flip/convox
1
0
Fork 0
mirror of https://github.com/FlipsideCrypto/convox.git synced 2026-02-06 10:56:56 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

use depends_on to reduce possible race condition around routes and roles

Browse Source
This commit is contained in:
David Dollar 2019-10-30 03:43:37 -04:00
parent 0b22e16e0f
commit 17ca024295
No known key found for this signature in database
GPG Key ID: AFAF263FB45B2124
3 changed files with 15 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
terraform/cluster/aws/iam.tf
View File

@ -26,24 +26,6 @@ data "aws_iam_policy_document" "assume_eks" {
}
}
data "aws_iam_policy_document" "assume_service" {
statement {
actions = ["sts:AssumeRoleWithWebIdentity"]
effect = "Allow"
condition {
test = "StringEquals"
variable = "${replace(aws_iam_openid_connect_provider.cluster.url, "https://", "")}:sub"
values = ["system:serviceaccount:kube-system:aws-node"]
}
principals {
identifiers = ["${aws_iam_openid_connect_provider.cluster.arn}"]
type = "Federated"
}
}
}
resource "aws_iam_role" "cluster" {
assume_role_policy = data.aws_iam_policy_document.assume_eks.json
name = "${var.name}-cluster"

5
terraform/cluster/aws/main.tf
View File

@ -53,6 +53,11 @@ resource "aws_eks_cluster" "cluster" {
security_group_ids = [aws_security_group.cluster.id]
subnet_ids = concat(aws_subnet.public.*.id)
}
depends_on = [
"aws_iam_role_policy_attachment.cluster_eks_cluster",
"aws_iam_role_policy_attachment.cluster_eks_service",
]
}
resource "null_resource" "after_cluster" {

10
terraform/cluster/aws/vpc.tf
View File

@ -50,6 +50,11 @@ resource "aws_route" "public-default" {
destination_cidr_block = "0.0.0.0/0"
gateway_id = aws_internet_gateway.nodes.id
route_table_id = aws_route_table.public.id
depends_on = [
"aws_internet_gateway.nodes",
"aws_route_table.public",
]
}
resource "aws_route_table_association" "public" {
@ -110,6 +115,11 @@ resource "aws_route" "private-default" {
destination_cidr_block = "0.0.0.0/0"
nat_gateway_id = aws_nat_gateway.private[count.index].id
route_table_id = aws_route_table.private[count.index].id
depends_on = [
"aws_internet_gateway.nodes",
"aws_route_table.private",
]
}
resource "aws_route_table_association" "private" {