awsAlbController.ts

import * as aws from "@pulumi/aws"
import * as eks from "@pulumi/eks"
import * as k8s from "@pulumi/kubernetes"
import * as pulumi from "@pulumi/pulumi"

const ignoreChangesTransformation = (
  resource: pulumi.ResourceTransformationArgs,
  ignorePropertyNames: string[]
): pulumi.ResourceTransformationResult => ({
  props: resource.props,
  opts: pulumi.mergeOptions(resource.opts, {
    ignoreChanges: ignorePropertyNames,
  }),
})

const deployAwsAlbController = (cluster: eks.Cluster) => {
  pulumi.log.info(
    `aws-load-balancer-controller transformation: Will ignore changes to TLS certificate on subsequent "pulumi up".`
  )

  const albChart = new k8s.helm.v3.Chart(
    "alb",
    {
      chart: "aws-load-balancer-controller",
      version: "1.2.0",
      namespace: "default",
      fetchOpts: {
        repo: "https://aws.github.io/eks-charts",
      },
      values: {
        clusterName: cluster.eksCluster.name,
        autoDiscoverAwsRegion: "true",
        autoDiscoverAwsVpcID: "true",
        logLevel: "debug",
      },
    },
    {
      provider: cluster.provider,
      transformations: [
        // Don't deploy any changes to the ALB controller's TLS cert. Without
        // this transformation, pulumi would cause the cert to update due to
        // pulumi running `helm template` to deploy charts. The generation
        // functions for the cert would run again.
        (args) => {
          if (
            args.type === "kubernetes:core/v1:Secret" &&
            args.name === "default/aws-load-balancer-tls"
          ) {
            return ignoreChangesTransformation(args, ["data"])
          } else if (
            args.name === "aws-load-balancer-webhook" &&
            (args.type ===
              "kubernetes:admissionregistration.k8s.io/v1:ValidatingWebhookConfiguration" ||
              args.type ===
                "kubernetes:admissionregistration.k8s.io/v1:MutatingWebhookConfiguration")
          ) {
            return ignoreChangesTransformation(args, [
              "webhooks[0].clientConfig.caBundle",
              "webhooks[1].clientConfig.caBundle",
            ])
          }

          return
        },
      ],
    }
  )

  const ingressControllerPolicy = new aws.iam.Policy(
    "ingressController-iam-policy",
    {
      policy: {
        Version: "2012-10-17",
        Statement: [
          {
            Effect: "Allow",
            Action: [
              "iam:CreateServiceLinkedRole",
              "ec2:DescribeAccountAttributes",
              "ec2:DescribeAddresses",
              "ec2:DescribeAvailabilityZones",
              "ec2:DescribeInternetGateways",
              "ec2:DescribeVpcs",
              "ec2:DescribeSubnets",
              "ec2:DescribeSecurityGroups",
              "ec2:DescribeInstances",
              "ec2:DescribeNetworkInterfaces",
              "ec2:DescribeTags",
              "ec2:GetCoipPoolUsage",
              "ec2:DescribeCoipPools",
              "elasticloadbalancing:DescribeLoadBalancers",
              "elasticloadbalancing:DescribeLoadBalancerAttributes",
              "elasticloadbalancing:DescribeListeners",
              "elasticloadbalancing:DescribeListenerCertificates",
              "elasticloadbalancing:DescribeSSLPolicies",
              "elasticloadbalancing:DescribeRules",
              "elasticloadbalancing:DescribeTargetGroups",
              "elasticloadbalancing:DescribeTargetGroupAttributes",
              "elasticloadbalancing:DescribeTargetHealth",
              "elasticloadbalancing:DescribeTags",
            ],
            Resource: "*",
          },
          {
            Effect: "Allow",
            Action: [
              "cognito-idp:DescribeUserPoolClient",
              "acm:ListCertificates",
              "acm:DescribeCertificate",
              "iam:ListServerCertificates",
              "iam:GetServerCertificate",
              "waf-regional:GetWebACL",
              "waf-regional:GetWebACLForResource",
              "waf-regional:AssociateWebACL",
              "waf-regional:DisassociateWebACL",
              "wafv2:GetWebACL",
              "wafv2:GetWebACLForResource",
              "wafv2:AssociateWebACL",
              "wafv2:DisassociateWebACL",
              "shield:GetSubscriptionState",
              "shield:DescribeProtection",
              "shield:CreateProtection",
              "shield:DeleteProtection",
            ],
            Resource: "*",
          },
          {
            Effect: "Allow",
            Action: [
              "ec2:AuthorizeSecurityGroupIngress",
              "ec2:RevokeSecurityGroupIngress",
            ],
            Resource: "*",
          },
          {
            Effect: "Allow",
            Action: ["ec2:CreateSecurityGroup"],
            Resource: "*",
          },
          {
            Effect: "Allow",
            Action: ["ec2:CreateTags"],
            Resource: "arn:aws:ec2:*:*:security-group/*",
            Condition: {
              StringEquals: {
                "ec2:CreateAction": "CreateSecurityGroup",
              },
              Null: {
                "aws:RequestTag/elbv2.k8s.aws/cluster": "false",
              },
            },
          },
          {
            Effect: "Allow",
            Action: ["ec2:CreateTags", "ec2:DeleteTags"],
            Resource: "arn:aws:ec2:*:*:security-group/*",
            Condition: {
              Null: {
                "aws:RequestTag/elbv2.k8s.aws/cluster": "true",
                "aws:ResourceTag/elbv2.k8s.aws/cluster": "false",
              },
            },
          },
          {
            Effect: "Allow",
            Action: [
              "ec2:AuthorizeSecurityGroupIngress",
              "ec2:RevokeSecurityGroupIngress",
              "ec2:DeleteSecurityGroup",
            ],
            Resource: "*",
            Condition: {
              Null: {
                "aws:ResourceTag/elbv2.k8s.aws/cluster": "false",
              },
            },
          },
          {
            Effect: "Allow",
            Action: [
              "elasticloadbalancing:CreateLoadBalancer",
              "elasticloadbalancing:CreateTargetGroup",
            ],
            Resource: "*",
            Condition: {
              Null: {
                "aws:RequestTag/elbv2.k8s.aws/cluster": "false",
              },
            },
          },
          {
            Effect: "Allow",
            Action: [
              "elasticloadbalancing:CreateListener",
              "elasticloadbalancing:DeleteListener",
              "elasticloadbalancing:CreateRule",
              "elasticloadbalancing:DeleteRule",
            ],
            Resource: "*",
          },
          {
            Effect: "Allow",
            Action: [
              "elasticloadbalancing:AddTags",
              "elasticloadbalancing:RemoveTags",
            ],
            Resource: [
              "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
              "arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*",
              "arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*",
            ],
            Condition: {
              Null: {
                "aws:RequestTag/elbv2.k8s.aws/cluster": "true",
                "aws:ResourceTag/elbv2.k8s.aws/cluster": "false",
              },
            },
          },
          {
            Effect: "Allow",
            Action: [
              "elasticloadbalancing:AddTags",
              "elasticloadbalancing:RemoveTags",
            ],
            Resource: [
              "arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*",
              "arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*",
              "arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*",
              "arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*",
            ],
          },
          {
            Effect: "Allow",
            Action: [
              "elasticloadbalancing:ModifyLoadBalancerAttributes",
              "elasticloadbalancing:SetIpAddressType",
              "elasticloadbalancing:SetSecurityGroups",
              "elasticloadbalancing:SetSubnets",
              "elasticloadbalancing:DeleteLoadBalancer",
              "elasticloadbalancing:ModifyTargetGroup",
              "elasticloadbalancing:ModifyTargetGroupAttributes",
              "elasticloadbalancing:DeleteTargetGroup",
            ],
            Resource: "*",
            Condition: {
              Null: {
                "aws:ResourceTag/elbv2.k8s.aws/cluster": "false",
              },
            },
          },
          {
            Effect: "Allow",
            Action: [
              "elasticloadbalancing:RegisterTargets",
              "elasticloadbalancing:DeregisterTargets",
            ],
            Resource: "arn:aws:elasticloadbalancing:*:*:targetgroup/*/*",
          },
          {
            Effect: "Allow",
            Action: [
              "elasticloadbalancing:SetWebAcl",
              "elasticloadbalancing:ModifyListener",
              "elasticloadbalancing:AddListenerCertificates",
              "elasticloadbalancing:RemoveListenerCertificates",
              "elasticloadbalancing:ModifyRule",
            ],
            Resource: "*",
          },
          {
            Effect: "Allow",
            Action: [
              "kinesis:PutRecords",
              "firehose:PutRecordBatch",
              "logs:CreateLogGroup",
              "logs:CreateLogStream",
              "logs:PutLogEvents",
              "logs:DescribeLogStreams",
            ],
            Resource: "*",
          },
        ],
      },
    }
  )

  // Attach this policy to the NodeInstanceRole of the worker nodes.
  new aws.iam.RolePolicyAttachment("eks-NodeInstanceRole-policy-attach", {
    policyArn: ingressControllerPolicy.arn,
    role: cluster.instanceRoles.apply((roles) => roles[0].name),
  })

  return albChart
}

export default deployAwsAlbController