b6f08b2b 100644
--- a/examples/deploy/terraform/cluster/variables.tf
+++ b/examples/deploy/terraform/cluster/variables.tf
@@ -102,7 +102,18 @@ variable "irsa_external_dns" {
hosted_zone_name = optional(string, null)
namespace = optional(string, null)
serviceaccount_name = optional(string, null)
+ rm_role_policy = optional(object({
+ remove = optional(bool, false)
+ detach_from_role = optional(bool, false)
+ policy_name = optional(string, "")
+ }), {})
})
default = {}
}
+
+variable "use_fips_endpoint" {
+ description = "Use aws FIPS endpoints"
+ type = bool
+ default = false
+}
diff --git a/examples/deploy/terraform/infra.tfvars b/examples/deploy/terraform/infra.tfvars
index d15ac39e..f86ec0e9 100644
--- a/examples/deploy/terraform/infra.tfvars
+++ b/examples/deploy/terraform/infra.tfvars
@@ -69,3 +69,5 @@ tags = null
domino_cur = {
provision_cost_usage_report = false
}
+
+use_fips_endpoint = false
diff --git a/examples/deploy/terraform/infra/README.md b/examples/deploy/terraform/infra/README.md
index 2488bee2..320771d6 100644
--- a/examples/deploy/terraform/infra/README.md
+++ b/examples/deploy/terraform/infra/README.md
@@ -39,6 +39,7 @@ No resources.
| [ssh\_pvt\_key\_path](#input\_ssh\_pvt\_key\_path) | SSH private key filepath. | `string` | n/a | yes |
| [storage](#input\_storage) | storage = {
efs = {
access\_point\_path = Filesystem path for efs.
backup\_vault = {
create = Create backup vault for EFS toggle.
force\_destroy = Toggle to allow automatic destruction of all backups when destroying.
backup = {
schedule = Cron-style schedule for EFS backup vault (default: once a day at 12pm).
cold\_storage\_after = Move backup data to cold storage after this many days.
delete\_after = Delete backup data after this many days.
}
}
}
s3 = {
force\_destroy\_on\_deletion = Toogle to allow recursive deletion of all objects in the s3 buckets. if 'false' terraform will NOT be able to delete non-empty buckets.
}
ecr = {
force\_destroy\_on\_deletion = Toogle to allow recursive deletion of all objects in the ECR repositories. if 'false' terraform will NOT be able to delete non-empty repositories.
}
}
} | object({
efs = optional(object({
access_point_path = optional(string, "/domino")
backup_vault = optional(object({
create = optional(bool, true)
force_destroy = optional(bool, true)
backup = optional(object({
schedule = optional(string, "0 12 * * ? *")
cold_storage_after = optional(number, 35)
delete_after = optional(number, 125)
}), {})
}), {})
}), {})
s3 = optional(object({
force_destroy_on_deletion = optional(bool, true)
}), {})
ecr = optional(object({
force_destroy_on_deletion = optional(bool, true)
}), {})
}) | `{}` | no |
| [tags](#input\_tags) | Deployment tags. | `map(string)` | n/a | yes |
+| [use\_fips\_endpoint](#input\_use\_fips\_endpoint) | Use aws FIPS endpoints | `bool` | `false` | no |
## Outputs
diff --git a/examples/deploy/terraform/infra/main.tf b/examples/deploy/terraform/infra/main.tf
index a3529c40..d02a6c30 100644
--- a/examples/deploy/terraform/infra/main.tf
+++ b/examples/deploy/terraform/infra/main.tf
@@ -6,15 +6,16 @@ module "infra" {
bastion = var.bastion
default_node_groups = var.default_node_groups
- network = var.network
- eks = var.eks
- kms = var.kms
- storage = var.storage
- region = var.region
- ssh_pvt_key_path = var.ssh_pvt_key_path
- tags = var.tags
- ignore_tags = var.ignore_tags
- domino_cur = var.domino_cur
+ network = var.network
+ eks = var.eks
+ kms = var.kms
+ storage = var.storage
+ region = var.region
+ ssh_pvt_key_path = var.ssh_pvt_key_path
+ tags = var.tags
+ ignore_tags = var.ignore_tags
+ domino_cur = var.domino_cur
+ use_fips_endpoint = var.use_fips_endpoint
}
@@ -24,6 +25,7 @@ provider "aws" {
ignore_tags {
keys = var.ignore_tags
}
+ use_fips_endpoint = var.use_fips_endpoint
}
terraform {
diff --git a/examples/deploy/terraform/infra/variables.tf b/examples/deploy/terraform/infra/variables.tf
index f7aeab41..bbcd2a69 100644
--- a/examples/deploy/terraform/infra/variables.tf
+++ b/examples/deploy/terraform/infra/variables.tf
@@ -361,3 +361,9 @@ variable "domino_cur" {
default = {}
}
+
+variable "use_fips_endpoint" {
+ description = "Use aws FIPS endpoints"
+ type = bool
+ default = false
+}
diff --git a/examples/deploy/terraform/nodes.tfvars b/examples/deploy/terraform/nodes.tfvars
index 18a039c6..b7c89fc6 100644
--- a/examples/deploy/terraform/nodes.tfvars
+++ b/examples/deploy/terraform/nodes.tfvars
@@ -11,3 +11,5 @@ default_node_groups = {
availability_zone_ids = ["usw2-az1", "usw2-az2"]
}
}
+
+use_fips_endpoint = false
diff --git a/examples/deploy/terraform/nodes/README.md b/examples/deploy/terraform/nodes/README.md
index bed39f53..705c38e0 100644
--- a/examples/deploy/terraform/nodes/README.md
+++ b/examples/deploy/terraform/nodes/README.md
@@ -6,6 +6,7 @@
| Name | Version |
|------|---------|
| [terraform](#requirement\_terraform) | >= 1.4.0 |
+| [aws](#requirement\_aws) | ~> 5.0 |
## Providers
@@ -32,6 +33,7 @@
|------|-------------|------|---------|:--------:|
| [additional\_node\_groups](#input\_additional\_node\_groups) | Additional EKS managed node groups definition. | map(object({
ami = optional(string)
bootstrap_extra_args = optional(string)
instance_types = list(string)
spot = optional(bool)
min_per_az = number
max_per_az = number
max_unavailable_percentage = optional(number)
max_unavailable = optional(number)
desired_per_az = number
availability_zone_ids = list(string)
labels = map(string)
taints = optional(list(object({
key = string
value = optional(string)
effect = string
})))
tags = optional(map(string), {})
gpu = optional(bool)
volume = object({
size = string
type = string
})
})) | `null` | no |
| [default\_node\_groups](#input\_default\_node\_groups) | EKS managed node groups definition. | object(
{
compute = object(
{
ami = optional(string)
bootstrap_extra_args = optional(string)
instance_types = optional(list(string))
spot = optional(bool)
min_per_az = optional(number)
max_per_az = optional(number)
max_unavailable_percentage = optional(number)
max_unavailable = optional(number)
desired_per_az = optional(number)
availability_zone_ids = list(string)
labels = optional(map(string))
taints = optional(list(object({
key = string
value = optional(string)
effect = string
})))
tags = optional(map(string))
gpu = optional(bool)
volume = optional(object({
size = optional(number)
type = optional(string)
})
)
}),
platform = object(
{
ami = optional(string)
bootstrap_extra_args = optional(string)
instance_types = optional(list(string))
spot = optional(bool)
min_per_az = optional(number)
max_per_az = optional(number)
max_unavailable_percentage = optional(number)
max_unavailable = optional(number)
desired_per_az = optional(number)
availability_zone_ids = list(string)
labels = optional(map(string))
taints = optional(list(object({
key = string
value = optional(string)
effect = string
})))
tags = optional(map(string))
gpu = optional(bool)
volume = optional(object({
size = optional(number)
type = optional(string)
}))
}),
gpu = object(
{
ami = optional(string)
bootstrap_extra_args = optional(string)
instance_types = optional(list(string))
spot = optional(bool)
min_per_az = optional(number)
max_per_az = optional(number)
max_unavailable_percentage = optional(number)
max_unavailable = optional(number)
desired_per_az = optional(number)
availability_zone_ids = list(string)
labels = optional(map(string))
taints = optional(list(object({
key = string
value = optional(string)
effect = string
})))
tags = optional(map(string), {})
gpu = optional(bool, null)
volume = optional(object({
size = optional(number)
type = optional(string)
}))
})
})
| `null` | no |
+| [use\_fips\_endpoint](#input\_use\_fips\_endpoint) | Use aws FIPS endpoints | `bool` | `false` | no |
## Outputs
diff --git a/examples/deploy/terraform/nodes/main.tf b/examples/deploy/terraform/nodes/main.tf
index 3d4248ba..355a1aa3 100644
--- a/examples/deploy/terraform/nodes/main.tf
+++ b/examples/deploy/terraform/nodes/main.tf
@@ -34,8 +34,20 @@ module "nodes" {
kms_info = local.infra.kms
tags = local.infra.tags
ignore_tags = local.infra.ignore_tags
+ use_fips_endpoint = var.use_fips_endpoint
+}
+
+provider "aws" {
+ region = local.infra.region
+ use_fips_endpoint = var.use_fips_endpoint
}
terraform {
required_version = ">= 1.4.0"
+ required_providers {
+ aws = {
+ source = "hashicorp/aws"
+ version = "~> 5.0"
+ }
+ }
}
diff --git a/examples/deploy/terraform/nodes/variables.tf b/examples/deploy/terraform/nodes/variables.tf
index b573a771..a0fd310f 100644
--- a/examples/deploy/terraform/nodes/variables.tf
+++ b/examples/deploy/terraform/nodes/variables.tf
@@ -112,3 +112,10 @@ variable "additional_node_groups" {
}))
default = null
}
+
+
+variable "use_fips_endpoint" {
+ description = "Use aws FIPS endpoints"
+ type = bool
+ default = false
+}
diff --git a/examples/tfvars/fips-on.tfvars b/examples/tfvars/fips-on.tfvars
new file mode 100644
index 00000000..bd237345
--- /dev/null
+++ b/examples/tfvars/fips-on.tfvars
@@ -0,0 +1,29 @@
+deploy_id = "plantest003"
+region = "us-west-2"
+ssh_pvt_key_path = "domino.pem"
+
+default_node_groups = {
+ compute = {
+ availability_zone_ids = ["usw2-az1", "usw2-az2"]
+ }
+ gpu = {
+ availability_zone_ids = ["usw2-az1", "usw2-az2"]
+ }
+ platform = {
+ "availability_zone_ids" = ["usw2-az1", "usw2-az2"]
+ }
+
+ eks = {
+ public_access = {
+ enabled = true
+ cidrs = ["108.214.49.0/24"] # Replace this with the desired CIDR range
+
+ }
+ }
+}
+
+bastion = {
+ enabled = false
+}
+
+use_fips_endpoint = true
diff --git a/modules/eks/README.md b/modules/eks/README.md
index 5f56c9a6..3e10a3c3 100644
--- a/modules/eks/README.md
+++ b/modules/eks/README.md
@@ -81,6 +81,7 @@
| [region](#input\_region) | AWS region for the deployment | `string` | n/a | yes |
| [ssh\_key](#input\_ssh\_key) | path = SSH private key filepath.
key\_pair\_name = AWS key\_pair name. | object({
path = string
key_pair_name = string
}) | n/a | yes |
| [tags](#input\_tags) | Deployment tags. | `map(string)` | `{}` | no |
+| [use\_fips\_endpoint](#input\_use\_fips\_endpoint) | Use aws FIPS endpoints | `bool` | `false` | no |
## Outputs
diff --git a/modules/eks/cluster.tf b/modules/eks/cluster.tf
index aaf1d21a..d082b971 100644
--- a/modules/eks/cluster.tf
+++ b/modules/eks/cluster.tf
@@ -104,6 +104,9 @@ resource "null_resource" "kubeconfig" {
provisioner "local-exec" {
when = create
command = "aws eks update-kubeconfig --kubeconfig ${self.triggers.kubeconfig_file} --region ${self.triggers.region} --name ${self.triggers.cluster_name} --alias ${self.triggers.cluster_name} ${local.kubeconfig.extra_args}"
+ environment = {
+ AWS_USE_FIPS_ENDPOINT = tostring(var.use_fips_endpoint)
+ }
}
provisioner "local-exec" {
when = destroy
diff --git a/modules/eks/k8s.tf b/modules/eks/k8s.tf
index 6fac8234..fe856227 100644
--- a/modules/eks/k8s.tf
+++ b/modules/eks/k8s.tf
@@ -6,10 +6,11 @@ locals {
module "k8s_setup" {
count = local.run_setup
- source = "./submodules/k8s"
- ssh_key = var.ssh_key
- bastion_info = var.bastion_info
- eks_info = local.eks_info
+ source = "./submodules/k8s"
+ ssh_key = var.ssh_key
+ bastion_info = var.bastion_info
+ eks_info = local.eks_info
+ use_fips_endpoint = var.use_fips_endpoint
depends_on = [null_resource.kubeconfig]
}
diff --git a/modules/eks/submodules/k8s/README.md b/modules/eks/submodules/k8s/README.md
index 0830b8b9..8d9c6263 100644
--- a/modules/eks/submodules/k8s/README.md
+++ b/modules/eks/submodules/k8s/README.md
@@ -36,6 +36,7 @@ No modules.
| [calico\_version](#input\_calico\_version) | Calico operator version. | `string` | `"v3.25.0"` | no |
| [eks\_info](#input\_eks\_info) | cluster = {
version = K8s version.
arn = EKS Cluster arn.
security\_group\_id = EKS Cluster security group id.
endpoint = EKS Cluster API endpoint.
roles = Default IAM Roles associated with the EKS cluster. {
name = string
arn = string
}
custom\_roles = Custom IAM Roles associated with the EKS cluster. {
rolearn = string
username = string
groups = list(string)
}
oidc = {
arn = OIDC provider ARN.
url = OIDC provider url.
}
}
nodes = {
security\_group\_id = EKS Nodes security group id.
roles = IAM Roles associated with the EKS Nodes.{
name = string
arn = string
}
}
kubeconfig = Kubeconfig details.{
path = string
extra\_args = string
} | object({
cluster = object({
version = string
arn = string
security_group_id = string
endpoint = string
roles = list(object({
name = string
arn = string
}))
custom_roles = list(object({
rolearn = string
username = string
groups = list(string)
}))
oidc = object({
arn = string
url = string
})
})
nodes = object({
nodes_master = bool
security_group_id = string
roles = list(object({
name = string
arn = string
}))
})
kubeconfig = object({
path = string
extra_args = string
})
}) | n/a | yes |
| [ssh\_key](#input\_ssh\_key) | path = SSH private key filepath.
key\_pair\_name = AWS key\_pair name. | object({
path = string
key_pair_name = string
}) | n/a | yes |
+| [use\_fips\_endpoint](#input\_use\_fips\_endpoint) | Use aws FIPS endpoints | `bool` | `false` | no |
## Outputs
diff --git a/modules/eks/submodules/k8s/main.tf b/modules/eks/submodules/k8s/main.tf
index 591dbdff..b4370e63 100644
--- a/modules/eks/submodules/k8s/main.tf
+++ b/modules/eks/submodules/k8s/main.tf
@@ -32,6 +32,7 @@ locals {
filename = local.k8s_pre_setup_sh_file
content = templatefile("${local.templates_dir}/${local.k8s_pre_setup_sh_template}", {
k8s_functions_sh_filename = local.k8s_functions_sh_filename
+ use_fips_endpoint = tostring(var.use_fips_endpoint)
})
}
diff --git a/modules/eks/submodules/k8s/templates/k8s-pre-setup.sh.tftpl b/modules/eks/submodules/k8s/templates/k8s-pre-setup.sh.tftpl
index 90510656..d8d2d67f 100644
--- a/modules/eks/submodules/k8s/templates/k8s-pre-setup.sh.tftpl
+++ b/modules/eks/submodules/k8s/templates/k8s-pre-setup.sh.tftpl
@@ -2,6 +2,7 @@
set -euo pipefail
source ${k8s_functions_sh_filename}
+export AWS_USE_FIPS_ENDPOINT=${use_fips_endpoint}
open_ssh_tunnel() {
local max_retries=5
diff --git a/modules/eks/submodules/k8s/variables.tf b/modules/eks/submodules/k8s/variables.tf
index bb9d8faf..c5f57901 100644
--- a/modules/eks/submodules/k8s/variables.tf
+++ b/modules/eks/submodules/k8s/variables.tf
@@ -97,3 +97,9 @@ variable "eks_info" {
})
})
}
+
+variable "use_fips_endpoint" {
+ description = "Use aws FIPS endpoints"
+ type = bool
+ default = false
+}
diff --git a/modules/eks/variables.tf b/modules/eks/variables.tf
index f6fffd43..4f812c65 100644
--- a/modules/eks/variables.tf
+++ b/modules/eks/variables.tf
@@ -251,3 +251,9 @@ variable "privatelink" {
default = {}
}
+
+variable "use_fips_endpoint" {
+ description = "Use aws FIPS endpoints"
+ type = bool
+ default = false
+}
diff --git a/modules/eks/versions.tf b/modules/eks/versions.tf
index be3532f5..f0d42ec2 100644
--- a/modules/eks/versions.tf
+++ b/modules/eks/versions.tf
@@ -25,6 +25,7 @@ provider "aws" {
ignore_tags {
keys = var.ignore_tags
}
+ use_fips_endpoint = var.use_fips_endpoint
}
provider "aws" {
@@ -39,4 +40,6 @@ provider "aws" {
assume_role {
role_arn = var.create_eks_role_arn
}
+
+ use_fips_endpoint = var.use_fips_endpoint
}
diff --git a/modules/flyte/README.md b/modules/flyte/README.md
index 4b18ff49..cc1fbe25 100644
--- a/modules/flyte/README.md
+++ b/modules/flyte/README.md
@@ -53,6 +53,7 @@ No modules.
| [platform\_namespace](#input\_platform\_namespace) | Name of Domino platform namespace for this deploy | `string` | n/a | yes |
| [region](#input\_region) | AWS region for the deployment | `string` | n/a | yes |
| [serviceaccount\_names](#input\_serviceaccount\_names) | Service account names for Flyte | object({
datacatalog = optional(string, "datacatalog")
flyteadmin = optional(string, "flyteadmin")
flytepropeller = optional(string, "flytepropeller")
}) | `{}` | no |
+| [use\_fips\_endpoint](#input\_use\_fips\_endpoint) | Use aws FIPS endpoints | `bool` | `false` | no |
## Outputs
diff --git a/modules/flyte/variables.tf b/modules/flyte/variables.tf
index 9536a831..db0e4786 100644
--- a/modules/flyte/variables.tf
+++ b/modules/flyte/variables.tf
@@ -81,3 +81,10 @@ variable "region" {
error_message = "The provided region must follow the format of AWS region names, e.g., us-west-2, us-gov-west-1."
}
}
+
+
+variable "use_fips_endpoint" {
+ description = "Use aws FIPS endpoints"
+ type = bool
+ default = false
+}
diff --git a/modules/flyte/versions.tf b/modules/flyte/versions.tf
index 6fe2b841..73822a47 100644
--- a/modules/flyte/versions.tf
+++ b/modules/flyte/versions.tf
@@ -11,3 +11,8 @@ terraform {
}
}
}
+
+provider "aws" {
+ region = var.region
+ use_fips_endpoint = var.use_fips_endpoint
+}
diff --git a/modules/iam-bootstrap/README.md b/modules/iam-bootstrap/README.md
index edf3ea13..ce0d12c6 100644
--- a/modules/iam-bootstrap/README.md
+++ b/modules/iam-bootstrap/README.md
@@ -37,6 +37,7 @@ No modules.
| [max\_session\_duration](#input\_max\_session\_duration) | Maximum session duration for role in seconds | `number` | `43200` | no |
| [region](#input\_region) | AWS region for the deployment | `string` | n/a | yes |
| [template\_config](#input\_template\_config) | Variables to use for any templating in the IAM policies. AWS account ID (as 'account\_id'), deploy\_id, region and partition are automatically included. | `map(any)` | `{}` | no |
+| [use\_fips\_endpoint](#input\_use\_fips\_endpoint) | Use aws FIPS endpoints | `bool` | `false` | no |
## Outputs
diff --git a/modules/iam-bootstrap/variables.tf b/modules/iam-bootstrap/variables.tf
index a27b64d7..63850841 100644
--- a/modules/iam-bootstrap/variables.tf
+++ b/modules/iam-bootstrap/variables.tf
@@ -41,3 +41,9 @@ variable "ignore_tags" {
description = "Tag keys to be ignored by the aws provider."
default = []
}
+
+variable "use_fips_endpoint" {
+ description = "Use aws FIPS endpoints"
+ type = bool
+ default = false
+}
diff --git a/modules/iam-bootstrap/versions.tf b/modules/iam-bootstrap/versions.tf
index 858de3dd..eed6e1af 100644
--- a/modules/iam-bootstrap/versions.tf
+++ b/modules/iam-bootstrap/versions.tf
@@ -13,4 +13,6 @@ provider "aws" {
ignore_tags {
keys = var.ignore_tags
}
+
+ use_fips_endpoint = var.use_fips_endpoint
}
diff --git a/modules/infra/README.md b/modules/infra/README.md
index a5ddc53d..26eda1b1 100644
--- a/modules/infra/README.md
+++ b/modules/infra/README.md
@@ -65,6 +65,7 @@
| [ssh\_pvt\_key\_path](#input\_ssh\_pvt\_key\_path) | SSH private key filepath. | `string` | n/a | yes |
| [storage](#input\_storage) | storage = {
efs = {
access\_point\_path = Filesystem path for efs.
backup\_vault = {
create = Create backup vault for EFS toggle.
force\_destroy = Toggle to allow automatic destruction of all backups when destroying.
backup = {
schedule = Cron-style schedule for EFS backup vault (default: once a day at 12pm).
cold\_storage\_after = Move backup data to cold storage after this many days.
delete\_after = Delete backup data after this many days.
}
}
}
s3 = {
force\_destroy\_on\_deletion = Toogle to allow recursive deletion of all objects in the s3 buckets. if 'false' terraform will NOT be able to delete non-empty buckets.
}
ecr = {
force\_destroy\_on\_deletion = Toogle to allow recursive deletion of all objects in the ECR repositories. if 'false' terraform will NOT be able to delete non-empty repositories.
}
enable\_remote\_backup = Enable tagging required for cross-account backups
costs\_enabled = Determines whether to provision domino cost related infrastructures, ie, long term storage
}
} | object({
efs = optional(object({
access_point_path = optional(string, "/domino")
backup_vault = optional(object({
create = optional(bool, true)
force_destroy = optional(bool, true)
backup = optional(object({
schedule = optional(string, "0 12 * * ? *")
cold_storage_after = optional(number, 35)
delete_after = optional(number, 125)
}), {})
}), {})
}), {})
s3 = optional(object({
force_destroy_on_deletion = optional(bool, true)
}), {})
ecr = optional(object({
force_destroy_on_deletion = optional(bool, true)
}), {}),
enable_remote_backup = optional(bool, false)
costs_enabled = optional(bool, true)
}) | `{}` | no |
| [tags](#input\_tags) | Deployment tags. | `map(string)` | `{}` | no |
+| [use\_fips\_endpoint](#input\_use\_fips\_endpoint) | Use aws FIPS endpoints | `bool` | `false` | no |
## Outputs
diff --git a/modules/infra/main.tf b/modules/infra/main.tf
index ff3f1006..f0251c1b 100644
--- a/modules/infra/main.tf
+++ b/modules/infra/main.tf
@@ -26,11 +26,13 @@ module "cost_usage_report" {
}
module "storage" {
- source = "./submodules/storage"
- deploy_id = var.deploy_id
- network_info = module.network.info
- kms_info = local.kms_info
- storage = var.storage
+ source = "./submodules/storage"
+ deploy_id = var.deploy_id
+ network_info = module.network.info
+ kms_info = local.kms_info
+ storage = var.storage
+ use_fips_endpoint = var.use_fips_endpoint
+
}
data "aws_ec2_instance_type" "all" {
@@ -99,14 +101,3 @@ locals {
node_iam_policies_storage = [module.storage.info.s3.iam_policy_arn, module.storage.info.ecr.iam_policy_arn]
node_iam_policies = local.cost_usage_report_info != null ? concat(local.node_iam_policies_storage, [local.cost_usage_report_info.cur_iam_policy_arn]) : local.node_iam_policies_storage
}
-
-provider "aws" {
- region = strcontains(var.region, "us-gov") ? "us-gov-east-1" : "us-east-1"
- alias = "us-east-1"
- default_tags {
- tags = var.tags
- }
- ignore_tags {
- keys = var.ignore_tags
- }
-}
diff --git a/modules/infra/submodules/bastion/README.md b/modules/infra/submodules/bastion/README.md
index 1a259216..031cf890 100644
--- a/modules/infra/submodules/bastion/README.md
+++ b/modules/infra/submodules/bastion/README.md
@@ -55,6 +55,7 @@ No modules.
| [network\_info](#input\_network\_info) | id = VPC ID.
subnets = {
public = List of public Subnets.
[{
name = Subnet name.
subnet\_id = Subnet ud
az = Subnet availability\_zone
az\_id = Subnet availability\_zone\_id
}]
private = List of private Subnets.
[{
name = Subnet name.
subnet\_id = Subnet ud
az = Subnet availability\_zone
az\_id = Subnet availability\_zone\_id
}]
pod = List of pod Subnets.
[{
name = Subnet name.
subnet\_id = Subnet ud
az = Subnet availability\_zone
az\_id = Subnet availability\_zone\_id
}]
} | object({
vpc_id = string
subnets = object({
public = list(object({
name = string
subnet_id = string
az = string
az_id = string
}))
private = optional(list(object({
name = string
subnet_id = string
az = string
az_id = string
})), [])
pod = optional(list(object({
name = string
subnet_id = string
az = string
az_id = string
})), [])
})
}) | n/a | yes |
| [region](#input\_region) | AWS region for the deployment | `string` | n/a | yes |
| [ssh\_key](#input\_ssh\_key) | path = SSH private key filepath.
key\_pair\_name = AWS key\_pair name. | object({
path = string
key_pair_name = string
}) | n/a | yes |
+| [use\_fips\_endpoint](#input\_use\_fips\_endpoint) | Use aws FIPS endpoints | `bool` | `false` | no |
## Outputs
diff --git a/modules/infra/submodules/bastion/main.tf b/modules/infra/submodules/bastion/main.tf
index 318fa206..95a5435d 100644
--- a/modules/infra/submodules/bastion/main.tf
+++ b/modules/infra/submodules/bastion/main.tf
@@ -123,6 +123,9 @@ resource "terraform_data" "check_bastion_instance_profile" {
exit 1
EOF
interpreter = ["bash", "-c"]
+ environment = {
+ AWS_USE_FIPS_ENDPOINT = tostring(var.use_fips_endpoint)
+ }
}
depends_on = [aws_iam_instance_profile.bastion]
}
diff --git a/modules/infra/submodules/bastion/variables.tf b/modules/infra/submodules/bastion/variables.tf
index 8abf18e9..f8093075 100644
--- a/modules/infra/submodules/bastion/variables.tf
+++ b/modules/infra/submodules/bastion/variables.tf
@@ -113,3 +113,9 @@ variable "ssh_key" {
key_pair_name = string
})
}
+
+variable "use_fips_endpoint" {
+ description = "Use aws FIPS endpoints"
+ type = bool
+ default = false
+}
diff --git a/modules/infra/submodules/storage/README.md b/modules/infra/submodules/storage/README.md
index ee77aa42..4b763982 100644
--- a/modules/infra/submodules/storage/README.md
+++ b/modules/infra/submodules/storage/README.md
@@ -70,6 +70,7 @@ No modules.
| [kms\_info](#input\_kms\_info) | key\_id = KMS key id.
key\_arn = KMS key arn.
enabled = KMS key is enabled | object({
key_id = string
key_arn = string
enabled = bool
}) | n/a | yes |
| [network\_info](#input\_network\_info) | id = VPC ID.
subnets = {
public = List of public Subnets.
[{
name = Subnet name.
subnet\_id = Subnet ud
az = Subnet availability\_zone
az\_id = Subnet availability\_zone\_id
}]
private = List of private Subnets.
[{
name = Subnet name.
subnet\_id = Subnet ud
az = Subnet availability\_zone
az\_id = Subnet availability\_zone\_id
}]
pod = List of pod Subnets.
[{
name = Subnet name.
subnet\_id = Subnet ud
az = Subnet availability\_zone
az\_id = Subnet availability\_zone\_id
}]
} | object({
vpc_id = string
subnets = object({
public = optional(list(object({
name = string
subnet_id = string
az = string
az_id = string
})), [])
private = list(object({
name = string
subnet_id = string
az = string
az_id = string
}))
pod = optional(list(object({
name = string
subnet_id = string
az = string
az_id = string
})), [])
})
}) | n/a | yes |
| [storage](#input\_storage) | storage = {
efs = {
access\_point\_path = Filesystem path for efs.
backup\_vault = {
create = Create backup vault for EFS toggle.
force\_destroy = Toggle to allow automatic destruction of all backups when destroying.
backup = {
schedule = Cron-style schedule for EFS backup vault (default: once a day at 12pm).
cold\_storage\_after = Move backup data to cold storage after this many days.
delete\_after = Delete backup data after this many days.
}
}
}
s3 = {
force\_destroy\_on\_deletion = Toogle to allow recursive deletion of all objects in the s3 buckets. if 'false' terraform will NOT be able to delete non-empty buckets.
}
ecr = {
force\_destroy\_on\_deletion = Toogle to allow recursive deletion of all objects in the ECR repositories. if 'false' terraform will NOT be able to delete non-empty repositories.
}
enable\_remote\_backup = Enable tagging required for cross-account backups
costs\_enabled = Determines whether to provision domino cost related infrastructures, ie, long term storage
}
} | object({
efs = optional(object({
access_point_path = optional(string)
backup_vault = optional(object({
create = optional(bool)
force_destroy = optional(bool)
backup = optional(object({
schedule = optional(string)
cold_storage_after = optional(number)
delete_after = optional(number)
}))
}))
}))
s3 = optional(object({
force_destroy_on_deletion = optional(bool)
}))
ecr = optional(object({
force_destroy_on_deletion = optional(bool)
}))
enable_remote_backup = optional(bool)
costs_enabled = optional(bool)
}) | n/a | yes |
+| [use\_fips\_endpoint](#input\_use\_fips\_endpoint) | Use aws FIPS endpoints | `bool` | `false` | no |
## Outputs
diff --git a/modules/infra/submodules/storage/efs_backup_vault.tf b/modules/infra/submodules/storage/efs_backup_vault.tf
index 3106d115..7699c97c 100644
--- a/modules/infra/submodules/storage/efs_backup_vault.tf
+++ b/modules/infra/submodules/storage/efs_backup_vault.tf
@@ -87,8 +87,12 @@ resource "terraform_data" "check_backup_role" {
exit 1
EOF
interpreter = ["bash", "-c"]
+ environment = {
+ AWS_USE_FIPS_ENDPOINT = tostring(var.use_fips_endpoint)
+ }
}
+
triggers_replace = [
aws_iam_role.efs_backup_role[0].id,
]
diff --git a/modules/infra/submodules/storage/main.tf b/modules/infra/submodules/storage/main.tf
index bb378f33..f1bd50fd 100644
--- a/modules/infra/submodules/storage/main.tf
+++ b/modules/infra/submodules/storage/main.tf
@@ -7,40 +7,58 @@ locals {
s3_buckets = { for k, v in {
backups = {
- bucket_name = aws_s3_bucket.backups.bucket
- id = aws_s3_bucket.backups.id
- policy_json = data.aws_iam_policy_document.backups.json
- arn = aws_s3_bucket.backups.arn
+ bucket_name = aws_s3_bucket.backups.bucket
+ id = aws_s3_bucket.backups.id
+ policy_json = data.aws_iam_policy_document.backups.json
+ arn = aws_s3_bucket.backups.arn
+ domain_name = aws_s3_bucket.backups.bucket_domain_name
+ regional_domain_name = aws_s3_bucket.backups.bucket_regional_domain_name
+ fips_regional_domain_name = replace(aws_s3_bucket.backups.bucket_regional_domain_name, ".s3.", ".s3-fips.")
}
blobs = {
- bucket_name = aws_s3_bucket.blobs.bucket
- id = aws_s3_bucket.blobs.id
- policy_json = data.aws_iam_policy_document.blobs.json
- arn = aws_s3_bucket.blobs.arn
+ bucket_name = aws_s3_bucket.blobs.bucket
+ id = aws_s3_bucket.blobs.id
+ policy_json = data.aws_iam_policy_document.blobs.json
+ arn = aws_s3_bucket.blobs.arn
+ domain_name = aws_s3_bucket.blobs.bucket_domain_name
+ regional_domain_name = aws_s3_bucket.blobs.bucket_regional_domain_name
+ fips_regional_domain_name = replace(aws_s3_bucket.blobs.bucket_regional_domain_name, ".s3.", ".s3-fips.")
}
costs = var.storage.costs_enabled ? {
- bucket_name = aws_s3_bucket.costs[0].bucket
- id = aws_s3_bucket.costs[0].id
- policy_json = data.aws_iam_policy_document.costs[0].json
- arn = aws_s3_bucket.costs[0].arn
+ bucket_name = aws_s3_bucket.costs[0].bucket
+ id = aws_s3_bucket.costs[0].id
+ policy_json = data.aws_iam_policy_document.costs[0].json
+ arn = aws_s3_bucket.costs[0].arn
+ domain_name = aws_s3_bucket.costs[0].bucket_domain_name
+ regional_domain_name = aws_s3_bucket.costs[0].bucket_regional_domain_name
+ fips_regional_domain_name = replace(aws_s3_bucket.costs[0].bucket_regional_domain_name, ".s3.", ".s3-fips.")
} : {}
logs = {
- bucket_name = aws_s3_bucket.logs.bucket
- id = aws_s3_bucket.logs.id
- policy_json = data.aws_iam_policy_document.logs.json
- arn = aws_s3_bucket.logs.arn
+ bucket_name = aws_s3_bucket.logs.bucket
+ id = aws_s3_bucket.logs.id
+ policy_json = data.aws_iam_policy_document.logs.json
+ arn = aws_s3_bucket.logs.arn
+ domain_name = aws_s3_bucket.logs.bucket_domain_name
+ regional_domain_name = aws_s3_bucket.logs.bucket_regional_domain_name
+ fips_regional_domain_name = replace(aws_s3_bucket.logs.bucket_regional_domain_name, ".s3.", ".s3-fips.")
}
monitoring = {
- bucket_name = aws_s3_bucket.monitoring.bucket
- id = aws_s3_bucket.monitoring.id
- policy_json = data.aws_iam_policy_document.monitoring.json
- arn = aws_s3_bucket.monitoring.arn
+ bucket_name = aws_s3_bucket.monitoring.bucket
+ id = aws_s3_bucket.monitoring.id
+ policy_json = data.aws_iam_policy_document.monitoring.json
+ arn = aws_s3_bucket.monitoring.arn
+ domain_name = aws_s3_bucket.monitoring.bucket_domain_name
+ regional_domain_name = aws_s3_bucket.monitoring.bucket_regional_domain_name
+ fips_regional_domain_name = replace(aws_s3_bucket.monitoring.bucket_regional_domain_name, ".s3.", ".s3-fips.")
}
registry = {
- bucket_name = aws_s3_bucket.registry.bucket
- id = aws_s3_bucket.registry.id
- policy_json = data.aws_iam_policy_document.registry.json
- arn = aws_s3_bucket.registry.arn
+ bucket_name = aws_s3_bucket.registry.bucket
+ id = aws_s3_bucket.registry.id
+ policy_json = data.aws_iam_policy_document.registry.json
+ arn = aws_s3_bucket.registry.arn
+ domain_name = aws_s3_bucket.registry.bucket_domain_name
+ regional_domain_name = aws_s3_bucket.registry.bucket_regional_domain_name
+ fips_regional_domain_name = replace(aws_s3_bucket.registry.bucket_regional_domain_name, ".s3.", ".s3-fips.")
}
} : k => v if contains(keys(v), "bucket_name") }
diff --git a/modules/infra/submodules/storage/outputs.tf b/modules/infra/submodules/storage/outputs.tf
index 3ebd597c..657f2705 100644
--- a/modules/infra/submodules/storage/outputs.tf
+++ b/modules/infra/submodules/storage/outputs.tf
@@ -22,9 +22,13 @@ output "info" {
}
s3 = {
buckets = { for k, b in local.s3_buckets : k => {
- "bucket_name" = b.bucket_name,
- "arn" = b.arn
- } }
+ "bucket_name" = b.bucket_name,
+ "arn" = b.arn
+ "domain_name" = b.domain_name
+ "regional_domain_name" = b.regional_domain_name
+ "fips_regional_domain_name" = b.fips_regional_domain_name
+ }
+ }
iam_policy_arn = aws_iam_policy.s3.arn
}
ecr = {
diff --git a/modules/infra/submodules/storage/s3.tf b/modules/infra/submodules/storage/s3.tf
index 4d1a5e2d..a9b9688a 100644
--- a/modules/infra/submodules/storage/s3.tf
+++ b/modules/infra/submodules/storage/s3.tf
@@ -213,7 +213,6 @@ resource "aws_s3_bucket" "monitoring" {
bucket = "${var.deploy_id}-monitoring"
force_destroy = var.storage.s3.force_destroy_on_deletion
object_lock_enabled = false
-
}
data "aws_iam_policy_document" "monitoring" {
@@ -354,6 +353,9 @@ resource "terraform_data" "set_monitoring_private_acl" {
exit 1
EOF
interpreter = ["bash", "-c"]
+ environment = {
+ AWS_USE_FIPS_ENDPOINT = tostring(var.use_fips_endpoint)
+ }
}
depends_on = [aws_s3_bucket.monitoring]
diff --git a/modules/infra/submodules/storage/variables.tf b/modules/infra/submodules/storage/variables.tf
index 9a535c86..f02bb624 100644
--- a/modules/infra/submodules/storage/variables.tf
+++ b/modules/infra/submodules/storage/variables.tf
@@ -122,3 +122,9 @@ variable "network_info" {
})
})
}
+
+variable "use_fips_endpoint" {
+ description = "Use aws FIPS endpoints"
+ type = bool
+ default = false
+}
diff --git a/modules/infra/variables.tf b/modules/infra/variables.tf
index bfd3a556..bc5d6b70 100644
--- a/modules/infra/variables.tf
+++ b/modules/infra/variables.tf
@@ -415,3 +415,9 @@ variable "domino_cur" {
default = {}
}
+
+variable "use_fips_endpoint" {
+ description = "Use aws FIPS endpoints"
+ type = bool
+ default = false
+}
diff --git a/modules/infra/versions.tf b/modules/infra/versions.tf
index 272758bb..cf4bb4c4 100644
--- a/modules/infra/versions.tf
+++ b/modules/infra/versions.tf
@@ -28,4 +28,19 @@ provider "aws" {
ignore_tags {
keys = var.ignore_tags
}
+
+ use_fips_endpoint = var.use_fips_endpoint
+}
+
+provider "aws" {
+ region = strcontains(var.region, "us-gov") ? "us-gov-east-1" : "us-east-1"
+ alias = "us-east-1"
+ default_tags {
+ tags = var.tags
+ }
+ ignore_tags {
+ keys = var.ignore_tags
+ }
+
+ use_fips_endpoint = var.use_fips_endpoint
}
diff --git a/modules/irsa/README.md b/modules/irsa/README.md
index 7be5b183..5b592748 100644
--- a/modules/irsa/README.md
+++ b/modules/irsa/README.md
@@ -50,6 +50,7 @@ No modules.
| [eks\_info](#input\_eks\_info) | cluster = {
specs {
name = Cluster name.
account\_id = AWS account id where the cluster resides.
}
oidc = {
arn = OIDC provider ARN.
url = OIDC provider url.
cert = {
thumbprint\_list = OIDC cert thumbprints.
url = OIDC cert URL.
}
} | object({
nodes = object({
roles = list(object({
arn = string
name = string
}))
})
cluster = object({
specs = object({
name = string
account_id = string
})
oidc = object({
arn = string
url = string
cert = object({
thumbprint_list = list(string)
url = string
})
})
})
}) | n/a | yes |
| [external\_dns](#input\_external\_dns) | Config to enable irsa for external-dns | object({
enabled = optional(bool, false)
hosted_zone_name = optional(string, null)
hosted_zone_private = optional(string, false)
namespace = optional(string, "domino-platform")
serviceaccount_name = optional(string, "external-dns")
rm_role_policy = optional(object({
remove = optional(bool, false)
detach_from_role = optional(bool, false)
policy_name = optional(string, "")
}), {})
}) | `{}` | no |
| [use\_cluster\_odc\_idp](#input\_use\_cluster\_odc\_idp) | Toogle to uset the oidc idp connector in the trust policy.
Set to `true` if the cluster and the hosted zone are in different aws accounts.
`rm_role_policy` used to facilitiate the cleanup if a node attached policy was used previously. | `bool` | `true` | no |
+| [use\_fips\_endpoint](#input\_use\_fips\_endpoint) | Use aws FIPS endpoints | `bool` | `false` | no |
## Outputs
diff --git a/modules/irsa/external-dns.tf b/modules/irsa/external-dns.tf
index 916c005d..3aa05b42 100644
--- a/modules/irsa/external-dns.tf
+++ b/modules/irsa/external-dns.tf
@@ -70,7 +70,7 @@ resource "terraform_data" "delete_route53_policy" {
var.external_dns.rm_role_policy.policy_name
]
provisioner "local-exec" {
- command = <<-EOF
+ command = <<-EOF
set -x -o pipefail
policy_arn="arn:${data.aws_partition.current.partition}:iam::${data.aws_caller_identity.aws_account.account_id}:policy/${var.external_dns.rm_role_policy.policy_name}"
@@ -92,6 +92,9 @@ resource "terraform_data" "delete_route53_policy" {
fi
EOF
+ environment = {
+ AWS_USE_FIPS_ENDPOINT = tostring(var.use_fips_endpoint)
+ }
interpreter = ["bash", "-c"]
}
depends_on = [aws_iam_role_policy_attachment.external_dns]
diff --git a/modules/irsa/variables.tf b/modules/irsa/variables.tf
index a3e07a5e..0b48958e 100644
--- a/modules/irsa/variables.tf
+++ b/modules/irsa/variables.tf
@@ -65,6 +65,10 @@ variable "external_dns" {
})
default = {}
+ validation {
+ condition = var.external_dns.enabled ? (var.external_dns.hosted_zone_name != null && length(var.external_dns.hosted_zone_name) > 0) : true
+ error_message = "Must provide a non-empty `external_dns.hosted_zone_name` if `external_dns.enabled` == true"
+ }
}
variable "additional_irsa_configs" {
@@ -83,3 +87,9 @@ variable "additional_irsa_configs" {
error_message = "Invalid json found in policy"
}
}
+
+variable "use_fips_endpoint" {
+ description = "Use aws FIPS endpoints"
+ type = bool
+ default = false
+}
diff --git a/modules/nodes/README.md b/modules/nodes/README.md
index 64f68105..2ef6539a 100644
--- a/modules/nodes/README.md
+++ b/modules/nodes/README.md
@@ -52,6 +52,7 @@ No modules.
| [region](#input\_region) | AWS region for the deployment | `string` | n/a | yes |
| [ssh\_key](#input\_ssh\_key) | path = SSH private key filepath.
key\_pair\_name = AWS key\_pair name. | object({
path = string
key_pair_name = string
}) | n/a | yes |
| [tags](#input\_tags) | Deployment tags. | `map(string)` | `{}` | no |
+| [use\_fips\_endpoint](#input\_use\_fips\_endpoint) | Use aws FIPS endpoints | `bool` | `false` | no |
## Outputs
diff --git a/modules/nodes/variables.tf b/modules/nodes/variables.tf
index 013255f4..d7d8de7c 100644
--- a/modules/nodes/variables.tf
+++ b/modules/nodes/variables.tf
@@ -350,3 +350,9 @@ variable "kms_info" {
enabled = bool
})
}
+
+variable "use_fips_endpoint" {
+ description = "Use aws FIPS endpoints"
+ type = bool
+ default = false
+}
diff --git a/modules/nodes/versions.tf b/modules/nodes/versions.tf
index f62e366f..ec59bb9b 100644
--- a/modules/nodes/versions.tf
+++ b/modules/nodes/versions.tf
@@ -24,4 +24,6 @@ provider "aws" {
ignore_tags {
keys = var.ignore_tags
}
+
+ use_fips_endpoint = var.use_fips_endpoint
}
diff --git a/tests/deploy/ci-deploy.sh b/tests/deploy/ci-deploy.sh
index c0adc4f5..2b459327 100755
--- a/tests/deploy/ci-deploy.sh
+++ b/tests/deploy/ci-deploy.sh
@@ -107,13 +107,17 @@ set_tf_vars() {
[ -f "$PVT_KEY" ] || { ssh-keygen -q -P '' -t rsa -b 4096 -m PEM -f "$PVT_KEY" && chmod 600 "$PVT_KEY"; }
export CUSTOM_AMI PVT_KEY
- local default_nodes=$(envsubst <"$INFRA_VARS_TPL" | tee "$INFRA_VARS" | hcledit attribute get default_node_groups)
+
+ printf "\nInfra vars:\n"
+ envsubst <"$INFRA_VARS_TPL" | tee "$INFRA_VARS"
+
+ export DEFAULT_NODES=$(hcledit attribute get default_node_groups -f "$INFRA_VARS")
+
+ printf "\nCluster vars:\n"
envsubst <"$CLUSTER_VARS_TPL" | tee "$CLUSTER_VARS"
- echo "default_node_groups = $default_nodes" >"$NODES_VARS"
- echo "Infra vars:" && cat "$INFRA_VARS"
- echo "Cluster vars:" && cat "$CLUSTER_VARS"
- echo "Nodes vars:" && cat "$NODES_VARS"
+ printf "\nNodes vars:\n"
+ envsubst <"$NODES_VARS_TPL" | tee "$NODES_VARS"
}
# Not used atm, but we could test nodes upgrades(OS-patches).
diff --git a/tests/deploy/cluster-ci.tfvars.tftpl b/tests/deploy/cluster-ci.tfvars.tftpl
index 38d56d4f..f8623d77 100644
--- a/tests/deploy/cluster-ci.tfvars.tftpl
+++ b/tests/deploy/cluster-ci.tfvars.tftpl
@@ -2,3 +2,5 @@ irsa_external_dns = {
enabled = true
hosted_zone_name = "deploys-delta.domino.tech"
}
+
+use_fips_endpoint = true
diff --git a/tests/deploy/infra-ci.tfvars.tftpl b/tests/deploy/infra-ci.tfvars.tftpl
index f6eff556..60d87612 100644
--- a/tests/deploy/infra-ci.tfvars.tftpl
+++ b/tests/deploy/infra-ci.tfvars.tftpl
@@ -67,4 +67,5 @@ tags = {
CIRCLE_BUILD_NUM = "${CIRCLE_BUILD_NUM}"
}
-ignore_tags = ["my-ignored-tag"]
+ignore_tags = ["my-ignored-tag"]
+use_fips_endpoint = true
diff --git a/tests/deploy/meta.sh b/tests/deploy/meta.sh
index 08248a07..c5d6bcc9 100644
--- a/tests/deploy/meta.sh
+++ b/tests/deploy/meta.sh
@@ -8,6 +8,7 @@ PVT_KEY="${DEPLOY_DIR}/domino.pem"
INFRA_VARS_TPL="${SH_DIR}/infra-ci.tfvars.tftpl"
CLUSTER_VARS_TPL="${SH_DIR}/cluster-ci.tfvars.tftpl"
+NODES_VARS_TPL="${SH_DIR}/nodes-ci.tfvars.tftpl"
declare -A COMP_MODS
COMP_MODS["infra"]="infra"
@@ -24,5 +25,6 @@ export SH_DIR \
PVT_KEY \
INFRA_VARS_TPL \
CLUSTER_VARS_TPL \
+ NODES_VARS_TPL \
COMP_MODS \
MOD_ADD
diff --git a/tests/deploy/nodes-ci.tfvars.tftpl b/tests/deploy/nodes-ci.tfvars.tftpl
new file mode 100644
index 00000000..4b90e537
--- /dev/null
+++ b/tests/deploy/nodes-ci.tfvars.tftpl
@@ -0,0 +1,2 @@
+default_node_groups = ${DEFAULT_NODES}
+use_fips_endpoint = true
diff --git a/tests/plan/terraform/README.md b/tests/plan/terraform/README.md
index de485a16..7818ee2e 100644
--- a/tests/plan/terraform/README.md
+++ b/tests/plan/terraform/README.md
@@ -53,6 +53,7 @@
| [ssh\_pvt\_key\_path](#input\_ssh\_pvt\_key\_path) | SSH private key filepath. | `string` | n/a | yes |
| [storage](#input\_storage) | storage = {
efs = {
access\_point\_path = Filesystem path for efs.
backup\_vault = {
create = Create backup vault for EFS toggle.
force\_destroy = Toggle to allow automatic destruction of all backups when destroying.
backup = {
schedule = Cron-style schedule for EFS backup vault (default: once a day at 12pm).
cold\_storage\_after = Move backup data to cold storage after this many days.
delete\_after = Delete backup data after this many days.
}
}
}
s3 = {
force\_destroy\_on\_deletion = Toogle to allow recursive deletion of all objects in the s3 buckets. if 'false' terraform will NOT be able to delete non-empty buckets.
}
ecr = {
force\_destroy\_on\_deletion = Toogle to allow recursive deletion of all objects in the ECR repositories. if 'false' terraform will NOT be able to delete non-empty repositories.
}
}
} | object({
efs = optional(object({
access_point_path = optional(string, "/domino")
backup_vault = optional(object({
create = optional(bool, true)
force_destroy = optional(bool, true)
backup = optional(object({
schedule = optional(string, "0 12 * * ? *")
cold_storage_after = optional(number, 35)
delete_after = optional(number, 125)
}), {})
}), {})
}), {})
s3 = optional(object({
force_destroy_on_deletion = optional(bool, true)
}), {})
ecr = optional(object({
force_destroy_on_deletion = optional(bool, true)
}), {})
costs_enabled = optional(bool, true)
}) | `{}` | no |
| [tags](#input\_tags) | Deployment tags. | `map(string)` | `{}` | no |
+| [use\_fips\_endpoint](#input\_use\_fips\_endpoint) | Use aws FIPS endpoints | `bool` | `false` | no |
## Outputs
diff --git a/tests/plan/terraform/main.tf b/tests/plan/terraform/main.tf
index f5a233b7..2b38be98 100644
--- a/tests/plan/terraform/main.tf
+++ b/tests/plan/terraform/main.tf
@@ -13,6 +13,7 @@ module "infra" {
ssh_pvt_key_path = var.ssh_pvt_key_path
tags = var.tags
domino_cur = var.domino_cur
+ use_fips_endpoint = var.use_fips_endpoint
}
@@ -35,16 +36,17 @@ module "eks" {
monitoring_bucket = module.infra.monitoring_bucket
route53_hosted_zone_name = var.route53_hosted_zone_name
}
+ use_fips_endpoint = var.use_fips_endpoint
}
module "irsa_external_dns" {
- count = var.route53_hosted_zone_name != null ? 1 : 0
source = "./../../../modules/irsa"
eks_info = module.eks.info
external_dns = {
- enabled = true
+ enabled = var.route53_hosted_zone_name != null
hosted_zone_name = var.route53_hosted_zone_name
}
+ use_fips_endpoint = var.use_fips_endpoint
}
data "aws_iam_policy_document" "mypod_s3" {
@@ -64,6 +66,7 @@ module "irsa_policies" {
policy = data.aws_iam_policy_document.mypod_s3.json
serviceaccount_name = "mypod-s3"
}]
+ use_fips_endpoint = var.use_fips_endpoint
}
module "nodes" {
@@ -77,6 +80,7 @@ module "nodes" {
network_info = module.infra.network
kms_info = module.infra.kms
tags = module.infra.tags
+ use_fips_endpoint = var.use_fips_endpoint
}
module "single_node" {
diff --git a/tests/plan/terraform/variables.tf b/tests/plan/terraform/variables.tf
index 0e0f1640..9fe3438c 100644
--- a/tests/plan/terraform/variables.tf
+++ b/tests/plan/terraform/variables.tf
@@ -443,3 +443,9 @@ variable "domino_cur" {
default = {}
}
+
+variable "use_fips_endpoint" {
+ description = "Use aws FIPS endpoints"
+ type = bool
+ default = false
+}
diff --git a/tests/plan/terraform/versions.tf b/tests/plan/terraform/versions.tf
index ae4c1b0f..df931ef0 100644
--- a/tests/plan/terraform/versions.tf
+++ b/tests/plan/terraform/versions.tf
@@ -3,6 +3,8 @@ provider "aws" {
ignore_tags {
keys = var.ignore_tags
}
+
+ use_fips_endpoint = var.use_fips_endpoint
}
terraform {