vector-eks-s3-opensearch/vector_agent.tf at main · Perun-Engineering/vector-eks-s3-opensearch · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
locals {
  default_agent_config = <<EOF
customConfig:
  data_dir: /vector-data-dir
  api:
    enabled: true
    address: 127.0.0.1:8686
    playground: false
  sources:
    kubernetes_logs:
      type: kubernetes_logs
      self_node_name: $${VECTOR_SELF_NODE_NAME:-unspecified}
    # internal_metrics:
    #   type: internal_metrics
  transforms:
    added_cluster_name:
      type: remap
      inputs:
        - kubernetes_logs
      source: |
        .kubernetes.cluster_name = "${var.eks_cluster_name}"
  sinks:
    s3:
      inputs:
        - added_cluster_name
      type: aws_s3
      region: "${data.aws_region.current.id}"
      bucket: "${module.vector_s3_bucket.s3_bucket_id}"
      key_prefix: date=%Y-%m-%d/
      encoding:
        codec: json

tolerations:
  - effect: NoSchedule
    operator: Exists

# avoid Fargate nodes, we can't deploy DaemonSets there
affinity:
  nodeAffinity:
    requiredDuringSchedulingIgnoredDuringExecution:
      nodeSelectorTerms:
      - matchExpressions:
        - key: eks.amazonaws.com/compute-type
          operator: NotIn
          values:
           - "fargate"
EOF

  default_agent_template_vairables = {
    region       = data.aws_region.current.id,
    bucket       = module.vector_s3_bucket.s3_bucket_id
    cluster_name = var.eks_cluster_name
  }

  custom_agent_config = var.agent_template_filename != null ? templatefile(var.agent_template_filename, merge(local.default_agent_template_vairables, var.agent_template_variables)) : local.default_agent_config

  agent_values = {
    role = "Agent"
    serviceAccount = {
      annotations = {
        "eks.amazonaws.com/role-arn" = module.vector_agent_role.arn
      }
    }
  }
}

data "utils_deep_merge_yaml" "values_agent_merged" {
  input = [
    local.custom_agent_config,
    yamlencode(local.agent_values),
    yamlencode(try(var.agent_values_override, {}))
  ]
}

resource "helm_release" "vector_agent" {
  name             = "vector-agent"
  chart            = local.helm_chart_config.chart
  repository       = local.helm_chart_config.repository
  version          = local.helm_chart_config.version
  namespace        = local.helm_chart_config.namespace
  create_namespace = local.helm_chart_config.create_namespace

  values = [data.utils_deep_merge_yaml.values_agent_merged.output]
}

data "aws_iam_policy_document" "vector_agent" {
  statement {
    actions = [
      "s3:ListBucket"
    ]
    resources = [
      module.vector_s3_bucket.s3_bucket_arn,
    ]
    effect = "Allow"
  }

  statement {
    actions = [
      "s3:PutObject"
    ]
    resources = [
      "${module.vector_s3_bucket.s3_bucket_arn}/*"
    ]
    effect = "Allow"
  }
}

resource "aws_iam_policy" "vector_agent" {
  name        = "${data.aws_eks_cluster.eks.id}-vector-agent"
  path        = "/"
  description = "Policy for vector agent pod."

  policy = data.aws_iam_policy_document.vector_agent.json
  tags   = var.tags
}

module "vector_agent_role" {
  source  = "terraform-aws-modules/iam/aws//modules/iam-role"
  version = "6.2.3"

  name        = "${data.aws_eks_cluster.eks.name}-vector-agent"
  description = "Vector Agent IRSA"

  # Enable OIDC provider trust
  enable_oidc        = true
  oidc_provider_urls = [replace(data.aws_eks_cluster.eks.identity[0].oidc[0].issuer, "https://", "")]
  oidc_subjects      = ["system:serviceaccount:${local.helm_chart_config.namespace}:vector-agent"]
  oidc_audiences     = ["sts.amazonaws.com"]

  # Attach policies
  policies = {
    vector_agent = aws_iam_policy.vector_agent.arn
  }

  tags = var.tags
}