eks-alb-controller.yaml

AWSTemplateFormatVersion: "2010-09-09"
Description: "Deploys the alb load balancer controller to an existing kubernetes cluster (qs-1qnl6p00n)"
Metadata:
  QSLint:
    Exclusions: [W9002, W9003, W9004, W9006]
Parameters:
  OIDCIssuerURLWithoutProtocol:
    Type: String
  ClusterName:
    Type: String
Resources:
  ALBIngressIAMRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: !Sub |
        {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Federated": "arn:aws:iam::${AWS::AccountId}:oidc-provider/${OIDCIssuerURLWithoutProtocol}"
              },
              "Action": "sts:AssumeRoleWithWebIdentity",
              "Condition": {
                "StringEquals": {
                  "${OIDCIssuerURLWithoutProtocol}:sub": "system:serviceaccount:kube-system:alb-load-balancer-controller"
                }
              }
            }
          ]
        }
      Policies:
      - PolicyName: alb-ingress-policy
        PolicyDocument:
          Statement:
          - Effect: Allow
            Action:
            - acm:DescribeCertificate
            - acm:ListCertificates
            - acm:GetCertificate
            Resource: "*"
          - Effect: Allow
            Action:
            - ec2:AuthorizeSecurityGroupIngress
            - ec2:CreateSecurityGroup
            - ec2:CreateTags
            - ec2:DeleteTags
            - ec2:DeleteSecurityGroup
            - ec2:DescribeAccountAttributes
            - ec2:DescribeAddresses
            - ec2:DescribeInstances
            - ec2:DescribeInstanceStatus
            - ec2:DescribeInternetGateways
            - ec2:DescribeNetworkInterfaces
            - ec2:DescribeSecurityGroups
            - ec2:DescribeSubnets
            - ec2:DescribeTags
            - ec2:DescribeVpcs
            - ec2:ModifyInstanceAttribute
            - ec2:ModifyNetworkInterfaceAttribute
            - ec2:RevokeSecurityGroupIngress
            Resource: "*"
          - Effect: Allow
            Action:
            - elasticloadbalancing:AddListenerCertificates
            - elasticloadbalancing:AddTags
            - elasticloadbalancing:CreateListener
            - elasticloadbalancing:CreateLoadBalancer
            - elasticloadbalancing:CreateRule
            - elasticloadbalancing:CreateTargetGroup
            - elasticloadbalancing:DeleteListener
            - elasticloadbalancing:DeleteLoadBalancer
            - elasticloadbalancing:DeleteRule
            - elasticloadbalancing:DeleteTargetGroup
            - elasticloadbalancing:DeregisterTargets
            - elasticloadbalancing:DescribeListenerCertificates
            - elasticloadbalancing:DescribeListeners
            - elasticloadbalancing:DescribeLoadBalancers
            - elasticloadbalancing:DescribeLoadBalancerAttributes
            - elasticloadbalancing:DescribeRules
            - elasticloadbalancing:DescribeSSLPolicies
            - elasticloadbalancing:DescribeTags
            - elasticloadbalancing:DescribeTargetGroups
            - elasticloadbalancing:DescribeTargetGroupAttributes
            - elasticloadbalancing:DescribeTargetHealth
            - elasticloadbalancing:ModifyListener
            - elasticloadbalancing:ModifyLoadBalancerAttributes
            - elasticloadbalancing:ModifyRule
            - elasticloadbalancing:ModifyTargetGroup
            - elasticloadbalancing:ModifyTargetGroupAttributes
            - elasticloadbalancing:RegisterTargets
            - elasticloadbalancing:RemoveListenerCertificates
            - elasticloadbalancing:RemoveTags
            - elasticloadbalancing:SetIpAddressType
            - elasticloadbalancing:SetSecurityGroups
            - elasticloadbalancing:SetSubnets
            - elasticloadbalancing:SetWebACL
            Resource: "*"
          - Effect: Allow
            Action:
            - iam:CreateServiceLinkedRole
            - iam:GetServerCertificate
            - iam:ListServerCertificates
            Resource: "*"
          - Effect: Allow
            Action:
            - waf-regional:GetWebACLForResource
            - waf-regional:GetWebACL
            - waf-regional:AssociateWebACL
            - waf-regional:DisassociateWebACL
            Resource: "*"
          - Effect: Allow
            Action:
            - tag:GetResources
            - tag:TagResources
            Resource: "*"
          - Effect: Allow
            Action:
            - waf:GetWebACL
            Resource: "*"
          - Effect: Allow
            Action:
            - wafv2:GetWebACL
            - wafv2:GetWebACLForResource
            - wafv2:AssociateWebACL
            - wafv2:DisassociateWebACL
            Resource: "*"
          - Effect: Allow
            Action:
            - shield:DescribeProtection
            - shield:GetSubscriptionState
            - shield:DeleteProtection
            - shield:CreateProtection
            - shield:DescribeSubscription
            - shield:ListProtections
            Resource: "*"
      Path: "/"
  ALBClusterRole:
    Type: "Custom::KubeManifest"
    Version: '1.0'
    Properties:
      ServiceToken: !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:EKS-QuickStart-KubeManifest-${ClusterName}"
      ClusterName: !Ref ClusterName
      Manifest:
        apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRole
        metadata:
          labels:
            app.kubernetes.io/name: alb-load-balancer-controller
          name: alb-load-balancer-controller
        rules:
          - apiGroups:
              - ""
              - extensions
            resources:
              - configmaps
              - endpoints
              - events
              - ingresses
              - ingresses/status
              - services
            verbs:
              - create
              - get
              - list
              - update
              - watch
              - patch
          - apiGroups:
              - ""
              - extensions
            resources:
              - nodes
              - pods
              - secrets
              - services
              - namespaces
            verbs:
              - get
              - list
              - watch
  ALBClusterRoleBinding:
    Type: "Custom::KubeManifest"
    Version: '1.0'
    DependsOn:
      - ALBClusterRole
      - ALBServiceAccount
    Properties:
      ServiceToken: !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:EKS-QuickStart-KubeManifest-${ClusterName}"
      ClusterName: !Ref ClusterName
      Manifest:
        apiVersion: rbac.authorization.k8s.io/v1
        kind: ClusterRoleBinding
        metadata:
          labels:
            app.kubernetes.io/name: alb-load-balancer-controller
          name: alb-load-balancer-controller
        roleRef:
          apiGroup: rbac.authorization.k8s.io
          kind: ClusterRole
          name: alb-load-balancer-controller
        subjects:
          - kind: ServiceAccount
            name: alb-load-balancer-controller
            namespace: kube-system
  ALBServiceAccount:
    Type: "Custom::KubeManifest"
    Version: '1.0'
    Properties:
      ServiceToken: !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:EKS-QuickStart-KubeManifest-${ClusterName}"
      ClusterName: !Ref ClusterName
      Manifest:
        apiVersion: v1
        kind: ServiceAccount
        metadata:
          labels:
            app.kubernetes.io/name: alb-load-balancer-controller
          annotations:
            eks.amazonaws.com/role-arn: !GetAtt ALBIngressIAMRole.Arn
          name: alb-load-balancer-controller
          namespace: kube-system
  ALBDeployment:
    Type: "Custom::KubeManifest"
    Version: '1.0'
    DependsOn: ALBServiceAccount
    Properties:
      ServiceToken: !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:EKS-QuickStart-KubeManifest-${ClusterName}"
      ClusterName: !Ref ClusterName
      Manifest:
         apiVersion: apps/v1
         kind: Deployment
         metadata:
           labels:
             app.kubernetes.io/name: alb-load-balancer-controller
           name: alb-load-balancer-controller
           namespace: kube-system
         spec:
           selector:
             matchLabels:
               app.kubernetes.io/name: alb-load-balancer-controller
           template:
             metadata:
               labels:
                 app.kubernetes.io/name: alb-load-balancer-controller
             spec:
               containers:
                 - name: alb-load-balancer-controller
                   args:
                     - --ingress-class=alb
                     - !Sub "--cluster-name=${ClusterName}"
                   image: docker.io/amazon/aws-alb-ingress-controller:v2.1.1
               serviceAccountName: alb-load-balancer-controller

Outputs:
  ALBDeployment:
    Value: !Ref ALBDeployment