Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

APC Patching #8657

Merged
merged 11 commits into from
Nov 18, 2024
Merged

APC Patching #8657

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
24c043c
maintenance
Emterry Nov 13, 2024
357d2ef
update rest of addons
Emterry Nov 14, 2024
e95332c
add bottlerocket and helm patching
Emterry Nov 14, 2024
def7a55
Revert BR
jacobwoffenden Nov 14, 2024
1187fed
testing expireAfter
jacobwoffenden Nov 14, 2024
a87396d
Revert the revert
jacobwoffenden Nov 14, 2024
ea876d8
Add spec.disruption.budgets
jacobwoffenden Nov 14, 2024
d40f668
Update kube-proxy and EFS CSI
jacobwoffenden Nov 14, 2024
38ae704
Update VPC CNI version
jacobwoffenden Nov 14, 2024
3c111fc
Update Prometheus
jacobwoffenden Nov 18, 2024
71110b2
Update test and prod
jacobwoffenden Nov 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions terraform/environments/analytical-platform-compute/eks-cluster.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ module "eks" {
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions

source = "terraform-aws-modules/eks/aws"
version = "20.26.0"
version = "20.29.0"

cluster_name = local.eks_cluster_name
cluster_version = local.environment_configuration.eks_cluster_version
Expand Down Expand Up @@ -172,7 +172,7 @@ module "karpenter" {
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions

source = "terraform-aws-modules/eks/aws//modules/karpenter"
version = "20.26.0"
version = "20.29.0"

cluster_name = module.eks.cluster_name

Expand Down
2 changes: 1 addition & 1 deletion terraform/environments/analytical-platform-compute/eks-pod-identities.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ module "aws_cloudwatch_metrics_pod_identity" {
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions

source = "terraform-aws-modules/eks-pod-identity/aws"
version = "1.5.0"
version = "1.7.0"

name = "aws-cloudwatch-metrics"

Expand Down
36 changes: 18 additions & 18 deletions terraform/environments/analytical-platform-compute/environment-configuration.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,15 +27,15 @@ locals {
/* EKS */
eks_sso_access_role = "modernisation-platform-sandbox"
eks_cluster_version = "1.31"
eks_node_version = "1.25.0-388e1050"
eks_node_version = "1.26.2-360b7a38"
eks_cluster_addon_versions = {
coredns = "v1.11.3-eksbuild.1"
kube_proxy = "v1.31.0-eksbuild.5"
aws_ebs_csi_driver = "v1.35.0-eksbuild.1"
aws_efs_csi_driver = "v2.0.7-eksbuild.1"
coredns = "v1.11.3-eksbuild.2"
kube_proxy = "v1.31.2-eksbuild.2"
aws_ebs_csi_driver = "v1.36.0-eksbuild.1"
aws_efs_csi_driver = "v2.0.9-eksbuild.1"
aws_guardduty_agent = "v1.7.1-eksbuild.2"
eks_pod_identity_agent = "v1.3.2-eksbuild.2"
vpc_cni = "v1.18.5-eksbuild.1"
vpc_cni = "v1.19.0-eksbuild.1"
}

/* Data Engineering Airflow */
Expand Down Expand Up @@ -78,15 +78,15 @@ locals {
/* EKS */
eks_sso_access_role = "modernisation-platform-developer"
eks_cluster_version = "1.31"
eks_node_version = "1.25.0-388e1050"
eks_node_version = "1.26.2-360b7a38"
eks_cluster_addon_versions = {
coredns = "v1.11.3-eksbuild.1"
kube_proxy = "v1.31.0-eksbuild.5"
aws_ebs_csi_driver = "v1.35.0-eksbuild.1"
aws_efs_csi_driver = "v2.0.7-eksbuild.1"
coredns = "v1.11.3-eksbuild.2"
kube_proxy = "v1.31.2-eksbuild.2"
aws_ebs_csi_driver = "v1.36.0-eksbuild.1"
aws_efs_csi_driver = "v2.0.9-eksbuild.1"
aws_guardduty_agent = "v1.7.1-eksbuild.2"
eks_pod_identity_agent = "v1.3.2-eksbuild.2"
vpc_cni = "v1.18.5-eksbuild.1"
vpc_cni = "v1.19.0-eksbuild.1"
}

/* Observability Platform */
Expand Down Expand Up @@ -128,15 +128,15 @@ locals {
/* EKS */
eks_sso_access_role = "modernisation-platform-developer"
eks_cluster_version = "1.31"
eks_node_version = "1.25.0-388e1050"
eks_node_version = "1.26.2-360b7a38"
eks_cluster_addon_versions = {
coredns = "v1.11.3-eksbuild.1"
kube_proxy = "v1.31.0-eksbuild.5"
aws_ebs_csi_driver = "v1.35.0-eksbuild.1"
aws_efs_csi_driver = "v2.0.7-eksbuild.1"
coredns = "v1.11.3-eksbuild.2"
kube_proxy = "v1.31.2-eksbuild.2"
aws_ebs_csi_driver = "v1.36.0-eksbuild.1"
aws_efs_csi_driver = "v2.0.9-eksbuild.1"
aws_guardduty_agent = "v1.7.1-eksbuild.2"
eks_pod_identity_agent = "v1.3.2-eksbuild.2"
vpc_cni = "v1.18.5-eksbuild.1"
vpc_cni = "v1.19.0-eksbuild.1"
}

/* Data Engineering Airflow */
Expand Down
14 changes: 7 additions & 7 deletions terraform/environments/analytical-platform-compute/helm-charts-system.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ resource "helm_release" "kyverno" {
name = "kyverno"
repository = "https://kyverno.github.io/kyverno"
chart = "kyverno"
version = "3.2.7"
version = "3.3.3"
namespace = kubernetes_namespace.kyverno.metadata[0].name
values = [
templatefile(
Expand Down Expand Up @@ -71,7 +71,7 @@ resource "helm_release" "amazon_prometheus_proxy" {
name = "amazon-prometheus-proxy"
repository = "https://prometheus-community.github.io/helm-charts"
chart = "kube-prometheus-stack"
version = "65.2.0"
version = "66.2.1"
namespace = kubernetes_namespace.aws_observability.metadata[0].name
values = [
templatefile(
Expand All @@ -96,7 +96,7 @@ resource "helm_release" "cluster_autoscaler" {
name = "cluster-autoscaler"
repository = "https://kubernetes.github.io/autoscaler"
chart = "cluster-autoscaler"
version = "9.43.0"
version = "9.43.2"
namespace = kubernetes_namespace.cluster_autoscaler.metadata[0].name

values = [
Expand All @@ -119,7 +119,7 @@ resource "helm_release" "karpenter_crd" {
name = "karpenter-crd"
repository = "oci://public.ecr.aws/karpenter"
chart = "karpenter-crd"
version = "1.0.6"
version = "1.0.8"
namespace = kubernetes_namespace.karpenter.metadata[0].name

values = [
Expand All @@ -141,7 +141,7 @@ resource "helm_release" "karpenter" {
name = "karpenter"
repository = "oci://public.ecr.aws/karpenter"
chart = "karpenter"
version = "1.0.6"
version = "1.0.8"
namespace = kubernetes_namespace.karpenter.metadata[0].name

values = [
Expand Down Expand Up @@ -283,7 +283,7 @@ resource "helm_release" "external_secrets" {
name = "external-secrets"
repository = "https://charts.external-secrets.io"
chart = "external-secrets"
version = "0.10.4"
version = "0.10.5"
namespace = kubernetes_namespace.external_secrets.metadata[0].name
values = [
templatefile(
Expand All @@ -310,7 +310,7 @@ resource "helm_release" "keda" {
name = "keda"
repository = "https://kedacore.github.io/charts"
chart = "keda"
version = "2.15.1"
version = "2.16.0"
namespace = kubernetes_namespace.keda.metadata[0].name
values = [
templatefile(
Expand Down
16 changes: 8 additions & 8 deletions terraform/environments/analytical-platform-compute/iam-policies.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ module "eks_cluster_logs_kms_access_iam_policy" {
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions

source = "terraform-aws-modules/iam/aws//modules/iam-policy"
version = "5.46.0"
version = "5.48.0"

name_prefix = "eks-cluster-logs-kms-access"

Expand All @@ -45,7 +45,7 @@ module "karpenter_sqs_kms_access_iam_policy" {
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions

source = "terraform-aws-modules/iam/aws//modules/iam-policy"
version = "5.46.0"
version = "5.48.0"

name_prefix = "karpenter-sqs-kms-access"

Expand All @@ -71,7 +71,7 @@ module "amazon_prometheus_proxy_iam_policy" {
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions

source = "terraform-aws-modules/iam/aws//modules/iam-policy"
version = "5.46.0"
version = "5.48.0"

name_prefix = "amazon-prometheus-proxy"

Expand All @@ -98,7 +98,7 @@ module "managed_prometheus_kms_access_iam_policy" {
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions

source = "terraform-aws-modules/iam/aws//modules/iam-policy"
version = "5.46.0"
version = "5.48.0"

name_prefix = "managed-prometheus-kms-access"

Expand Down Expand Up @@ -147,7 +147,7 @@ module "mlflow_iam_policy" {
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions

source = "terraform-aws-modules/iam/aws//modules/iam-policy"
version = "5.46.0"
version = "5.48.0"

name_prefix = "mlflow"

Expand All @@ -168,7 +168,7 @@ module "gha_mojas_airflow_iam_policy" {
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions

source = "terraform-aws-modules/iam/aws//modules/iam-policy"
version = "5.46.0"
version = "5.48.0"

name_prefix = "github-actions-mojas-airflow"

Expand Down Expand Up @@ -258,7 +258,7 @@ module "analytical_platform_lake_formation_share_policy" {
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions

source = "terraform-aws-modules/iam/aws//modules/iam-policy"
version = "5.46.0"
version = "5.48.0"

name_prefix = "analytical-platform-lake-formation-sharing-policy"

Expand Down Expand Up @@ -290,7 +290,7 @@ module "quicksight_vpc_connection_iam_policy" {
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions

source = "terraform-aws-modules/iam/aws//modules/iam-policy"
version = "5.46.0"
version = "5.48.0"

name_prefix = "quicksight-vpc-connection"

Expand Down
32 changes: 16 additions & 16 deletions terraform/environments/analytical-platform-compute/iam-roles.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ module "vpc_cni_iam_role" {
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions

source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
version = "5.46.0"
version = "5.48.0"

role_name_prefix = "vpc-cni"
attach_vpc_cni_policy = true
Expand All @@ -24,7 +24,7 @@ module "ebs_csi_driver_iam_role" {
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions

source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
version = "5.46.0"
version = "5.48.0"

role_name_prefix = "ebs-csi-driver"
attach_ebs_csi_policy = true
Expand All @@ -44,7 +44,7 @@ module "efs_csi_driver_iam_role" {
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions

source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
version = "5.46.0"
version = "5.48.0"

role_name_prefix = "efs-csi-driver"
attach_efs_csi_policy = true
Expand All @@ -64,7 +64,7 @@ module "aws_for_fluent_bit_iam_role" {
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions

source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
version = "5.46.0"
version = "5.48.0"

role_name_prefix = "aws-for-fluent-bit"

Expand All @@ -88,7 +88,7 @@ module "amazon_prometheus_proxy_iam_role" {
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions

source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
version = "5.46.0"
version = "5.48.0"

role_name_prefix = "amazon-prometheus-proxy"

Expand All @@ -111,7 +111,7 @@ module "cluster_autoscaler_iam_role" {
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions

source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
version = "5.46.0"
version = "5.48.0"

role_name_prefix = "cluster-autoscaler"

Expand All @@ -133,7 +133,7 @@ module "external_dns_iam_role" {
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions

source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
version = "5.46.0"
version = "5.48.0"

role_name_prefix = "external-dns"
attach_external_dns_policy = true
Expand All @@ -154,7 +154,7 @@ module "cert_manager_iam_role" {
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions

source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
version = "5.46.0"
version = "5.48.0"

role_name_prefix = "cert-manager"
attach_cert_manager_policy = true
Expand All @@ -175,7 +175,7 @@ module "external_secrets_iam_role" {
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions

source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
version = "5.46.0"
version = "5.48.0"

role_name_prefix = "external-secrets"
attach_external_secrets_policy = true
Expand All @@ -196,7 +196,7 @@ module "mlflow_iam_role" {
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions

source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
version = "5.46.0"
version = "5.48.0"

role_name_prefix = "mlflow"

Expand All @@ -219,7 +219,7 @@ module "gha_mojas_airflow_iam_role" {
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions

source = "terraform-aws-modules/iam/aws//modules/iam-github-oidc-role"
version = "5.46.0"
version = "5.48.0"

name = "github-actions-mojas-airflow"

Expand All @@ -237,7 +237,7 @@ module "lake_formation_share_role" {
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions

source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role"
version = "5.46.0"
version = "5.48.0"

create_role = true
role_requires_mfa = false
Expand All @@ -264,7 +264,7 @@ module "analytical_platform_ui_service_role" {
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions

source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks"
version = "5.46.0"
version = "5.48.0"

create_role = true

Expand All @@ -287,7 +287,7 @@ module "analytical_platform_control_panel_service_role" {
#checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role"
version = "5.46.0"
version = "5.48.0"

allow_self_assume_role = true
trusted_role_arns = [
Expand All @@ -310,7 +310,7 @@ module "analytical_platform_data_eng_dba_service_role" {
#checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
#checkov:skip=CKV_TF_2:Module registry does not support tags for versions
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role"
version = "5.46.0"
version = "5.48.0"

allow_self_assume_role = false
trusted_role_arns = formatlist("arn:aws:iam::%s:root", [local.environment_management.account_ids[local.analytical_platform_environment], local.environment_management.account_ids["analytical-platform-management-production"]])
Expand All @@ -330,7 +330,7 @@ module "quicksight_vpc_connection_iam_role" {
#checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions

source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role"
version = "5.46.0"
version = "5.48.0"

create_role = true
role_name_prefix = "quicksight-vpc-connection"
Expand Down
2 changes: 1 addition & 1 deletion terraform/environments/analytical-platform-compute/locals.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ locals {
eks_cloudwatch_log_group_retention_in_days = 400

/* Kube Prometheus Stack */
prometheus_operator_crd_version = "v0.77.1"
prometheus_operator_crd_version = "v0.78.1"

/* Mapping Analytical Platform Environments to Modernisation Platform */

Expand Down
Loading