fixup! Migrate cluster modules from map(map(string)) to map(object)

Author: pst

aws/_modules/eks/aws_iam_authenticator.tf

@@ -11,7 +11,7 @@ resource "kubernetes_config_map" "current" {
   groups:
     - system:bootstrappers
     - system:nodes
-${var.aws_auth_map_roles}
+${var.aws_auth_map_roles != null ? var.aws_auth_map_roles : ""}
 MAPROLES
 
     mapUsers = var.aws_auth_map_users

aws/_modules/eks/node_pool.tf

@@ -27,6 +27,9 @@ module "node_pool" {
 
   tags = var.default_node_pool != null && var.default_node_pool.additional_node_tags != null ? var.default_node_pool.additional_node_tags : {}
 
+  labels = var.default_node_pool.labels
+
+
   kubernetes_version = aws_eks_cluster.current.version
 
   # force node_pool to depend on aws-auth configmap

aws/_modules/eks/node_pool/variables.tf

@@ -45,9 +45,7 @@ variable "min_size" {
 
 variable "disk_size" {
   type        = number
-  default     = 20
   description = "Size in GB of node root volumes."
-  nullable    = false
 }
 
 variable "subnet_ids" {
@@ -72,15 +70,11 @@ variable "taints" {
 variable "tags" {
   type        = map(string)
   description = "AWS tags to set on the node pool. Merged with Kubestack default tags."
-  default     = {}
-  nullable    = false
 }
 
 variable "labels" {
   type        = map(string)
   description = "Kubernetes labels to set on the nodes created by the node pool. Merged with Kubestack default labels."
-  default     = {}
-  nullable    = false
 }
 
 variable "ami_type" {
@@ -101,10 +95,10 @@ variable "kubernetes_version" {
 variable "metadata_options" {
   description = "EC2 metadata service options."
   type = object({
-    http_endpoint               = optional(string)
-    http_tokens                 = optional(string)
-    http_put_response_hop_limit = optional(number)
-    http_protocol_ipv6          = optional(string)
-    instance_metadata_tags      = optional(string)
+    http_endpoint               = string
+    http_tokens                 = string
+    http_put_response_hop_limit = number
+    http_protocol_ipv6          = string
+    instance_metadata_tags      = string
   })
 }

aws/_modules/eks/variables.tf

@@ -18,77 +18,67 @@ variable "kubernetes_version" {
 variable "enabled_cluster_log_types" {
   type        = list(string)
   description = "List of cluster log types to enable."
-  default     = ["api", "audit", "authenticator", "controllerManager", "scheduler"]
-  nullable    = false
 }
 
 variable "vpc_config" {
   type = object({
-    cidr                      = optional(string, "10.0.0.0/16")
-    control_subnet_newbits    = optional(string, "8")
-    node_subnet_newbits       = optional(string, "4")
-    node_subnet_number_offset = optional(string, "1")
-    legacy_node_subnets       = optional(bool, false)
-    dns_hostnames             = optional(bool, false)
-    dns_support               = optional(bool, true)
-    subnet_map_public_ip      = optional(bool, true)
-    endpoint_private_access   = optional(bool, false)
-    endpoint_public_access    = optional(bool, true)
-    public_access_cidrs       = optional(list(string))
+    cidr                      = string
+    control_subnet_newbits    = string
+    node_subnet_newbits       = string
+    node_subnet_number_offset = string
+    legacy_node_subnets       = bool
+    dns_hostnames             = bool
+    dns_support               = bool
+    subnet_map_public_ip      = bool
+    endpoint_private_access   = bool
+    endpoint_public_access    = bool
+    public_access_cidrs       = list(string)
   })
   description = "VPC configuration for the EKS cluster matching vpc_config block structure."
-  default     = {}
-  nullable    = false
 }
 
 variable "kubernetes_network_config" {
   type = object({
-    service_ipv4_cidr = optional(string)
+    service_ipv4_cidr = string
   })
   description = "Kubernetes network configuration matching kubernetes_network_config block."
-  default     = {}
-  nullable    = false
 }
 
 variable "encryption_config" {
   type = object({
-    provider_key_arn = optional(string)
+    provider_key_arn = string
   })
   description = "Encryption configuration matching encryption_config block. Set provider_key_arn to enable encryption."
-  default     = {}
-  nullable    = false
 }
 
 variable "availability_zones" {
   description = "List of availability zones for the cluster."
   type        = list(string)
-  default     = []
-  nullable    = false
 }
 
 variable "default_node_pool" {
   type = object({
-    instance_types   = optional(list(string))
-    desired_capacity = optional(number)
-    max_size         = optional(number)
-    min_size         = optional(number)
-    launch_template = optional(object({
-      metadata_options = optional(object({
-        http_endpoint               = optional(string)
-        http_tokens                 = optional(string)
-        http_put_response_hop_limit = optional(number)
-        http_protocol_ipv6          = optional(string)
-        instance_metadata_tags      = optional(string)
-      }))
-    }))
-    additional_node_tags    = optional(map(string))
-    root_device_volume_size = optional(number)
-    root_device_encrypted   = optional(bool)
-    ami_type                = optional(string)
-    ami_release_version     = optional(string)
+    instance_types   = list(string)
+    desired_capacity = number
+    max_size         = number
+    min_size         = number
+    launch_template = object({
+      metadata_options = object({
+        http_endpoint               = string
+        http_tokens                 = string
+        http_put_response_hop_limit = number
+        http_protocol_ipv6          = string
+        instance_metadata_tags      = string
+      })
+    })
+    additional_node_tags    = map(string)
+    labels                  = map(string)
+    root_device_volume_size = number
+    root_device_encrypted   = bool
+    ami_type                = string
+    ami_release_version     = string
   })
   description = "Default node pool configuration."
-  default     = null
 }
 
 variable "taints" {
@@ -103,34 +93,24 @@ variable "taints" {
 variable "aws_auth_map_roles" {
   description = "mapRoles entries added to aws-auth configmap"
   type        = string
-  default     = ""
-  nullable    = false
 }
 
 variable "aws_auth_map_users" {
   description = "mapUsers entries added to aws-auth configmap"
   type        = string
-  default     = ""
-  nullable    = false
 }
 
 variable "aws_auth_map_accounts" {
   description = "mapAccounts entries added to aws-auth configmap"
   type        = string
-  default     = ""
-  nullable    = false
 }
 
 variable "disable_default_ingress" {
   type        = bool
   description = "Whether to disable the default ingress."
-  default     = false
-  nullable    = false
 }
 
 variable "disable_openid_connect_provider" {
   type        = bool
   description = "Whether to disable the OpenID connect provider."
-  default     = false
-  nullable    = false
 }

aws/cluster/main.tf

@@ -6,6 +6,9 @@ module "configuration" {
 
 locals {
   cfg = module.configuration.merged[terraform.workspace]
+
+  default_node_pool_cfg                  = local.cfg["default_node_pool"]
+  default_node_pool_metadata_options_cfg = try(local.default_node_pool_cfg["metadata_options"], null)
 }
 
 data "aws_region" "current" {
@@ -28,19 +31,19 @@ module "cluster" {
 
   kubernetes_version = local.cfg["cluster_version"]
 
-  availability_zones = local.cfg["cluster_availability_zones"]
+  availability_zones = try(coalesce(local.cfg["cluster_availability_zones"], null), [])
 
   vpc_config = {
-    cidr                      = local.cfg["cluster_vpc_cidr"]
-    control_subnet_newbits    = local.cfg["cluster_vpc_control_subnet_newbits"]
-    node_subnet_newbits       = local.cfg["cluster_vpc_node_subnet_newbits"]
-    node_subnet_number_offset = local.cfg["cluster_vpc_node_subnet_number_offset"]
-    legacy_node_subnets       = local.cfg["cluster_vpc_legacy_node_subnets"]
-    dns_hostnames             = local.cfg["cluster_vpc_dns_hostnames"]
-    dns_support               = local.cfg["cluster_vpc_dns_support"]
-    subnet_map_public_ip      = local.cfg["cluster_vpc_subnet_map_public_ip"]
-    endpoint_private_access   = local.cfg["cluster_endpoint_private_access"]
-    endpoint_public_access    = local.cfg["cluster_endpoint_public_access"]
+    cidr                      = try(coalesce(local.cfg["cluster_vpc_cidr"], null), "10.0.0.0/16")
+    control_subnet_newbits    = try(coalesce(local.cfg["cluster_vpc_control_subnet_newbits"], null), "8")
+    node_subnet_newbits       = try(coalesce(local.cfg["cluster_vpc_node_subnet_newbits"], null), "4")
+    node_subnet_number_offset = try(coalesce(local.cfg["cluster_vpc_node_subnet_number_offset"], null), "1")
+    legacy_node_subnets       = try(coalesce(local.cfg["cluster_vpc_legacy_node_subnets"], null), false)
+    dns_hostnames             = try(coalesce(local.cfg["cluster_vpc_dns_hostnames"], null), false)
+    dns_support               = try(coalesce(local.cfg["cluster_vpc_dns_support"], null), true)
+    subnet_map_public_ip      = try(coalesce(local.cfg["cluster_vpc_subnet_map_public_ip"], null), true)
+    endpoint_private_access   = try(coalesce(local.cfg["cluster_endpoint_private_access"], null), false)
+    endpoint_public_access    = try(coalesce(local.cfg["cluster_endpoint_public_access"], null), true)
     public_access_cidrs       = local.cfg["cluster_public_access_cidrs"]
   }
 
@@ -52,17 +55,37 @@ module "cluster" {
     provider_key_arn = local.cfg["cluster_encryption_key_arn"]
   }
 
-  enabled_cluster_log_types = local.cfg["enabled_cluster_log_types"]
-
-  default_node_pool = local.cfg["default_node_pool"]
+  enabled_cluster_log_types = try(coalesce(local.cfg["enabled_cluster_log_types"], null), ["api", "audit", "authenticator", "controllerManager", "scheduler"])
+
+  default_node_pool = {
+    instance_types   = try(local.default_node_pool_cfg["instance_types"], null)
+    desired_capacity = try(coalesce(local.default_node_pool_cfg["desired_capacity"], null), 1)
+    max_size         = try(coalesce(local.default_node_pool_cfg["max_size"], null), 1)
+    min_size         = try(coalesce(local.default_node_pool_cfg["min_size"], null), 1)
+    launch_template = {
+      metadata_options = try({
+        http_endpoint               = local.default_node_pool_metadata_options_cfg["http_endpoint"]
+        http_tokens                 = local.default_node_pool_metadata_options_cfg["http_tokens"]
+        http_put_response_hop_limit = local.default_node_pool_metadata_options_cfg["http_put_response_hop_limit"]
+        http_protocol_ipv6          = local.default_node_pool_metadata_options_cfg["http_protocol_ipv6"]
+        instance_metadata_tags      = local.default_node_pool_metadata_options_cfg["instance_metadata_tags"]
+      }, null)
+    }
+    additional_node_tags    = try(local.default_node_pool_cfg["additional_node_tags"], null)
+    labels                  = try(coalesce(local.default_node_pool_cfg["labels"], null), {})
+    root_device_volume_size = try(coalesce(local.default_node_pool_cfg["root_device_volume_size"], null), 20)
+    root_device_encrypted   = try(local.default_node_pool_cfg["root_device_encrypted"], null)
+    ami_type                = try(local.default_node_pool_cfg["ami_type"], null)
+    ami_release_version     = try(local.default_node_pool_cfg["ami_release_version"], null)
+  }
 
   taints = toset([])
 
-  aws_auth_map_roles    = local.cfg["cluster_aws_auth_map_roles"]
-  aws_auth_map_users    = local.cfg["cluster_aws_auth_map_users"]
-  aws_auth_map_accounts = local.cfg["cluster_aws_auth_map_accounts"]
+  aws_auth_map_roles    = try(coalesce(local.cfg["cluster_aws_auth_map_roles"], null), "")
+  aws_auth_map_users    = try(coalesce(local.cfg["cluster_aws_auth_map_users"], null), "")
+  aws_auth_map_accounts = try(coalesce(local.cfg["cluster_aws_auth_map_accounts"], null), "")
 
-  disable_default_ingress = local.cfg["disable_default_ingress"]
+  disable_default_ingress = try(coalesce(local.cfg["disable_default_ingress"], null), false)
 
-  disable_openid_connect_provider = local.cfg["disable_openid_connect_provider"]
+  disable_openid_connect_provider = try(coalesce(local.cfg["disable_openid_connect_provider"], null), false)
 }

aws/cluster/node-pool/main.tf

@@ -34,7 +34,7 @@ module "node_pool" {
 
   subnet_ids = local.vpc_subnet_newbits == null ? local.vpc_subnet_ids : aws_subnet.current[*].id
 
-  instance_types      = local.cfg["instance_types"] == null ? toset([]) : toset(local.cfg["instance_types"])
+  instance_types      = try(toset(local.cfg["instance_types"]), toset([]))
   ami_release_version = lookup(local.cfg, "ami_release_version")
   desired_size        = lookup(local.cfg, "desired_capacity")
   max_size            = lookup(local.cfg, "max_size")
@@ -44,15 +44,16 @@ module "node_pool" {
 
   kubernetes_version = data.aws_eks_cluster.current.version
 
-  disk_size = local.cfg["disk_size"]
+  disk_size = try(coalesce(local.cfg["disk_size"], null), 20)
 
   metadata_options = local.cfg["metadata_options"]
 
-  taints = local.cfg["taints"] == null ? toset([]) : local.cfg["taints"]
+  taints = try(coalesce(local.cfg["taints"], null), toset([]))
 
-  tags = local.cfg["tags"]
+  tags = try(coalesce(local.cfg["tags"], null), {})
 
-  labels = local.cfg["labels"]
+  labels = try(coalesce(local.cfg["labels"], null), {})
 
   depends-on-aws-auth = null
 }
+

aws/cluster/variables.tf

@@ -30,6 +30,7 @@ variable "configuration" {
         instance_metadata_tags      = optional(string)
       }))
       additional_node_tags    = optional(map(string))
+      labels                  = optional(map(string))
       root_device_volume_size = optional(number)
       root_device_encrypted   = optional(bool)
       ami_type                = optional(string)