Merge pull request #484 from SmartColumbusOS/oidc-more

add dynamic thumbprint

Author: bbrewer-forge

features/eks-cluster.hcl

@@ -230,9 +230,13 @@ data "aws_eks_cluster" "eks_cluster" {
   name = "${module.eks-cluster.cluster_id}"
 }
 
+data "external" "oidc_thumbprint" {
+  program = ["${path.module}/files/scripts/oidc_thumbprint.sh", "${var.region}"]
+}
+
 resource "aws_iam_openid_connect_provider" "eks_cluster" {
   client_id_list  = ["sts.amazonaws.com"]
-  thumbprint_list = []
+  thumbprint_list = ["${data.external.oidc_thumbprint.result.thumbprint}"]
   url             = "${data.aws_eks_cluster.eks_cluster.identity.0.oidc.0.issuer}"
 }
 

files/scripts/oidc_thumbprint.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+set -e
+
+thumbprint=$(
+  echo | \
+    openssl s_client -servername oidc.eks.${1}.amazonaws.com -connect oidc.eks.${1}.amazonaws.com:443 2>&- | \
+    sed -n '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/p' | \
+    openssl x509 -fingerprint -noout | \
+    sed 's/://g' | awk -F= '{print tolower($2)}'
+)
+thumbprint_json="{\"thumbprint\": \"${thumbprint}\"}"
+
+echo $thumbprint_json