You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+26-22
Original file line number
Diff line number
Diff line change
@@ -1,9 +1,9 @@
1
-
# AWS EKS Universal Addon Terraform module
1
+
# Bitbucket Runner Autoscaler
2
2
3
-
A Terraform module to deploy the universal addon on Amazon EKS cluster.
3
+
This module deploys a Helm chart for the Bitbucket runner autoscaler and supports deploying Bitbucket runner groups, as well as the AWS IAM components needed for Bitbucket runners to authenticate against AWS resources.
| <aname="input_cluster_identity_oidc_issuer"></a> [cluster\_identity\_oidc\_issuer](#input\_cluster\_identity\_oidc\_issuer)|The OIDC Identity issuer for the cluster (required).|`string`|
85
-
| <aname="input_cluster_identity_oidc_issuer_arn"></a> [cluster\_identity\_oidc\_issuer\_arn](#input\_cluster\_identity\_oidc\_issuer\_arn)|The OIDC Identity issuer ARN for the cluster that can be used to associate IAM roles with a Service Account (required).|`string`|
| <aname="input_enabled"></a> [enabled](#input\_enabled)| Set to false to prevent the module from creating any resources. |`bool`|
87
88
| <aname="input_helm_atomic"></a> [helm\_atomic](#input\_helm\_atomic)| If set, installation process purges chart on fail. The wait flag will be set automatically if atomic is used. Defaults to `false`. |`bool`|
88
89
| <aname="input_helm_chart_name"></a> [helm\_chart\_name](#input\_helm\_chart\_name)| Helm chart name to be installed. Defaults to `local.addon.name` (required). |`string`|
@@ -117,29 +118,32 @@ See [basic example](examples/basic) for further information.
117
118
| <aname="input_helm_timeout"></a> [helm\_timeout](#input\_helm\_timeout)| Time in seconds to wait for any individual Kubernetes operation (like Jobs for hooks). Defaults to `300`. |`number`|
118
119
| <aname="input_helm_wait"></a> [helm\_wait](#input\_helm\_wait)| Will wait until all Helm release resources are in a ready state before marking the release as successful. It will wait for as long as timeout. Defaults to `false`. |`bool`|
119
120
| <aname="input_helm_wait_for_jobs"></a> [helm\_wait\_for\_jobs](#input\_helm\_wait\_for\_jobs)| If wait is enabled, will wait until all Helm Jobs have been completed before marking the release as successful. It will wait for as long as timeout. Defaults to `false`. |`bool`|
120
-
| <aname="input_irsa_additional_policies"></a> [irsa\_additional\_policies](#input\_irsa\_additional\_policies)| Map of the additional policies to be attached to IRSA role. Where key is arbitrary id and value is policy ARN. Defaults to `{}`. |`map(string)`|
121
-
| <aname="input_irsa_assume_role_arns"></a> [irsa\_assume\_role\_arns](#input\_irsa\_assume\_role\_arns)| List of ARNs assumable by the IRSA role. Applied only if `irsa_assume_role_enabled` is `true`. |`list(string)`|
122
-
| <aname="input_irsa_assume_role_enabled"></a> [irsa\_assume\_role\_enabled](#input\_irsa\_assume\_role\_enabled)| Whether IRSA is allowed to assume role defined by `irsa_assume_role_arn`. Mutually exclusive with `irsa_policy_enabled`. Defaults to `false`. |`bool`|
123
-
| <aname="input_irsa_permissions_boundary"></a> [irsa\_permissions\_boundary](#input\_irsa\_permissions\_boundary)| ARN of the policy that is used to set the permissions boundary for the IRSA role. Defaults to `""`. |`string`|
124
-
| <aname="input_irsa_policy"></a> [irsa\_policy](#input\_irsa\_policy)| Policy to be attached to the IRSA role. Applied only if `irsa_policy_enabled` is `true`. |`string`|
125
-
| <aname="input_irsa_policy_enabled"></a> [irsa\_policy\_enabled](#input\_irsa\_policy\_enabled)| Whether to create IAM policy specified by `irsa_policy`. Mutually exclusive with `irsa_assume_role_enabled`. Defaults to `false`. |`bool`|
126
-
| <aname="input_irsa_role_create"></a> [irsa\_role\_create](#input\_irsa\_role\_create)| Whether to create IRSA role and annotate Service Account. Defaults to `true`. |`bool`|
127
-
| <aname="input_irsa_role_name"></a> [irsa\_role\_name](#input\_irsa\_role\_name)| IRSA role name. The value is prefixed by `var.irsa_role_name_prefix`. Defaults to addon Helm chart name. |`string`|
128
-
| <aname="input_irsa_role_name_prefix"></a> [irsa\_role\_name\_prefix](#input\_irsa\_role\_name\_prefix)| IRSA role name prefix. Defaults to addon IRSA component name with `irsa` suffix. |`string`|
129
-
| <aname="input_irsa_tags"></a> [irsa\_tags](#input\_irsa\_tags)| IRSA resources tags. Defaults to `{}`. |`map(string)`|
130
121
| <aname="input_namespace"></a> [namespace](#input\_namespace)| The Kubernetes Namespace in which the Helm chart will be installed. Defaults to `local.addon.name`. |`string`|
131
-
| <aname="input_rbac_create"></a> [rbac\_create](#input\_rbac\_create)| Whether to create and use RBAC resources. Defaults to `true`. |`bool`|
132
-
| <aname="input_service_account_create"></a> [service\_account\_create](#input\_service\_account\_create)| Whether to create Service Account. Defaults to `true`. |`bool`|
133
-
| <aname="input_service_account_name"></a> [service\_account\_name](#input\_service\_account\_name)| The Kubernetes Service Account name. Defaults to addon name. |`string`|
134
-
| <aname="input_service_account_namespace"></a> [service\_account\_namespace](#input\_service\_account\_namespace)| The Kubernetes Service Account namespace. Defaults to addon namespace. |`string`|
122
+
| <aname="input_oidc_additional_policies"></a> [oidc\_additional\_policies](#input\_oidc\_additional\_policies)| Map of the additional policies to be attached to oidc role. Where key is arbitrary id and value is policy ARN. Defaults to `{}`. |`map(string)`|
123
+
| <aname="input_oidc_assume_role_arns"></a> [oidc\_assume\_role\_arns](#input\_oidc\_assume\_role\_arns)| List of ARNs assumable by the oidc role. Applied only if `oidc_assume_role_enabled` is `true`. |`list(string)`|
124
+
| <aname="input_oidc_assume_role_enabled"></a> [oidc\_assume\_role\_enabled](#input\_oidc\_assume\_role\_enabled)| Whether oidc is allowed to assume role defined by `oidc_assume_role_arn`. Mutually exclusive with `oidc_policy_enabled`. Defaults to `false`. |`bool`|
125
+
| <aname="input_oidc_assume_role_policy_condition_test"></a> [oidc\_assume\_role\_policy\_condition\_test](#input\_oidc\_assume\_role\_policy\_condition\_test)| Specifies the condition test to use for the assume role trust policy. Defaults to `StringLike`. |`string`|
126
+
| <aname="input_oidc_assume_role_policy_condition_values"></a> [oidc\_assume\_role\_policy\_condition\_values](#input\_oidc\_assume\_role\_policy\_condition\_values)| Specifies the values for the assume role trust policy condition. Defaults to `[]`. |`list(string)`|
127
+
| <aname="input_oidc_assume_role_policy_condition_variable"></a> [oidc\_assume\_role\_policy\_condition\_variable](#input\_oidc\_assume\_role\_policy\_condition\_variable)| Specifies the variable to use for the assume role trust policy. Defaults to `""`. |`string`|
128
+
| <aname="input_oidc_custom_provider_arn"></a> [oidc\_custom\_provider\_arn](#input\_oidc\_custom\_provider\_arn)| Specifies a custom OIDC provider ARN. If provided, the module will not create a default OIDC provider. Defaults to `""`. |`string`|
129
+
| <aname="input_oidc_openid_client_ids"></a> [oidc\_openid\_client\_ids](#input\_oidc\_openid\_client\_ids)| List of client IDs that are allowed to authenticate. Defaults to `[]`. |`list(string)`|
130
+
| <aname="input_oidc_openid_provider_url"></a> [oidc\_openid\_provider\_url](#input\_oidc\_openid\_provider\_url)| oidc provider url. Defaults to `""`. |`string`|
131
+
| <aname="input_oidc_openid_thumbprints"></a> [oidc\_openid\_thumbprints](#input\_oidc\_openid\_thumbprints)| List of thumbprints of the OIDC provider's server certificate. Defaults to `[]`. |`list(string)`|
132
+
| <aname="input_oidc_permissions_boundary"></a> [oidc\_permissions\_boundary](#input\_oidc\_permissions\_boundary)| ARN of the policy that is used to set the permissions boundary for the oidc role. Defaults to `""`. |`string`|
133
+
| <aname="input_oidc_policy"></a> [oidc\_policy](#input\_oidc\_policy)| Policy to be attached to the oidc role. Applied only if `oidc_policy_enabled` is `true`. |`string`|
134
+
| <aname="input_oidc_policy_enabled"></a> [oidc\_policy\_enabled](#input\_oidc\_policy\_enabled)| Whether to create IAM policy specified by `oidc_policy`. Mutually exclusive with `oidc_assume_role_enabled`. Defaults to `false`. |`bool`|
135
+
| <aname="input_oidc_role_create"></a> [oidc\_role\_create](#input\_oidc\_role\_create)| Whether to create oidc role and annotate Service Account. Defaults to `true`. |`bool`|
136
+
| <aname="input_oidc_role_name"></a> [oidc\_role\_name](#input\_oidc\_role\_name)| oidc role name. The value is prefixed by `var.oidc_role_name_prefix`. Defaults to addon Helm chart name. |`string`|
137
+
| <aname="input_oidc_role_name_prefix"></a> [oidc\_role\_name\_prefix](#input\_oidc\_role\_name\_prefix)| oidc role name prefix. Defaults to addon oidc component name with `oidc` suffix. |`string`|
138
+
| <aname="input_oidc_tags"></a> [oidc\_tags](#input\_oidc\_tags)| oidc resources tags. Defaults to `{}`. |`map(string)`|
135
139
| <aname="input_settings"></a> [settings](#input\_settings)| Additional Helm sets which will be passed to the Helm chart values. Defaults to `{}`. |`map(any)`|
136
140
| <aname="input_values"></a> [values](#input\_values)| Additional yaml encoded values which will be passed to the Helm chart. Defaults to `""`. |`string`|
137
141
## Outputs
138
142
139
143
| Name | Description |
140
144
|------|-------------|
141
145
| <aname="output_addon"></a> [addon](#output\_addon)| The addon module outputs |
142
-
| <aname="output_addon_irsa"></a> [addon\_irsa](#output\_addon\_irsa)| The addon IRSA module outputs |
146
+
| <aname="output_addon_oidc"></a> [addon\_oidc](#output\_addon\_oidc)| The addon oidc module outputs |
143
147
## Contributing and reporting issues
144
148
145
149
Feel free to create an issue in this repository if you have questions, suggestions or feature requests.
You have two options for setting up cross-account IAM access:
3
+
4
+
- Create an IAM Role and OIDC Provider in Another AWS Account: Set up an IAM role and OIDC provider for the same Bitbucket workspace in your other AWS account, and then assume that IAM role from your current account.
5
+
6
+
- Use the `additional_assumable_iam_roles` Variable: Utilize the additional_assumable_iam_roles variable, which adds sts:AssumeRole permissions for the specified roles to the IAM role where your runners are deployed. In your pipelines, you can then assume roles deployed in your other AWS accounts.
7
+
8
+
## Use Specialized AWS IAM Roles for Runners
9
+
The IAM role created by this module is opinionated and limited, it can only interact with ECR images. If you require the capability to manage additional AWS services, it is advised to create separate IAM roles. Configure these roles with assume policy conditions that restrict authentication to specific repositories and environments within those repositories.
10
+
11
+
## OIDC Thumbprint
12
+
To generate the OIDC thumbprint for the Bitbucket provider, set by the `bitbucket_oidc_thumbprint` variable, follow [this guide](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html).
0 commit comments