More CIDR restrictions fixes

niallthomson · niallthomson · commit cf2b660ae254 · 2026-05-04T22:37:47.000Z
diff --git a/manifests/modules/automation/continuousdelivery/codepipeline/.workshop/terraform/main.tf b/manifests/modules/automation/continuousdelivery/codepipeline/.workshop/terraform/main.tf
@@ -316,10 +316,11 @@ resource "kubernetes_manifest" "ui_alb" {
         "alb.ingress.kubernetes.io/scheme"           = "internet-facing"
         "alb.ingress.kubernetes.io/target-type"      = "ip"
         "alb.ingress.kubernetes.io/healthcheck-path" = "/actuator/health/liveness"
+        "alb.ingress.kubernetes.io/inbound-cidrs"    = var.inbound_cidrs
       }
     }
     "spec" = {
-      ingressClassName = "alb",
+      "ingressClassName" = "alb",
       "rules" = [{
         "http" = {
           paths = [{
diff --git a/manifests/modules/automation/controlplanes/kro/.workshop/terraform/main.tf b/manifests/modules/automation/controlplanes/kro/.workshop/terraform/main.tf
@@ -67,10 +67,11 @@ resource "kubernetes_manifest" "ui_alb" {
         "alb.ingress.kubernetes.io/scheme"           = "internet-facing"
         "alb.ingress.kubernetes.io/target-type"      = "ip"
         "alb.ingress.kubernetes.io/healthcheck-path" = "/actuator/health/liveness"
+        "alb.ingress.kubernetes.io/inbound-cidrs"    = var.inbound_cidrs
       }
     }
     "spec" = {
-      ingressClassName = "alb",
+      "ingressClassName" = "alb",
       "rules" = [{
         "http" = {
           paths = [{
diff --git a/manifests/modules/automation/controlplanes/kro/.workshop/terraform/templates/nlb.yaml b/manifests/modules/automation/controlplanes/kro/.workshop/terraform/templates/nlb.yaml
diff --git a/manifests/modules/automation/controlplanes/kro/app/carts-ddb.yaml b/manifests/modules/automation/controlplanes/kro/app/carts-ddb.yaml
@@ -18,5 +18,5 @@ spec:
     RETAIL_CART_PERSISTENCE_DYNAMODB_TABLE_NAME: "eks-workshop-carts-kro"
 
   aws:
-    accountID: ${AWS_ACCOUNT_ID}
+    accountID: "${AWS_ACCOUNT_ID}"
     region: ${AWS_REGION}
diff --git a/manifests/modules/automation/controlplanes/kro/rgds/webapp-dynamodb-rgd.yaml b/manifests/modules/automation/controlplanes/kro/rgds/webapp-dynamodb-rgd.yaml
@@ -37,142 +37,142 @@ spec:
         groupname: string | default="eks-workshop"
 
   resources:
-  - id: podIdentityAssociation
-    template:
-      apiVersion: eks.services.k8s.aws/v1alpha1
-      kind: PodIdentityAssociation
-      metadata:
-        name: ${schema.spec.appName}
-        namespace: ${schema.spec.appName}
-      spec:
-        clusterName: "eks-workshop"
-        namespace: ${schema.spec.appName}
-        serviceAccount: ${schema.spec.appName}
-        roleARN: ${itemsTableIAMRole.status.ackResourceMetadata.arn}
+    - id: podIdentityAssociation
+      template:
+        apiVersion: eks.services.k8s.aws/v1alpha1
+        kind: PodIdentityAssociation
+        metadata:
+          name: ${schema.spec.appName}
+          namespace: ${schema.spec.appName}
+        spec:
+          clusterName: "eks-workshop"
+          namespace: ${schema.spec.appName}
+          serviceAccount: ${schema.spec.appName}
+          roleARN: ${itemsTableIAMRole.status.ackResourceMetadata.arn}
 
-  - id: webApplication
-    template:
-      apiVersion: kro.run/v1alpha1
-      kind: WebApplication
-      metadata:
-        name: ${schema.spec.appName}
-        namespace: ${schema.spec.appName}
-      spec:
-        appName: ${schema.spec.appName}
-        replicas: 1
-        image: ${schema.spec.image}
-        port: 8080
-        healthcheck:
-          readinessPath: ${schema.spec.healthcheck.readinessPath}
-          readinessPort: ${schema.spec.healthcheck.readinessPort}
-          livenessPath: ${schema.spec.healthcheck.livenessPath}
-          livenessPort: ${schema.spec.healthcheck.livenessPort}
+    - id: webApplication
+      template:
+        apiVersion: kro.run/v1alpha1
+        kind: WebApplication
+        metadata:
+          name: ${schema.spec.appName}
+          namespace: ${schema.spec.appName}
+        spec:
+          appName: ${schema.spec.appName}
+          replicas: 1
+          image: ${schema.spec.image}
+          port: 8080
+          healthcheck:
+            readinessPath: ${schema.spec.healthcheck.readinessPath}
+            readinessPort: ${schema.spec.healthcheck.readinessPort}
+            livenessPath: ${schema.spec.healthcheck.livenessPath}
+            livenessPort: ${schema.spec.healthcheck.livenessPort}
 
-        service:
-          enabled: ${schema.spec.service.enabled}
-          iamRole: ${podIdentityAssociation.status.ackResourceMetadata.arn}
+          service:
+            enabled: ${schema.spec.service.enabled}
+            iamRole: ${podIdentityAssociation.status.ackResourceMetadata.arn}
 
-        env: ${schema.spec.env}
+          env: ${schema.spec.env}
 
-        ingress:
-          enabled: ${schema.spec.ingress.enabled}
-          path: ${schema.spec.ingress.path}
-          healthcheckPath: ${schema.spec.ingress.healthcheckPath}
-          groupname: ${schema.spec.ingress.groupname}
+          ingress:
+            enabled: ${schema.spec.ingress.enabled}
+            path: ${schema.spec.ingress.path}
+            healthcheckPath: ${schema.spec.ingress.healthcheckPath}
+            groupname: ${schema.spec.ingress.groupname}
 
-  - id: serviceDDB
-    template:
-      apiVersion: v1
-      kind: Service
-      metadata:
-        name: carts-dynamodb
-        labels:
-          app.kubernetes.io/created-by: eks-workshop
-      spec:
-        type: ClusterIP
-        ports:
-        - port: 8000
-          targetPort: dynamodb
-          protocol: TCP
-          name: dynamodb
-        selector:
-          app.kubernetes.io/name: ${schema.spec.appName}
-          app.kubernetes.io/instance: ${schema.spec.appName}
-          app.kubernetes.io/component: dynamodb
+    - id: serviceDDB
+      template:
+        apiVersion: v1
+        kind: Service
+        metadata:
+          name: carts-dynamodb
+          labels:
+            app.kubernetes.io/created-by: eks-workshop
+        spec:
+          type: ClusterIP
+          ports:
+            - port: 8000
+              targetPort: dynamodb
+              protocol: TCP
+              name: dynamodb
+          selector:
+            app.kubernetes.io/name: ${schema.spec.appName}
+            app.kubernetes.io/instance: ${schema.spec.appName}
+            app.kubernetes.io/component: dynamodb
 
-  - id: itemsTable
-    template:
-      apiVersion: dynamodb.services.k8s.aws/v1alpha1
-      kind: Table
-      metadata:
-        name: items
-        namespace: ${schema.spec.appName}
-      spec:
-        keySchema:
-        - attributeName: id
-          keyType: HASH
-        attributeDefinitions:
-        - attributeName: id
-          attributeType: "S"
-        - attributeName: customerId
-          attributeType: "S"
-        billingMode: PAY_PER_REQUEST
-        tableName: ${schema.spec.dynamodb.tableName}
-        globalSecondaryIndexes:
-        - indexName: idx_global_customerId
+    - id: itemsTable
+      template:
+        apiVersion: dynamodb.services.k8s.aws/v1alpha1
+        kind: Table
+        metadata:
+          name: items
+          namespace: ${schema.spec.appName}
+        spec:
           keySchema:
-          - attributeName: customerId
-            keyType: HASH
-          - attributeName: id
-            keyType: RANGE
-          projection:
-            projectionType: "ALL"
-  - id: itemsTableIamPolicy
-    template:
-      apiVersion: iam.services.k8s.aws/v1alpha1
-      kind: Policy
-      metadata:
-        name: ${itemsTable.spec.tableName}-iam-policy
-      spec:
-        name: ${itemsTable.spec.tableName}-iam-policy
-        description: "EKS Workshop Carts DynamoDB Policy"
-        policyDocument: >
-          {
-            "Version": "2012-10-17",
-            "Statement": [
-              {
-                "Sid": "AllAPIActionsOnCart",
-                "Effect": "Allow",
-                "Action": "dynamodb:*",
-                "Resource": [
-                  "arn:aws:dynamodb:${schema.spec.aws.region}:${schema.spec.aws.accountID}:table/${itemsTable.spec.tableName}",
-                  "arn:aws:dynamodb:${schema.spec.aws.region}:${schema.spec.aws.accountID}:table/${itemsTable.spec.tableName}/index/*"
-                ]
-              }
-            ]
-          }
-  - id: itemsTableIAMRole
-    template:
-      apiVersion: iam.services.k8s.aws/v1alpha1
-      kind: Role
-      metadata:
-        name: ${itemsTable.spec.tableName}-iam-role
-        namespace: ${schema.spec.appName}
-      spec:
-        name: ${itemsTable.spec.tableName}-iam-role
-        description: "EKS Workshop Carts DynamoDB Role"
-        maxSessionDuration: 3600
-        policies:
-        - ${itemsTableIamPolicy.status.ackResourceMetadata.arn}
-        assumeRolePolicyDocument: >
-          {
-            "Version":"2012-10-17",
-            "Statement": [{
-              "Effect":"Allow",
-              "Principal": {"Service": "pods.eks.amazonaws.com"},
-              "Action": [
-                  "sts:TagSession",
-                  "sts:AssumeRole"
+            - attributeName: id
+              keyType: HASH
+          attributeDefinitions:
+            - attributeName: id
+              attributeType: "S"
+            - attributeName: customerId
+              attributeType: "S"
+          billingMode: PAY_PER_REQUEST
+          tableName: ${schema.spec.dynamodb.tableName}
+          globalSecondaryIndexes:
+            - indexName: idx_global_customerId
+              keySchema:
+                - attributeName: customerId
+                  keyType: HASH
+                - attributeName: id
+                  keyType: RANGE
+              projection:
+                projectionType: "ALL"
+    - id: itemsTableIamPolicy
+      template:
+        apiVersion: iam.services.k8s.aws/v1alpha1
+        kind: Policy
+        metadata:
+          name: ${itemsTable.spec.tableName}-iam-policy
+        spec:
+          name: ${itemsTable.spec.tableName}-iam-policy
+          description: "EKS Workshop Carts DynamoDB Policy"
+          policyDocument: >
+            {
+              "Version": "2012-10-17",
+              "Statement": [
+                {
+                  "Sid": "AllAPIActionsOnCart",
+                  "Effect": "Allow",
+                  "Action": "dynamodb:*",
+                  "Resource": [
+                    "arn:aws:dynamodb:${schema.spec.aws.region}:${string(schema.spec.aws.accountID)}:table/${itemsTable.spec.tableName}",
+                    "arn:aws:dynamodb:${schema.spec.aws.region}:${string(schema.spec.aws.accountID)}:table/${itemsTable.spec.tableName}/index/*"
+                  ]
+                }
               ]
-            }]
-          }
+            }
+    - id: itemsTableIAMRole
+      template:
+        apiVersion: iam.services.k8s.aws/v1alpha1
+        kind: Role
+        metadata:
+          name: ${itemsTable.spec.tableName}-iam-role
+          namespace: ${schema.spec.appName}
+        spec:
+          name: ${itemsTable.spec.tableName}-iam-role
+          description: "EKS Workshop Carts DynamoDB Role"
+          maxSessionDuration: 3600
+          policies:
+            - ${itemsTableIamPolicy.status.ackResourceMetadata.arn}
+          assumeRolePolicyDocument: >
+            {
+              "Version":"2012-10-17",
+              "Statement": [{
+                "Effect":"Allow",
+                "Principal": {"Service": "pods.eks.amazonaws.com"},
+                "Action": [
+                    "sts:TagSession",
+                    "sts:AssumeRole"
+                ]
+              }]
+            }
diff --git a/manifests/modules/autoscaling/workloads/keda/.workshop/terraform/main.tf b/manifests/modules/autoscaling/workloads/keda/.workshop/terraform/main.tf
@@ -53,7 +53,7 @@ resource "kubernetes_manifest" "ui_alb" {
       }
     }
     "spec" = {
-      ingressClassName = "alb",
+      "ingressClassName" = "alb",
       "rules" = [{
         "http" = {
           paths = [{
diff --git a/manifests/modules/observability/resiliency/.workshop/terraform/main.tf b/manifests/modules/observability/resiliency/.workshop/terraform/main.tf
@@ -42,7 +42,7 @@ resource "kubernetes_manifest" "ui_alb" {
       }
     }
     "spec" = {
-      ingressClassName = "alb",
+      "ingressClassName" = "alb",
       "rules" = [{
         "http" = {
           paths = [{
diff --git a/website/docs/automation/controlplanes/kro/cloud-dynamodb.md b/website/docs/automation/controlplanes/kro/cloud-dynamodb.md
@@ -90,7 +90,7 @@ Now we can wait until the instance has reached a "synced" state:
 
 ```bash
 $ kubectl wait -o yaml webapplicationdynamodb/carts -n carts \
-  --for=condition=InstanceSynced=True --timeout=120s
+  --for=condition=ResourcesReady=True --timeout=120s
 ```
 
 To verify that the DynamoDB table has been created, we can check the generated ACK resource:
diff --git a/website/docs/automation/controlplanes/kro/provision-resources.md b/website/docs/automation/controlplanes/kro/provision-resources.md
@@ -87,7 +87,7 @@ Now we can wait until the instance has reached a "synced" state:
 
 ```bash
 $ kubectl wait -o yaml webapplication/carts -n carts \
-  --for=condition=InstanceSynced=True --timeout=120s
+  --for=condition=ResourcesReady=True --timeout=120s
 ```
 
 Next, verify the components of the RGD are running:

Original file line number	Diff line number	Diff line change
`@@ -316,10 +316,11 @@ resource "kubernetes_manifest" "ui_alb" {`
`316`	`316`	`"alb.ingress.kubernetes.io/scheme" = "internet-facing"`
`317`	`317`	`"alb.ingress.kubernetes.io/target-type" = "ip"`
`318`	`318`	`"alb.ingress.kubernetes.io/healthcheck-path" = "/actuator/health/liveness"`
	`319`	`+ "alb.ingress.kubernetes.io/inbound-cidrs" = var.inbound_cidrs`
`319`	`320`	`}`
`320`	`321`	`}`
`321`	`322`	`"spec" = {`
`322`		`- ingressClassName = "alb",`
	`323`	`+ "ingressClassName" = "alb",`
`323`	`324`	`"rules" = [{`
`324`	`325`	`"http" = {`
`325`	`326`	`paths = [{`
Original file line number	Diff line number	Diff line change
`@@ -67,10 +67,11 @@ resource "kubernetes_manifest" "ui_alb" {`
`67`	`67`	`"alb.ingress.kubernetes.io/scheme" = "internet-facing"`
`68`	`68`	`"alb.ingress.kubernetes.io/target-type" = "ip"`
`69`	`69`	`"alb.ingress.kubernetes.io/healthcheck-path" = "/actuator/health/liveness"`
	`70`	`+ "alb.ingress.kubernetes.io/inbound-cidrs" = var.inbound_cidrs`
`70`	`71`	`}`
`71`	`72`	`}`
`72`	`73`	`"spec" = {`
`73`		`- ingressClassName = "alb",`
	`74`	`+ "ingressClassName" = "alb",`
`74`	`75`	`"rules" = [{`
`75`	`76`	`"http" = {`
`76`	`77`	`paths = [{`
Original file line number	Diff line number	Diff line change
`@@ -53,7 +53,7 @@ resource "kubernetes_manifest" "ui_alb" {`
`53`	`53`	`}`
`54`	`54`	`}`
`55`	`55`	`"spec" = {`
`56`		`- ingressClassName = "alb",`
	`56`	`+ "ingressClassName" = "alb",`
`57`	`57`	`"rules" = [{`
`58`	`58`	`"http" = {`
`59`	`59`	`paths = [{`
Original file line number	Diff line number	Diff line change
`@@ -42,7 +42,7 @@ resource "kubernetes_manifest" "ui_alb" {`
`42`	`42`	`}`
`43`	`43`	`}`
`44`	`44`	`"spec" = {`
`45`		`- ingressClassName = "alb",`
	`45`	`+ "ingressClassName" = "alb",`
`46`	`46`	`"rules" = [{`
`47`	`47`	`"http" = {`
`48`	`48`	`paths = [{`