Merge pull request hashicorp#167 from kawsark/master

Minor updates for OpenShift cluster provisioning

Author: rberlind

governance/first-generation/aws/sentinel.hcl

@@ -0,0 +1,3 @@
+policy "restrict-aws-region" {
+    enforcement_level = "soft-mandatory"
+}

infrastructure-as-code/k8s-cluster-openshift-aws/main.tf

@@ -203,6 +203,6 @@ resource "vault_kubernetes_auth_backend_role" "role" {
   role_name = "demo"
   bound_service_account_names = ["cats-and-dogs"]
   bound_service_account_namespaces = ["default", "cats-and-dogs"]
-  policies = ["${var.vault_user}"]
-  ttl = 7200
+  token_policies = ["${var.vault_user}"]
+  token_ttl = 7200
 }

infrastructure-as-code/k8s-cluster-openshift-aws/modules/openshift/01-amis.tf

@@ -49,6 +49,6 @@ data "aws_ami" "amazonlinux" {
 
   filter {
     name   = "name"
-    values = ["amzn-ami-hvm-*"]
+    values = ["amzn-ami-hvm-2018.03.0.20190611-x86_64-gp2"]
   }
 }

infrastructure-as-code/k8s-cluster-openshift-aws/scripts/postinstall-master.sh

@@ -3,7 +3,7 @@
 # Note: This script runs after the ansible install, use it to make configuration
 # changes which would otherwise be overwritten by ansible.
 
-sleep 120
+sleep 180
 
 # Create an htpasswd file, we'll use htpasswd auth for OpenShift.
 sudo mkdir -p /etc/origin/master

infrastructure-as-code/k8s-cluster-openshift-aws/scripts/postinstall-node.sh

@@ -3,7 +3,7 @@
 # Note: This script runs after the ansible install, use it to make configuration
 # changes which would otherwise be overwritten by ansible.
 
-sleep 120
+sleep 180
 
 # Update the docker config to allow OpenShift's local insecure registry. Also
 # use json-file for logging, so our Splunk forwarder can eat the container logs.

infrastructure-as-code/k8s-cluster-openshift-aws/variables.tf

@@ -4,6 +4,11 @@ variable "region" {
   default = "us-east-1"
 }
 
+variable "bastion_ami_filter" {
+  description = "The filter for the bastion AMI data source"
+  default = "amzn-ami-hvm-*"
+}
+
 variable "key_name" {
   description = "The name of the key to user for ssh access"
 }