mirror of
https://github.com/storytold/terraform-aws-observability-accelerator.git
synced 2026-10-18 07:33:25 +00:00
Split base from modules
- Add infra as a example - Introduces a dependency issue between adot operator and workload collector
This commit is contained in:
Rodrigue Koffi
@@ -0,0 +1,72 @@
|
||||
# AWS OpenTelemetry Operator
|
||||
|
||||
[AWS Distro for OpenTelemetry (ADOT)](https://aws-otel.github.io/) is a secure,
|
||||
production-ready, AWS-supported distribution of the OpenTelemetry project.
|
||||
Part of the Cloud Native Computing Foundation, OpenTelemetry provides open
|
||||
source APIs, libraries, and agents to collect distributed traces and metrics
|
||||
for application monitoring.
|
||||
|
||||
This modules deploys either the
|
||||
[AWS Managed ADOT OpenTelemetry Operator for EKS](https://aws.amazon.com/about-aws/whats-new/2022/04/eks-opentelemetry-operator-now-available/)
|
||||
or [the OpenTelemetry Operator](https://github.com/open-telemetry/opentelemetry-helm-charts)
|
||||
through helm.
|
||||
The OpenTelemetry Operator is an implementation of a Kubernetes Operator.
|
||||
A Kubernetes Operator is a method of packaging, deploying and managing a
|
||||
Kubernetes-native application, which is both deployed on Kubernetes and
|
||||
managed using the Kubernetes APIs and kubectl tooling. The Kubernetes Operator
|
||||
is a custom controller, which introduces new object types through Custom Resource
|
||||
Definition (CRD), an extension mechanism in Kubernetes.
|
||||
In this case, the CRD that is managed by the OpenTelemetry Operator is the Collector.
|
||||
|
||||
> :warning: We do install [cert-manager](https://cert-manager.io/) as a [hard requirement](https://docs.aws.amazon.com/eks/latest/userguide/opentelemetry.html) for
|
||||
the ADOT Operator.
|
||||
|
||||
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
## Requirements
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
|
||||
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 3.72 |
|
||||
| <a name="requirement_kubernetes"></a> [kubernetes](#requirement\_kubernetes) | >= 2.10 |
|
||||
|
||||
## Providers
|
||||
|
||||
| Name | Version |
|
||||
|------|---------|
|
||||
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 3.72 |
|
||||
| <a name="provider_kubernetes"></a> [kubernetes](#provider\_kubernetes) | >= 2.10 |
|
||||
|
||||
## Modules
|
||||
|
||||
| Name | Source | Version |
|
||||
|------|--------|---------|
|
||||
| <a name="module_cert_manager"></a> [cert\_manager](#module\_cert\_manager) | ../cert-manager | n/a |
|
||||
| <a name="module_helm_addon"></a> [helm\_addon](#module\_helm\_addon) | ../helm-addon | n/a |
|
||||
|
||||
## Resources
|
||||
|
||||
| Name | Type |
|
||||
|------|------|
|
||||
| [aws_eks_addon.adot](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_addon) | resource |
|
||||
| [kubernetes_cluster_role_binding_v1.adot](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/cluster_role_binding_v1) | resource |
|
||||
| [kubernetes_cluster_role_v1.adot](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/cluster_role_v1) | resource |
|
||||
| [kubernetes_namespace_v1.adot](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/namespace_v1) | resource |
|
||||
| [kubernetes_role_binding_v1.adot](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/role_binding_v1) | resource |
|
||||
| [kubernetes_role_v1.adot](https://registry.terraform.io/providers/hashicorp/kubernetes/latest/docs/resources/role_v1) | resource |
|
||||
| [aws_eks_addon_version.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/eks_addon_version) | data source |
|
||||
|
||||
## Inputs
|
||||
|
||||
| Name | Description | Type | Default | Required |
|
||||
|------|-------------|------|---------|:--------:|
|
||||
| <a name="input_addon_config"></a> [addon\_config](#input\_addon\_config) | Amazon EKS Managed CoreDNS Add-on config | `any` | `{}` | no |
|
||||
| <a name="input_addon_context"></a> [addon\_context](#input\_addon\_context) | Input configuration for the addon | <pre>object({<br> aws_caller_identity_account_id = string<br> aws_caller_identity_arn = string<br> aws_eks_cluster_endpoint = string<br> aws_partition_id = string<br> aws_region_name = string<br> eks_cluster_id = string<br> eks_oidc_issuer_url = string<br> eks_oidc_provider_arn = string<br> irsa_iam_role_path = string<br> tags = map(string)<br> })</pre> | n/a | yes |
|
||||
| <a name="input_enable_amazon_eks_adot"></a> [enable\_amazon\_eks\_adot](#input\_enable\_amazon\_eks\_adot) | Enable Amazon EKS ADOT add-on | `bool` | `true` | no |
|
||||
| <a name="input_enable_opentelemetry_operator"></a> [enable\_opentelemetry\_operator](#input\_enable\_opentelemetry\_operator) | Enable opentelemetry operator addon | `bool` | `false` | no |
|
||||
| <a name="input_helm_config"></a> [helm\_config](#input\_helm\_config) | Helm provider config for ADOT Operator AddOn | `any` | `{}` | no |
|
||||
|
||||
## Outputs
|
||||
|
||||
No outputs.
|
||||
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
|
||||
@@ -0,0 +1,6 @@
|
||||
locals {
|
||||
name = "adot"
|
||||
eks_addon_role_name = "eks:addon-manager"
|
||||
eks_addon_clusterrole_name = "eks:addon-manager-otel"
|
||||
addon_namespace = "opentelemetry-operator-system"
|
||||
}
|
||||
@@ -0,0 +1,276 @@
|
||||
module "cert_manager" {
|
||||
source = "github.com/aws-ia/terraform-aws-eks-blueprints/modules/kubernetes-addons/cert-manager"
|
||||
count = var.enable_cert_manager ? 1 : 0
|
||||
|
||||
helm_config = { version = "v1.8.2" }
|
||||
addon_context = var.addon_context
|
||||
}
|
||||
|
||||
resource "kubernetes_namespace_v1" "adot" {
|
||||
|
||||
metadata {
|
||||
# If using EKS addon, namespace must be "opentelemetry-operator-system"
|
||||
name = local.addon_namespace
|
||||
|
||||
labels = {
|
||||
# Prerequisite for EKS addon
|
||||
"control-plane" = "controller-manager"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
data "aws_eks_addon_version" "this" {
|
||||
addon_name = local.name
|
||||
kubernetes_version = try(var.addon_config.kubernetes_version, var.kubernetes_version)
|
||||
most_recent = try(var.addon_config.most_recent, true)
|
||||
}
|
||||
|
||||
resource "aws_eks_addon" "adot" {
|
||||
cluster_name = var.addon_context.eks_cluster_id
|
||||
addon_name = local.name
|
||||
addon_version = try(var.addon_config.addon_version, data.aws_eks_addon_version.this.version)
|
||||
resolve_conflicts = try(var.addon_config.resolve_conflicts, "OVERWRITE")
|
||||
service_account_role_arn = try(var.addon_config.service_account_role_arn, null)
|
||||
preserve = try(var.addon_config.preserve, true)
|
||||
|
||||
tags = merge(
|
||||
var.addon_context.tags,
|
||||
try(var.addon_config.tags, {}),
|
||||
# implicit dependency with roles
|
||||
{
|
||||
RoleVersion = try(kubernetes_role_v1.adot.metadata[0].resource_version, ""),
|
||||
ClusterRoleVersion = try(kubernetes_cluster_role_v1.adot.metadata[0].resource_version, "")
|
||||
}
|
||||
)
|
||||
|
||||
depends_on = [module.cert_manager]
|
||||
}
|
||||
|
||||
resource "kubernetes_role_v1" "adot" {
|
||||
|
||||
metadata {
|
||||
name = local.eks_addon_role_name
|
||||
namespace = kubernetes_namespace_v1.adot.metadata[0].name
|
||||
}
|
||||
|
||||
rule {
|
||||
api_groups = [""]
|
||||
resources = ["serviceaccounts"]
|
||||
resource_names = ["opentelemetry-operator-controller-manager"]
|
||||
verbs = ["create", "delete", "get", "list", "patch", "update", "watch"]
|
||||
}
|
||||
rule {
|
||||
api_groups = ["rbac.authorization.k8s.io"]
|
||||
resources = ["roles"]
|
||||
resource_names = ["opentelemetry-operator-leader-election-role"]
|
||||
verbs = ["create", "delete", "get", "list", "patch", "update", "watch"]
|
||||
}
|
||||
rule {
|
||||
api_groups = ["rbac.authorization.k8s.io"]
|
||||
resources = ["rolebindings"]
|
||||
resource_names = ["opentelemetry-operator-leader-election-rolebinding"]
|
||||
verbs = ["create", "delete", "get", "list", "patch", "update", "watch"]
|
||||
}
|
||||
rule {
|
||||
api_groups = [""]
|
||||
resources = ["services"]
|
||||
resource_names = ["opentelemetry-operator-controller-manager-metrics-service", "opentelemetry-operator-webhook-service"]
|
||||
verbs = ["create", "delete", "get", "list", "patch", "update", "watch"]
|
||||
}
|
||||
rule {
|
||||
api_groups = ["apps"]
|
||||
resources = ["deployments"]
|
||||
resource_names = ["opentelemetry-operator-controller-manager"]
|
||||
verbs = ["create", "delete", "get", "list", "patch", "update", "watch"]
|
||||
}
|
||||
rule {
|
||||
api_groups = ["cert-manager.io"]
|
||||
resources = ["certificates", "issuers"]
|
||||
resource_names = ["opentelemetry-operator-serving-cert", "opentelemetry-operator-selfsigned-issuer"]
|
||||
verbs = ["create", "delete", "get", "list", "patch", "update", "watch"]
|
||||
}
|
||||
rule {
|
||||
api_groups = [""]
|
||||
resources = ["configmaps"]
|
||||
verbs = ["create", "delete", "get", "list", "patch", "update", "watch"]
|
||||
}
|
||||
rule {
|
||||
api_groups = [""]
|
||||
resources = ["configmaps/status"]
|
||||
verbs = ["get", "update", "patch"]
|
||||
}
|
||||
rule {
|
||||
api_groups = [""]
|
||||
resources = ["events"]
|
||||
verbs = ["create", "patch"]
|
||||
}
|
||||
rule {
|
||||
api_groups = [""]
|
||||
resources = ["pods"]
|
||||
verbs = ["list"]
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_role_binding_v1" "adot" {
|
||||
|
||||
metadata {
|
||||
name = local.eks_addon_role_name
|
||||
namespace = kubernetes_namespace_v1.adot.metadata[0].name
|
||||
}
|
||||
|
||||
subject {
|
||||
kind = "User"
|
||||
name = local.eks_addon_role_name
|
||||
api_group = "rbac.authorization.k8s.io"
|
||||
}
|
||||
role_ref {
|
||||
api_group = "rbac.authorization.k8s.io"
|
||||
kind = "Role"
|
||||
name = local.eks_addon_role_name
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_cluster_role_v1" "adot" {
|
||||
|
||||
metadata {
|
||||
name = local.eks_addon_clusterrole_name
|
||||
}
|
||||
|
||||
rule {
|
||||
api_groups = ["apiextensions.k8s.io"]
|
||||
resources = ["customresourcedefinitions"]
|
||||
resource_names = ["opentelemetrycollectors.opentelemetry.io", "instrumentations.opentelemetry.io"]
|
||||
verbs = ["create", "delete", "get", "list", "patch", "update", "watch"]
|
||||
}
|
||||
rule {
|
||||
api_groups = [""]
|
||||
resources = ["namespaces"]
|
||||
resource_names = [kubernetes_namespace_v1.adot.metadata[0].name]
|
||||
verbs = ["create", "delete", "get", "list", "patch", "update", "watch"]
|
||||
}
|
||||
rule {
|
||||
api_groups = ["rbac.authorization.k8s.io"]
|
||||
resources = ["clusterroles"]
|
||||
resource_names = ["opentelemetry-operator-manager-role", "opentelemetry-operator-metrics-reader", "opentelemetry-operator-proxy-role"]
|
||||
verbs = ["create", "delete", "get", "list", "patch", "update", "watch"]
|
||||
}
|
||||
rule {
|
||||
api_groups = ["rbac.authorization.k8s.io"]
|
||||
resources = ["clusterrolebindings"]
|
||||
resource_names = ["opentelemetry-operator-manager-rolebinding", "opentelemetry-operator-proxy-rolebinding"]
|
||||
verbs = ["create", "delete", "get", "list", "patch", "update", "watch"]
|
||||
}
|
||||
rule {
|
||||
api_groups = ["admissionregistration.k8s.io"]
|
||||
resources = ["mutatingwebhookconfigurations", "validatingwebhookconfigurations"]
|
||||
resource_names = ["opentelemetry-operator-mutating-webhook-configuration", "opentelemetry-operator-validating-webhook-configuration"]
|
||||
verbs = ["create", "delete", "get", "list", "patch", "update", "watch"]
|
||||
}
|
||||
rule {
|
||||
non_resource_urls = ["/metrics"]
|
||||
verbs = ["get"]
|
||||
}
|
||||
rule {
|
||||
api_groups = [""]
|
||||
resources = ["configmaps"]
|
||||
verbs = ["create", "delete", "get", "list", "patch", "update", "watch"]
|
||||
}
|
||||
rule {
|
||||
api_groups = [""]
|
||||
resources = ["events"]
|
||||
verbs = ["create", "patch"]
|
||||
}
|
||||
rule {
|
||||
api_groups = [""]
|
||||
resources = ["namespaces"]
|
||||
verbs = ["list", "watch"]
|
||||
}
|
||||
rule {
|
||||
api_groups = [""]
|
||||
resources = ["serviceaccounts"]
|
||||
verbs = ["create", "delete", "get", "list", "patch", "update", "watch"]
|
||||
}
|
||||
rule {
|
||||
api_groups = [""]
|
||||
resources = ["services"]
|
||||
verbs = ["create", "delete", "get", "list", "patch", "update", "watch"]
|
||||
}
|
||||
rule {
|
||||
api_groups = ["apps"]
|
||||
resources = ["daemonsets"]
|
||||
verbs = ["create", "delete", "get", "list", "patch", "update", "watch"]
|
||||
}
|
||||
rule {
|
||||
api_groups = ["apps"]
|
||||
resources = ["deployments"]
|
||||
verbs = ["create", "delete", "get", "list", "patch", "update", "watch"]
|
||||
}
|
||||
rule {
|
||||
api_groups = ["apps"]
|
||||
resources = ["replicasets"]
|
||||
verbs = ["create", "delete", "get", "list", "patch", "update", "watch"]
|
||||
}
|
||||
rule {
|
||||
api_groups = ["apps"]
|
||||
resources = ["statefulsets"]
|
||||
verbs = ["create", "delete", "get", "list", "patch", "update", "watch"]
|
||||
}
|
||||
rule {
|
||||
api_groups = ["autoscaling"]
|
||||
resources = ["horizontalpodautoscalers"]
|
||||
verbs = ["create", "delete", "get", "list", "patch", "update", "watch"]
|
||||
}
|
||||
rule {
|
||||
api_groups = ["coordination.k8s.io"]
|
||||
resources = ["leases"]
|
||||
verbs = ["create", "get", "list", "update"]
|
||||
}
|
||||
rule {
|
||||
api_groups = ["opentelemetry.io"]
|
||||
resources = ["opentelemetrycollectors"]
|
||||
verbs = ["create", "delete", "get", "list", "patch", "update", "watch"]
|
||||
}
|
||||
rule {
|
||||
api_groups = ["opentelemetry.io"]
|
||||
resources = ["opentelemetrycollectors/finalizers"]
|
||||
verbs = ["get", "patch", "update"]
|
||||
}
|
||||
rule {
|
||||
api_groups = ["opentelemetry.io"]
|
||||
resources = ["opentelemetrycollectors/status"]
|
||||
verbs = ["get", "patch", "update"]
|
||||
}
|
||||
rule {
|
||||
api_groups = ["opentelemetry.io"]
|
||||
resources = ["instrumentations"]
|
||||
verbs = ["get", "list", "patch", "update", "watch"]
|
||||
}
|
||||
rule {
|
||||
api_groups = ["authentication.k8s.io"]
|
||||
resources = ["tokenreviews"]
|
||||
verbs = ["create"]
|
||||
}
|
||||
rule {
|
||||
api_groups = ["authorization.k8s.io"]
|
||||
resources = ["subjectaccessreviews"]
|
||||
verbs = ["create"]
|
||||
}
|
||||
}
|
||||
|
||||
resource "kubernetes_cluster_role_binding_v1" "adot" {
|
||||
|
||||
metadata {
|
||||
name = local.eks_addon_clusterrole_name
|
||||
}
|
||||
subject {
|
||||
kind = "User"
|
||||
name = local.eks_addon_role_name
|
||||
api_group = "rbac.authorization.k8s.io"
|
||||
}
|
||||
role_ref {
|
||||
api_group = "rbac.authorization.k8s.io"
|
||||
kind = "ClusterRole"
|
||||
name = local.eks_addon_clusterrole_name
|
||||
}
|
||||
|
||||
}
|
||||
@@ -0,0 +1,36 @@
|
||||
variable "helm_config" {
|
||||
description = "Helm provider config for ADOT Operator AddOn"
|
||||
type = any
|
||||
default = {}
|
||||
}
|
||||
|
||||
variable "addon_context" {
|
||||
description = "Input configuration for the addon"
|
||||
type = object({
|
||||
aws_caller_identity_account_id = string
|
||||
aws_caller_identity_arn = string
|
||||
aws_eks_cluster_endpoint = string
|
||||
aws_partition_id = string
|
||||
aws_region_name = string
|
||||
eks_cluster_id = string
|
||||
eks_oidc_issuer_url = string
|
||||
eks_oidc_provider_arn = string
|
||||
irsa_iam_role_path = string
|
||||
tags = map(string)
|
||||
})
|
||||
}
|
||||
|
||||
variable "enable_cert_manager" {
|
||||
type = bool
|
||||
default = true
|
||||
}
|
||||
|
||||
variable "kubernetes_version" {
|
||||
type = string
|
||||
}
|
||||
|
||||
variable "addon_config" {
|
||||
description = "Amazon EKS Managed CoreDNS Add-on config"
|
||||
type = any
|
||||
default = {}
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
terraform {
|
||||
required_version = ">= 1.0.0"
|
||||
|
||||
required_providers {
|
||||
aws = {
|
||||
source = "hashicorp/aws"
|
||||
version = ">= 3.72"
|
||||
}
|
||||
kubernetes = {
|
||||
source = "hashicorp/kubernetes"
|
||||
version = ">= 2.10"
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user