From 072835aeb587756765f54c707e76346b0020bfd1 Mon Sep 17 00:00:00 2001
From: maxim <nikromax@gmail.com>
Date: Wed, 17 Nov 2021 16:11:26 +0600
Subject: [PATCH 1/4] refactor: do not use templates/nginx-ingress-values.yaml
 and set necessary values in the eks-ingress-nginx-controller.tf file

---
 ...ler.tf => eks-ingress-nginx-controller.tf} | 96 +++++++++++++++----
 terraform/layer2-k8s/helm-releases.yaml       |  2 +-
 ...ss-certmanager-ssl-termination-values.yaml | 46 ---------
 .../templates/nginx-ingress-values.yaml       | 42 --------
 terraform/layer2-k8s/variables.tf             |  7 --
 5 files changed, 76 insertions(+), 117 deletions(-)
 rename terraform/layer2-k8s/{eks-nginx-ingress-controller.tf => eks-ingress-nginx-controller.tf} (58%)
 delete mode 100644 terraform/layer2-k8s/templates/nginx-ingress-certmanager-ssl-termination-values.yaml
 delete mode 100644 terraform/layer2-k8s/templates/nginx-ingress-values.yaml

diff --git a/terraform/layer2-k8s/eks-nginx-ingress-controller.tf b/terraform/layer2-k8s/eks-ingress-nginx-controller.tf
similarity index 58%
rename from terraform/layer2-k8s/eks-nginx-ingress-controller.tf
rename to terraform/layer2-k8s/eks-ingress-nginx-controller.tf
index dd9024f2..6e55a067 100644
--- a/terraform/layer2-k8s/eks-nginx-ingress-controller.tf
+++ b/terraform/layer2-k8s/eks-ingress-nginx-controller.tf
@@ -4,27 +4,80 @@ locals {
     enabled       = local.helm_releases[index(local.helm_releases.*.id, "ingress-nginx")].enabled
     chart         = local.helm_releases[index(local.helm_releases.*.id, "ingress-nginx")].chart
     repository    = local.helm_releases[index(local.helm_releases.*.id, "ingress-nginx")].repository
-    chart_version = local.helm_releases[index(local.helm_releases.*.id, "ingress-nginx")].version
+    chart_version = local.helm_releases[index(local.helm_releases.*.id, "ingress-nginx")].chart_version
     namespace     = local.helm_releases[index(local.helm_releases.*.id, "ingress-nginx")].namespace
   }
-  ssl_certificate_arn = var.nginx_ingress_ssl_terminator == "lb" ? data.terraform_remote_state.layer1-aws.outputs.ssl_certificate_arn : ""
+  ssl_certificate_arn          = var.nginx_ingress_ssl_terminator == "lb" ? data.terraform_remote_state.layer1-aws.outputs.ssl_certificate_arn : "ssl-certificate"
+  ingress_ngxin_general_values = <<VALUES
+rbac:
+  create: true
+controller:
+  metrics:
+    enabled: true
+    serviceMonitor:
+      enabled: true
+  podAnnotations:
+    co.elastic.logs/module: nginx
+    co.elastic.logs/fileset.stdout: ingress_controller
+    co.elastic.logs/fileset.stderr: error
 
-  template_name = (
-    var.nginx_ingress_ssl_terminator == "lb" ? "nginx-ingress-values.yaml" : (
-    var.nginx_ingress_ssl_terminator == "nginx" ? "nginx-ingress-certmanager-ssl-termination-values.yaml" : "")
-  )
-}
-
-data "template_file" "ingress_nginx" {
-  count = local.ingress_nginx.enabled ? 1 : 0
-
-  template = file("${path.module}/templates/${local.template_name}")
-  vars = {
-    hostname           = local.domain_name
-    ssl_cert           = local.ssl_certificate_arn
-    proxy_real_ip_cidr = local.vpc_cidr
-    namespace          = module.ingress_nginx_namespace[count.index].name
-  }
+  affinity:
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+        - matchExpressions:
+          - key: eks.amazonaws.com/capacityType
+            operator: In
+            values:
+              - ON_DEMAND
+VALUES
+  ingress_nginx_l7_values      = <<VALUES
+controller:
+  service:
+    targetPorts:
+      http: http
+      https: http
+    annotations:
+      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
+      service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: '60'
+      service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https"
+      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ${local.ssl_certificate_arn}
+      service.beta.kubernetes.io/aws-load-balancer-ssl-negotiation-policy: ELBSecurityPolicy-TLS-1-2-2017-01
+      external-dns.alpha.kubernetes.io/hostname: ${local.domain_name}.
+  publishService:
+    enabled: true
+  config:
+    server-tokens: "false"
+    use-forwarded-headers: "true"
+    set-real-ip-from: "${local.vpc_cidr}"
+VALUES
+  ingress_nginx_l4_values      = <<VALUES
+controller:
+  extraArgs:
+    default-ssl-certificate: "${local.ingress_nginx.enabled ? module.ingress_nginx_namespace[0].name : "default"}/nginx-tls"
+  containerPort:
+    http: 80
+    https: 443
+  service:
+    targetPorts:
+      http: http
+      https: https
+    annotations:
+      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
+      service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*"
+      service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: '60'
+      service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https"
+      # service.beta.kubernetes.io/aws-load-balancer-type: nlb
+      external-dns.alpha.kubernetes.io/hostname: ${local.domain_name}.
+  publishService:
+    enabled: true
+  config:
+    server-tokens: "false"
+    use-forwarded-headers: "true"
+    use-proxy-protocol: "true"
+    set-real-ip-from: "${local.vpc_cidr}"
+    real-ip-header: "proxy_protocol"
+VALUES
 }
 
 #tfsec:ignore:kubernetes-network-no-public-egress tfsec:ignore:kubernetes-network-no-public-ingress
@@ -169,9 +222,10 @@ resource "helm_release" "ingress_nginx" {
   namespace   = module.ingress_nginx_namespace[count.index].name
   max_history = var.helm_release_history_size
 
-  values = [
-    data.template_file.ingress_nginx[count.index].rendered,
-  ]
+  values = compact([
+    local.ingress_ngxin_general_values,
+    var.nginx_ingress_ssl_terminator == "lb" ? local.ingress_nginx_l7_values : local.ingress_nginx_l4_values
+  ])
 
   depends_on = [helm_release.prometheus_operator]
 }
diff --git a/terraform/layer2-k8s/helm-releases.yaml b/terraform/layer2-k8s/helm-releases.yaml
index 34716a4e..a45d8c4b 100644
--- a/terraform/layer2-k8s/helm-releases.yaml
+++ b/terraform/layer2-k8s/helm-releases.yaml
@@ -69,7 +69,7 @@ releases:
     enabled: true
     chart: ingress-nginx
     repository: https://kubernetes.github.io/ingress-nginx
-    version: 3.23.0
+    chart_version: 3.23.0
     namespace: ingress-nginx
   - id: istio-operator
     enabled: false
diff --git a/terraform/layer2-k8s/templates/nginx-ingress-certmanager-ssl-termination-values.yaml b/terraform/layer2-k8s/templates/nginx-ingress-certmanager-ssl-termination-values.yaml
deleted file mode 100644
index 87a676c9..00000000
--- a/terraform/layer2-k8s/templates/nginx-ingress-certmanager-ssl-termination-values.yaml
+++ /dev/null
@@ -1,46 +0,0 @@
-controller:
-  extraArgs:
-    default-ssl-certificate: "${namespace}/nginx-tls"
-
-  containerPort:
-    http: 80
-    https: 443
-
-  service:
-    targetPorts:
-      http: http
-      https: https
-    annotations:
-      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: tcp
-      service.beta.kubernetes.io/aws-load-balancer-proxy-protocol: "*"
-      service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: '60'
-      service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https"
-      # service.beta.kubernetes.io/aws-load-balancer-type: nlb
-      external-dns.alpha.kubernetes.io/hostname: ${hostname}.
-  publishService:
-    enabled: true
-
-  config:
-    server-tokens: "false"
-    use-forwarded-headers: "true"
-    use-proxy-protocol: "true"
-    set-real-ip-from: "${proxy_real_ip_cidr}"
-    real-ip-header: "proxy_protocol"
-
-  metrics:
-    enabled: true
-    serviceMonitor:
-      enabled: true
-
-  affinity:
-    nodeAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-        nodeSelectorTerms:
-        - matchExpressions:
-          - key: eks.amazonaws.com/capacityType
-            operator: In
-            values:
-              - ON_DEMAND
-
-rbac:
-  create: true
diff --git a/terraform/layer2-k8s/templates/nginx-ingress-values.yaml b/terraform/layer2-k8s/templates/nginx-ingress-values.yaml
deleted file mode 100644
index fd0035ad..00000000
--- a/terraform/layer2-k8s/templates/nginx-ingress-values.yaml
+++ /dev/null
@@ -1,42 +0,0 @@
-controller:
-  service:
-    targetPorts:
-      http: http
-      https: http
-    annotations:
-      service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http
-      service.beta.kubernetes.io/aws-load-balancer-connection-idle-timeout: '60'
-      service.beta.kubernetes.io/aws-load-balancer-ssl-ports: "https"
-      service.beta.kubernetes.io/aws-load-balancer-ssl-cert: ${ssl_cert}
-      service.beta.kubernetes.io/aws-load-balancer-ssl-negotiation-policy: ELBSecurityPolicy-TLS-1-2-2017-01
-      external-dns.alpha.kubernetes.io/hostname: ${hostname}.
-  publishService:
-    enabled: true
-
-  config:
-    server-tokens: "false"
-    use-forwarded-headers: "true"
-    set-real-ip-from: "${proxy_real_ip_cidr}"
-
-  metrics:
-    enabled: true
-    serviceMonitor:
-      enabled: true
-
-  podAnnotations:
-    co.elastic.logs/module: nginx
-    co.elastic.logs/fileset.stdout: ingress_controller
-    co.elastic.logs/fileset.stderr: error
-
-  affinity:
-    nodeAffinity:
-      requiredDuringSchedulingIgnoredDuringExecution:
-        nodeSelectorTerms:
-        - matchExpressions:
-          - key: eks.amazonaws.com/capacityType
-            operator: In
-            values:
-              - ON_DEMAND
-
-rbac:
-  create: true
diff --git a/terraform/layer2-k8s/variables.tf b/terraform/layer2-k8s/variables.tf
index 5a880a44..5e6ab3e7 100644
--- a/terraform/layer2-k8s/variables.tf
+++ b/terraform/layer2-k8s/variables.tf
@@ -39,13 +39,6 @@ variable "nginx_ingress_ssl_terminator" {
   # nginx - terminate ssl on nginx side
 }
 
-# ALB Ingress
-variable "aws_loadbalancer_controller_enable" {
-  description = "Disable or Enable aws-loadbalancer-controller. You need to enable it if you want to use Fargate"
-  type        = bool
-  default     = false
-}
-
 # Cluster autoscaler
 variable "cluster_autoscaler_version" {
   description = "Version of cluster autoscaler"

From d27331aed73290984e51d2165fb39a47532a5173 Mon Sep 17 00:00:00 2001
From: maxim <nikromax@gmail.com>
Date: Wed, 17 Nov 2021 16:21:00 +0600
Subject: [PATCH 2/4] fix ingress_nginx_general_values variable name

---
 terraform/layer2-k8s/eks-ingress-nginx-controller.tf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/terraform/layer2-k8s/eks-ingress-nginx-controller.tf b/terraform/layer2-k8s/eks-ingress-nginx-controller.tf
index 6e55a067..fba14688 100644
--- a/terraform/layer2-k8s/eks-ingress-nginx-controller.tf
+++ b/terraform/layer2-k8s/eks-ingress-nginx-controller.tf
@@ -8,7 +8,7 @@ locals {
     namespace     = local.helm_releases[index(local.helm_releases.*.id, "ingress-nginx")].namespace
   }
   ssl_certificate_arn          = var.nginx_ingress_ssl_terminator == "lb" ? data.terraform_remote_state.layer1-aws.outputs.ssl_certificate_arn : "ssl-certificate"
-  ingress_ngxin_general_values = <<VALUES
+  ingress_nginx_general_values = <<VALUES
 rbac:
   create: true
 controller:
@@ -223,7 +223,7 @@ resource "helm_release" "ingress_nginx" {
   max_history = var.helm_release_history_size
 
   values = compact([
-    local.ingress_ngxin_general_values,
+    local.ingress_nginx_general_values,
     var.nginx_ingress_ssl_terminator == "lb" ? local.ingress_nginx_l7_values : local.ingress_nginx_l4_values
   ])
 

From 8f33a4768d9ce8c589e275b647ff33a263614528 Mon Sep 17 00:00:00 2001
From: maxim <nikromax@gmail.com>
Date: Wed, 17 Nov 2021 16:22:21 +0600
Subject: [PATCH 3/4] do not use compact function

---
 terraform/layer2-k8s/eks-ingress-nginx-controller.tf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/terraform/layer2-k8s/eks-ingress-nginx-controller.tf b/terraform/layer2-k8s/eks-ingress-nginx-controller.tf
index fba14688..8d1ad80c 100644
--- a/terraform/layer2-k8s/eks-ingress-nginx-controller.tf
+++ b/terraform/layer2-k8s/eks-ingress-nginx-controller.tf
@@ -222,10 +222,10 @@ resource "helm_release" "ingress_nginx" {
   namespace   = module.ingress_nginx_namespace[count.index].name
   max_history = var.helm_release_history_size
 
-  values = compact([
+  values = [
     local.ingress_nginx_general_values,
     var.nginx_ingress_ssl_terminator == "lb" ? local.ingress_nginx_l7_values : local.ingress_nginx_l4_values
-  ])
+  ]
 
   depends_on = [helm_release.prometheus_operator]
 }

From d1110d42f2e35ac6c786ed3a6fba3e447fa9c00e Mon Sep 17 00:00:00 2001
From: maxim <nikromax@gmail.com>
Date: Wed, 17 Nov 2021 16:35:18 +0600
Subject: [PATCH 4/4] fix values naming

---
 terraform/layer2-k8s/eks-ingress-nginx-controller.tf | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/terraform/layer2-k8s/eks-ingress-nginx-controller.tf b/terraform/layer2-k8s/eks-ingress-nginx-controller.tf
index 8d1ad80c..c16c3235 100644
--- a/terraform/layer2-k8s/eks-ingress-nginx-controller.tf
+++ b/terraform/layer2-k8s/eks-ingress-nginx-controller.tf
@@ -7,8 +7,8 @@ locals {
     chart_version = local.helm_releases[index(local.helm_releases.*.id, "ingress-nginx")].chart_version
     namespace     = local.helm_releases[index(local.helm_releases.*.id, "ingress-nginx")].namespace
   }
-  ssl_certificate_arn          = var.nginx_ingress_ssl_terminator == "lb" ? data.terraform_remote_state.layer1-aws.outputs.ssl_certificate_arn : "ssl-certificate"
-  ingress_nginx_general_values = <<VALUES
+  ssl_certificate_arn                         = var.nginx_ingress_ssl_terminator == "lb" ? data.terraform_remote_state.layer1-aws.outputs.ssl_certificate_arn : "ssl-certificate"
+  ingress_nginx_general_values                = <<VALUES
 rbac:
   create: true
 controller:
@@ -31,7 +31,7 @@ controller:
             values:
               - ON_DEMAND
 VALUES
-  ingress_nginx_l7_values      = <<VALUES
+  ingress_loadbalancer_ssl_termination_values = <<VALUES
 controller:
   service:
     targetPorts:
@@ -51,7 +51,7 @@ controller:
     use-forwarded-headers: "true"
     set-real-ip-from: "${local.vpc_cidr}"
 VALUES
-  ingress_nginx_l4_values      = <<VALUES
+  ingress_pod_ssl_termination_values          = <<VALUES
 controller:
   extraArgs:
     default-ssl-certificate: "${local.ingress_nginx.enabled ? module.ingress_nginx_namespace[0].name : "default"}/nginx-tls"
@@ -224,7 +224,7 @@ resource "helm_release" "ingress_nginx" {
 
   values = [
     local.ingress_nginx_general_values,
-    var.nginx_ingress_ssl_terminator == "lb" ? local.ingress_nginx_l7_values : local.ingress_nginx_l4_values
+    var.nginx_ingress_ssl_terminator == "lb" ? local.ingress_loadbalancer_ssl_termination_values : local.ingress_pod_ssl_termination_values
   ]
 
   depends_on = [helm_release.prometheus_operator]