added k8s_groups for vpn-users (#159)

Author: sshi100

templates/kubernetes/terraform/modules/kubernetes/vpn.tf

@@ -225,3 +225,33 @@ resource "kubernetes_deployment" "wireguard" {
   }
 }
 
+# Create Kubernetes role and binding to use arbitrary group 'vpn-users'. This group has been added by administor and mapped to user roles(developer & operator).
+resource "kubernetes_role" "wireguard" {
+  metadata {
+    name      = "wireguard"
+    namespace = kubernetes_namespace.vpn_namespace.metadata[0].name
+  }
+
+  rule {
+    api_groups = [""]
+    resources  = ["pods", "pods/exec"]
+    verbs      = ["exec", "list", "create"]
+  }
+}
+
+resource "kubernetes_role_binding" "wireguard" {
+  metadata {
+    name      = "wireguard"
+    namespace = kubernetes_namespace.vpn_namespace.metadata[0].name
+  }
+  role_ref {
+    api_group = "rbac.authorization.k8s.io"
+    kind      = "Role"
+    name      = "wireguard"
+  }
+  subject {
+    kind      = "Group"
+    name      = "vpn-users"
+    api_group = "rbac.authorization.k8s.io"
+  }
+}

templates/terraform/environments/prod/main.tf

@@ -115,16 +115,19 @@ module "prod" {
       name         = "developer"
       aws_policy   = data.aws_iam_policy_document.developer_access.json
       k8s_policies = local.k8s_developer_access
+      k8s_groups   = ["vpn-users"]
     },
     {
       name         = "operator"
       aws_policy   = data.aws_iam_policy_document.operator_access.json
       k8s_policies = local.k8s_operator_access
+      k8s_groups   = ["vpn-users"]
     },
     {
       name         = "deployer"
       aws_policy   = data.aws_iam_policy_document.deployer_access.json
       k8s_policies = local.k8s_deployer_access
+      k8s_groups   = []
     }
   ]
 

templates/terraform/environments/stage/main.tf

@@ -119,16 +119,19 @@ module "stage" {
       name         = "developer"
       aws_policy   = data.aws_iam_policy_document.developer_access.json
       k8s_policies = local.k8s_developer_access
+      k8s_groups   = ["vpn-users"]
     },
     {
       name         = "operator"
       aws_policy   = data.aws_iam_policy_document.operator_access.json
       k8s_policies = local.k8s_operator_access
+      k8s_groups   = ["vpn-users"]
     },
     {
       name         = "deployer"
       aws_policy   = data.aws_iam_policy_document.deployer_access.json
       k8s_policies = local.k8s_deployer_access
+      k8s_groups   = []
     }
   ]
 

templates/terraform/modules/environment/main.tf

@@ -3,7 +3,7 @@
 locals {
   kubernetes_cluster_name = "${var.project}-${var.environment}-${var.region}"
 
-  users = [
+  user_access_users = [
     for u in var.user_role_mapping : {
       name = u.name
       roles = [
@@ -12,12 +12,22 @@ locals {
       ]
     }
   ]
+ 
+  user_access_roles = [
+    for r in var.roles : {
+      name         = r.name
+      aws_policy   = r.aws_policy
+      k8s_policies = r.k8s_policies
+    }
+  ]
 
-  kubernetes_iam_role_mapping = [
+  eks_kubernetes_iam_role_mapping = [
     for r in module.user_access.eks_iam_role_mapping : {
       iam_role_arn  = r.arn
       k8s_role_name = r.name
-      k8s_groups    = [ r.name ]
+      k8s_groups    = flatten(concat([r.name], [
+        for o in var.roles : o.k8s_groups if r.name == "${var.project}-kubernetes-${o.name}-${var.environment}"
+      ]))
     }
   ]
 }
@@ -64,7 +74,7 @@ module "eks" {
   worker_asg_max_size  = var.eks_worker_asg_max_size
   worker_ami           = var.eks_worker_ami # EKS-Optimized AMI for your region: https://docs.aws.amazon.com/eks/latest/userguide/eks-optimized-ami.html
 
-  iam_role_mapping = local.kubernetes_iam_role_mapping
+  iam_role_mapping = local.eks_kubernetes_iam_role_mapping
 }
 
 
@@ -163,8 +173,8 @@ module "user_access" {
   project     = var.project
   environment = var.environment
 
-  roles = var.roles
-  users = local.users
+  roles = local.user_access_roles
+  users = local.user_access_users
 }
 
 

templates/terraform/modules/environment/variables.tf

@@ -149,6 +149,7 @@ variable "roles" {
     name         = string
     aws_policy   = string
     k8s_policies = list(map(list(string)))
+    k8s_groups   = list(string)
   }))
   description = "Role list with policies"
 }