Service Catalog Version 0.96.9

Helm Service

View SourceRelease Notes

Overview

This service contains Terraform code to deploy an arbitrary Helm chart to Kubernetes following best practices.

This module is intended to deploy third-party applications already packaged as Helm Charts, such as those available in bitnami. If you want to deploy your own application containers to Kubernetes, see the k8s-service module.

Kubernetes Service architecture

Features

• Deploy any Helm chart using Terraform
• Managed with Helm

Learn

note

This repo is a part of the Gruntwork Service Catalog, a collection of reusable, battle-tested, production ready infrastructure code. If you’ve never used the Service Catalog before, make sure to read How to use the Gruntwork Service Catalog!

Core concepts

• Kubernetes core concepts: learn about Kubernetes architecture (control plane, worker nodes), access control (authentication, authorization, resources (pods, controllers, services, config, secrets), and more.

• How do you run applications on Kubernetes?

• What is Helm?

• Kubernetes in Action: the best book we’ve found for getting up and running with Kubernetes.

Repo organization

• modules: the main implementation code for this repo, broken down into multiple standalone, orthogonal submodules.
• examples: This folder contains working examples of how to use the submodules.
• test: Automated tests for the modules and examples.

Deploy

Non-production deployment (quick start for learning)

If you just want to try this repo out for experimenting and learning, check out the following resources:

• examples/for-learning-and-testing folder: The examples/for-learning-and-testing folder contains standalone sample code optimized for learning, experimenting, and testing (but not direct production usage).

Production deployment

If you want to deploy this repo in production, check out the following resources:

• examples/for-production folder: The examples/for-production folder contains sample code optimized for direct usage in production. This is code from the Gruntwork Reference Architecture, and it shows you how we build an end-to-end, integrated tech stack on top of the Gruntwork Service Catalog.

Reference

Inputs

Required

application_namestringrequired

The name of the application (e.g. my-service-stage). Used for labeling Kubernetes resources.

helm_chartstringrequired

Chart name to be installed. The chart name can be local path, a URL to a chart, or the name of the chart if repository is specified. It is also possible to use the <repository>/<chart> format here if you are running Terraform on a system that the repository has been added to with helm repo add but this is not recommended.

helm_repositorystringrequired

Repository URL where to locate the requested chart.

namespacestringrequired

The Kubernetes Namespace to deploy the helm chart into.

Optional

eks_iam_role_for_service_accounts_configobject(…)optional

Configuration for using the IAM role with Service Accounts feature to provide permissions to the applications. This expects a map with two properties: openid_connect_provider_arn and openid_connect_provider_url. The openid_connect_provider_arn is the ARN of the OpenID Connect Provider for EKS to retrieve IAM credentials, while openid_connect_provider_url is the URL. Leave as an empty string if you do not wish to use IAM role with Service Accounts.

Type Details

object({
    openid_connect_provider_arn = string
    openid_connect_provider_url = string
  })

Default:null

helm_chart_valuesanyoptional

Map of values to pass to the Helm chart. Leave empty to use chart default values.

Type Details

Any types represent complex values of variable type. For details, please consult `variables.tf` in the source repo.

Default:{}

helm_chart_versionstringoptional

Specify the exact chart version to install. If this is not specified, the latest version is installed.

Default:null

iam_policymap(object(…))optional

An object defining the policy to attach to iam_role_name if the IAM role is going to be created. Accepts a map of objects, where the map keys are sids for IAM policy statements, and the object fields are the resources, actions, and the effect ('Allow' or 'Deny') of the statement. Ignored if iam_role_arn is provided. Leave as null if you do not wish to use IAM role with Service Accounts.

Type Details

map(object({
    resources = list(string)
    actions   = list(string)
    effect    = string
  }))

Default:null

iam_role_existsbooloptional

Whether or not the IAM role passed in iam_role_name already exists. Set to true if it exists, or false if it needs to be created. Defaults to false.

Default:false

iam_role_namestringoptional

The name of an IAM role that will be used by the pod to access the AWS API. If iam_role_exists is set to false, this role will be created. Leave as an empty string if you do not wish to use IAM role with Service Accounts.

Default:""

service_account_namestringoptional

The name of a service account to create for use with the Pods. This service account will be mapped to the IAM role defined in <a href="#iam_role_name"><code>iam_role_name</code></a> to give the pod permissions to access the AWS API. Must be unique in this namespace. Leave as an empty string if you do not wish to assign a Service Account to the Pods.

Default:""

sleep_for_resource_cullingbooloptional

Sleep for 30 seconds to allow Kubernetes time to remove associated AWS resources.

Default:false

waitbooloptional

When true, wait until Pods are up and healthy or wait_timeout seconds before exiting terraform.

Default:true

wait_timeoutnumberoptional

Number of seconds to wait for Pods to become healthy before marking the deployment as a failure.

Default:300

Outputs