Terraform interop with service contexts
Communicate data between Terraform and Kubernetes using Service Contexts
Overview
A common and incredibly frustrating challenge with managing Kubernetes, especially at scale, is sharing state between Terraform and the common tools used to manage Kubernetes configuration, like Helm and Kustomize, or with other independent sections of Terraform code.
We've created an API called Service Contexts to facilitate this. At its core, a service context is a named bundle of configuration that can be created via the API (and thus easily integrated with Terraform or Pulumi) and mounted to Plural services, or imported as a data resource in other stacks. This guide walks you through how to use the API throughout your IaC usage.
Defining a service context
Here's a simple example that sets up an IRSA role for external-dns:
module "assumable_role_externaldns" {
source = "terraform-aws-modules/iam/aws//modules/iam-assumable-role-with-oidc"
version = "3.14.0"
create_role = true
role_name = "${var.cluster_name}-externaldns"
provider_url = replace(local.cluster_oidc_issuer_url, "https://", "")
role_policy_arns = [aws_iam_policy.externaldns.arn] # defined elsewhere
oidc_fully_qualified_subjects = ["system:serviceaccount:${var.namespace}:${var.externaldns_serviceaccount}"]
}
resource "plural_service_context" "externaldns" {
name = "externaldns"
configuration = {
roleArn = module.assumable_role_externaldns.this_iam_role_arn
}
}Using in another Plural Terraform stack
Referencing a service context in another stack is simple:
data "plural_service_context" "externaldns" {
name = "externaldns"
}
locals {
# can wire it in wherever, this is just an example
external_dns_arn = data.plural_service_context.externaldns.configuration.roleArn
}