blob: 71cc1fc87e5a453dd713aef05278227385a8cbc7 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
|
---
- block:
# If us-west-1 does become supported, change this test to use an unsupported region
# or if all regions are supported, delete this test
- name: attempt to use eks in unsupported region
eks_cluster:
name: "{{ eks_cluster_name }}"
state: absent
access_key: "{{ aws_access_key }}"
secret_key: "{{ aws_secret_key }}"
session_token: "{{ security_token | default(omit) }}"
region: us-west-1
register: aws_eks_unsupported_region
ignore_errors: yes
- name: check that aws_eks_cluster did nothing
assert:
that:
- aws_eks_unsupported_region is failed
- '"msg" in aws_eks_unsupported_region'
- name: delete an as yet non-existent EKS cluster
eks_cluster:
name: "{{ eks_cluster_name }}"
state: absent
register: aws_eks_delete_non_existent
- name: check that aws_eks_cluster did nothing
assert:
that:
- aws_eks_delete_non_existent is not changed
- name: ensure IAM instance role exists
iam_role:
name: aws_eks_cluster_role
assume_role_policy_document: "{{ lookup('file','eks-trust-policy.json') }}"
state: present
create_instance_profile: no
managed_policies:
- AmazonEKSServicePolicy
- AmazonEKSClusterPolicy
register: iam_role
- name: create a VPC to work in
ec2_vpc_net:
cidr_block: 10.0.0.0/16
state: present
name: '{{ resource_prefix }}_aws_eks'
resource_tags:
Name: '{{ resource_prefix }}_aws_eks'
register: setup_vpc
- name: create subnets
ec2_vpc_subnet:
az: '{{ aws_region }}{{ item.zone }}'
tags:
Name: '{{ resource_prefix }}_aws_eks-subnet-{{ item.zone }}'
vpc_id: '{{ setup_vpc.vpc.id }}'
cidr: "{{ item.cidr }}"
state: present
register: setup_subnets
with_items:
- "{{ eks_subnets }}"
- name: create security groups to use for EKS
ec2_security_group:
name: "{{ item.name }}"
description: "{{ item.description }}"
state: present
rules: "{{ item.rules }}"
rules_egress: "{{ item.rules_egress|default(omit) }}"
vpc_id: '{{ setup_vpc.vpc.id }}'
with_items: "{{ eks_security_groups }}"
register: setup_security_groups
- name: create EKS cluster
eks_cluster:
name: "{{ eks_cluster_name }}"
security_groups: "{{ eks_security_groups | map(attribute='name') }}"
subnets: "{{ setup_subnets.results | map(attribute='subnet.id') }}"
role_arn: "{{ iam_role.arn }}"
tags:
Name: "{{ resource_prefix }}"
another: foobar
register: eks_create
- name: check that EKS cluster was created
assert:
that:
- eks_create is changed
- eks_create.name == eks_cluster_name
- eks_create.tags.another == "foobar"
- name: create EKS cluster with same details but wait for it to become active
eks_cluster:
name: "{{ eks_cluster_name }}"
security_groups: "{{ eks_security_groups | map(attribute='name') }}"
subnets: "{{ setup_subnets.results | map(attribute='subnet.id') }}"
role_arn: "{{ iam_role.arn }}"
wait: yes
register: eks_create
- name: Check that EKS cluster is active and has CA and endpoint data
assert:
that:
- eks_create is not changed
- eks_create.name == eks_cluster_name
- eks_create.status == "ACTIVE"
- eks_create.certificate_authority.data is defined
- eks_create.certificate_authority.data != ""
- eks_create.endpoint is defined
- eks_create.endpoint != ""
- name: create EKS cluster with same details but using SG ids
eks_cluster:
name: "{{ eks_cluster_name }}"
security_groups: "{{ setup_security_groups.results | map(attribute='group_id') }}"
subnets: "{{ setup_subnets.results | map(attribute='subnet.id') }}"
role_arn: "{{ iam_role.arn }}"
register: eks_create
- name: check that EKS cluster did not change
assert:
that:
- eks_create is not changed
- eks_create.name == eks_cluster_name
- name: remove EKS cluster, waiting until complete
eks_cluster:
name: "{{ eks_cluster_name }}"
state: absent
wait: yes
register: eks_delete
- name: check that EKS cluster was removed
assert:
that:
- eks_delete is changed
- name: create EKS cluster with same details but wait for it to become active
eks_cluster:
name: "{{ eks_cluster_name }}"
security_groups: "{{ eks_security_groups | map(attribute='name') }}"
subnets: "{{ setup_subnets.results | map(attribute='subnet.id') }}"
role_arn: "{{ iam_role.arn }}"
wait: yes
register: eks_create
- name: check that EKS cluster was created
assert:
that:
- eks_create is changed
- eks_create.name == eks_cluster_name
- name: remove EKS cluster, without waiting this time
eks_cluster:
name: "{{ eks_cluster_name }}"
state: absent
register: eks_delete
- name: check that EKS cluster remove has started
assert:
that:
- eks_delete is changed
- name: create EKS cluster with short name
eks_cluster:
name: "{{ eks_cluster_short_name }}"
security_groups: "{{ eks_security_groups | map(attribute='name') }}"
subnets: "{{ setup_subnets.results | map(attribute='subnet.id') }}"
role_arn: "{{ iam_role.arn }}"
register: eks_create
- name: check that EKS cluster was created with short name
assert:
that:
- eks_create is changed
- eks_create.name == eks_cluster_short_name
- eks_create is not failed
- name: remove EKS cluster with short name
eks_cluster:
name: "{{ eks_cluster_short_name }}"
state: absent
wait: yes
register: eks_delete
always:
- name: Announce teardown start
debug:
msg: "***** TESTING COMPLETE. COMMENCE TEARDOWN *****"
- name: remove EKS cluster
eks_cluster:
name: "{{ eks_cluster_name }}"
state: absent
wait: yes
register: eks_delete
ignore_errors: yes
- name: remove EKS cluster
eks_cluster:
name: "{{ eks_cluster_short_name }}"
state: absent
wait: yes
register: eks_delete
ignore_errors: yes
- debug:
msg: "{{ eks_security_groups|reverse|list }}"
- name: create list of all additional EKS security groups
set_fact:
additional_eks_sg:
- name: "{{ eks_cluster_name }}-workers-sg"
- name: set all security group rule lists to empty to remove circular dependency
ec2_security_group:
name: "{{ item.name }}"
description: "{{ item.description }}"
state: present
rules: []
rules_egress: []
purge_rules: yes
purge_rules_egress: yes
vpc_id: '{{ setup_vpc.vpc.id }}'
with_items: "{{ eks_security_groups }}"
ignore_errors: yes
- name: remove security groups
ec2_security_group:
name: '{{ item.name }}'
state: absent
vpc_id: '{{ setup_vpc.vpc.id }}'
with_items: "{{ eks_security_groups|reverse|list + additional_eks_sg }}"
ignore_errors: yes
- name: remove setup subnet
ec2_vpc_subnet:
az: '{{ aws_region }}{{ item.zone }}'
vpc_id: '{{ setup_vpc.vpc.id }}'
cidr: "{{ item.cidr}}"
state: absent
with_items: "{{ eks_subnets }}"
ignore_errors: yes
- name: remove setup VPC
ec2_vpc_net:
cidr_block: 10.0.0.0/16
state: absent
name: '{{ resource_prefix }}_aws_eks'
ignore_errors: yes
|
