-
Notifications
You must be signed in to change notification settings - Fork 3.8k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
aws-eks: albController and FargateCluster compatibility with AuthenticationMode.API mode #30888
Comments
Yes, that is how AuthenticationMode is designed. When you switch to I am not sure if albController does require ConfigMap, if it does, you probably should use |
@pahud I know that this is the intended behavior for Currently it's not possibile to use Fargate in a Cluster with aws-cdk/packages/aws-cdk-lib/aws-eks/lib/fargate-profile.ts Lines 204 to 213 in e3c0764
Or maybe could be removed at all, as per EKS documentation:
And I can also see that just switching to About ALB Controller, I don't know why here there is a dependency to aws-cdk/packages/aws-cdk-lib/aws-eks/lib/alb-controller.ts Lines 329 to 332 in e3c0764
As far as I know ALB Controller needs permissions to access AWS API with a ServiceAccount, not to grant access to K8S API to an IAM entity. Also here should be checked with EKS and ALB Controller teams. |
Yes we will need to improve the compatibility with
Yes I agree. This might be required.
We probably need a similar check here as well. We welcome PRs to help us improve the compatibility with |
…ode (#31258) ### Issue # (if applicable) This PR improve the compatibility for `albController` with `authenticationMode.API` related to #30888 We will address Fargate compatibility in #31267 ### Reason for this change - When `authenticationMode.API` is specified, no aws-auth configMap should be created - albController should not depend on `cluster.awsAuth` because that would create aws-auth configmap, which is not required in `API` mode. ### Description of changes ### Description of how you validated changes **unit tests** - validate the behavior in all conditions of the `authenticationMode` **integ test** - add a new integ test with API mode to ensure successful deployment ## debugger ```js { "version": "0.2.0", "configurations": [ { "type": "node", "request": "launch", "name": "Jest", "program": "${workspaceFolder}/node_modules/jest/bin/jest.js", "cwd": "${workspaceFolder}/packages/aws-cdk-lib", "args": [ "--verbose", "-i", "--no-cache", "test/alb-controller.test.ts", ], "console": "integratedTerminal", "internalConsoleOptions": "neverOpen", "skipFiles": [ "<node_internals>/**" ], "outFiles": [ "${workspaceFolder}/**/*.(m|c|)js", "!**/node_modules/**" ], } ] } ``` ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Describe the bug
Setting EKS Cluster
authenticationMode: AuthenticationMode.API
cause "Error: ConfigMap not supported in the AuthenticationMode" if usingalbController
or fargate profiles (for FargateCluster).Expected Behavior
Use the new
AccessEntry
mechanism whenauthenticationMode: AuthenticationMode.API
, for all resources managed by Cluster that need EKS API access.Current Behavior
Error: ConfigMap not supported in the AuthenticationMode
Reproduction Steps
or
Possible Solution
No response
Additional Information/Context
No response
CDK CLI Version
2.148.0 (build e5740c0)
Framework Version
2.148.0
Node.js Version
v20.15.1
OS
Ubuntu 20.04
Language
TypeScript
Language Version
TypeScript 5.5.3
Other information
No response
The text was updated successfully, but these errors were encountered: