fix(eks): aws-auth username not set by default (#5649)

* fix(eks): aws-auth username not set by default When mapping roles and users through the aws-auth config map, if a username is not specified, we need to default to the user/role ARN. Not specifying a default username will cause things like metrics server to fail. Fixes #5263 * chore(build): foreach.sh --up Add support for `--up` in `foreach.sh` which will execute the command for the current module and all its dependencies (instead of the entire repo). Use this new feature in `buildup` so from now, `buildup` is resumable. Restart can be done through `./buildup --restart`. Update CONTRIBUTING guide. * update expectations
aws · Jan 6, 2020 · 87befa6 · 87befa6
1 parent 59cbdc0
commit 87befa6
Show file tree

Hide file tree

Showing 5 changed files with 46 additions and 3 deletions.
diff --git a/packages/@aws-cdk/aws-eks/lib/aws-auth.ts b/packages/@aws-cdk/aws-eks/lib/aws-auth.ts
@@ -95,7 +95,7 @@ export class AwsAuth extends Construct {
     return Lazy.anyValue({
       produce: () => this.stack.toJsonString(this.roleMappings.map(m => ({
         rolearn: m.role.roleArn,
-        username: m.mapping.username,
+        username: m.mapping.username ?? m.role.roleArn,
         groups: m.mapping.groups
       })))
     });
@@ -105,7 +105,7 @@ export class AwsAuth extends Construct {
     return Lazy.anyValue({
       produce: () => this.stack.toJsonString(this.userMappings.map(m => ({
         userarn: m.user.userArn,
-        username: m.mapping.username,
+        username: m.mapping.username ?? m.user.userArn,
         groups: m.mapping.groups
       })))
     });

diff --git a/packages/@aws-cdk/aws-eks/test/integ.eks-helm.lit.expected.json b/packages/@aws-cdk/aws-eks/test/integ.eks-helm.lit.expected.json
@@ -684,6 +684,13 @@
                     "Arn"
                   ]
                 },
+                "\\\",\\\"username\\\":\\\"",
+                {
+                  "Fn::GetAtt": [
+                    "AdminRole38563C57",
+                    "Arn"
+                  ]
+                },
                 "\\\",\\\"groups\\\":[\\\"system:masters\\\"]},{\\\"rolearn\\\":\\\"",
                 {
                   "Fn::GetAtt": [

diff --git a/packages/@aws-cdk/aws-eks/test/integ.eks-kubectl.lit.expected.json b/packages/@aws-cdk/aws-eks/test/integ.eks-kubectl.lit.expected.json
@@ -684,6 +684,13 @@
                     "Arn"
                   ]
                 },
+                "\\\",\\\"username\\\":\\\"",
+                {
+                  "Fn::GetAtt": [
+                    "AdminRole38563C57",
+                    "Arn"
+                  ]
+                },
                 "\\\",\\\"groups\\\":[\\\"system:masters\\\"]},{\\\"rolearn\\\":\\\"",
                 {
                   "Fn::GetAtt": [

diff --git a/packages/@aws-cdk/aws-eks/test/test.awsauth.ts b/packages/@aws-cdk/aws-eks/test/test.awsauth.ts
@@ -71,13 +71,27 @@ export = {
                 "Arn"
               ]
             },
+            "\\\",\\\"username\\\":\\\"",
+            {
+              "Fn::GetAtt": [
+                "roleC7B7E775",
+                "Arn"
+              ]
+            },
             "\\\",\\\"groups\\\":[\\\"role-group2\\\",\\\"role-group3\\\"]}]\",\"mapUsers\":\"[{\\\"userarn\\\":\\\"",
             {
               "Fn::GetAtt": [
                 "user2C2B57AE",
                 "Arn"
               ]
             },
+            "\\\",\\\"username\\\":\\\"",
+            {
+              "Fn::GetAtt": [
+                "user2C2B57AE",
+                "Arn"
+              ]
+            },
             "\\\",\\\"groups\\\":[\\\"user-group1\\\",\\\"user-group2\\\"]},{\\\"userarn\\\":\\\"",
             {
               "Fn::GetAtt": [
@@ -118,7 +132,15 @@ export = {
                 "Arn"
               ]
             },
-            "\\\",\\\"username\\\":\\\"system:node:{{EC2PrivateDNSName}}\\\",\\\"groups\\\":[\\\"system:bootstrappers\\\",\\\"system:nodes\\\"]},{\\\"rolearn\\\":\\\"arn:aws:iam::123456789012:role/S3Access\\\",\\\"groups\\\":[\\\"group1\\\"]}]\",\"mapUsers\":\"[{\\\"userarn\\\":\\\"arn:",
+            "\\\",\\\"username\\\":\\\"system:node:{{EC2PrivateDNSName}}\\\",\\\"groups\\\":[\\\"system:bootstrappers\\\",\\\"system:nodes\\\"]},{\\\"rolearn\\\":\\\"arn:aws:iam::123456789012:role/S3Access\\\",\\\"username\\\":\\\"arn:aws:iam::123456789012:role/S3Access\\\",\\\"groups\\\":[\\\"group1\\\"]}]\",\"mapUsers\":\"[{\\\"userarn\\\":\\\"arn:",
+            {
+              Ref: "AWS::Partition"
+            },
+            ":iam::",
+            {
+              Ref: "AWS::AccountId"
+            },
+            ":user/MyUserName\\\",\\\"username\\\":\\\"arn:",
             {
               Ref: "AWS::Partition"
             },

diff --git a/packages/@aws-cdk/aws-eks/test/test.cluster.ts b/packages/@aws-cdk/aws-eks/test/test.cluster.ts
@@ -228,6 +228,13 @@ export = {
                 "Arn"
               ]
             },
+            "\\\",\\\"username\\\":\\\"",
+            {
+              "Fn::GetAtt": [
+                "roleC7B7E775",
+                "Arn"
+              ]
+            },
             "\\\",\\\"groups\\\":[\\\"system:masters\\\"]}]\",\"mapUsers\":\"[]\",\"mapAccounts\":\"[]\"}}]"
           ]
         ]