Add support for cluster authentication mode and access entries #1171
Conversation
| @@ -533,14 +570,55 @@ func mapClusterToKubeAccess(kubeconfigs ...interface{}) (clusterKubeAccessMap, e | |||
| } | |||
|
|
|||
| // Parse the kubeconfig user auth exec args for the cluster name. | |||
| clusterNameIndex := len(kubeAccess.RESTConfig.ExecProvider.Args) - 1 | |||
| var clusterNameIndex int | |||
There was a problem hiding this comment.
This previously assumed that the cluster name is always the last parameter in the list, but that's not true (with the current aws cli version it's the output type for example).
This now retrieves the correct positional argument
| roleMappings: pulumi.Input<pulumi.Input<RoleMapping>[]> | undefined, | ||
| userMappings: pulumi.Input<pulumi.Input<UserMapping>[]> | undefined, | ||
| ): pulumi.Input<{ [key: string]: pulumi.Input<string> }> { | ||
| const instanceRoleMappings = instanceRoles.apply((roles) => |
There was a problem hiding this comment.
This is the same as before, just extracted it to here to slim down cluster.ts a bit and make it more manageable
| monitoring: { | ||
| enabled: args.enableDetailedMonitoring, | ||
| }, | ||
| monitoring: |
There was a problem hiding this comment.
This changed by pulling the new upstream provider version. Without this we're always getting diffs when the monitoring block is empty (i.e. all it's properties are undefined`
There was a problem hiding this comment.
You can throw an issue in pulumi-aws if relevant happy to dig deep into that.
There was a problem hiding this comment.
That's one of the permadiffs on empty objects that we've already found some of (empty blocks are not saved to state).
I can cut a ticket to look into it holistically
| @@ -19,7 +19,7 @@ | |||
| }, | |||
| "bugs": "https://github.com/pulumi/pulumi-eks/issues", | |||
| "dependencies": { | |||
| "@pulumi/aws": "^6.0.4", | |||
| "@pulumi/aws": "^6.18.2", | |||
There was a problem hiding this comment.
This is the first version supporting access entries
| These map to Access Entries of type `STANDARD`, which is the default. | ||
|
|
||
| The following shows how you'd add access entries for the role and user mappings: | ||
| ``` |
There was a problem hiding this comment.
| ``` | |
| ```ts |
| These map to Access Entries of type `EC2_LINUX`. | ||
|
|
||
| The following shows how you'd add access entries for the instance roles: | ||
| ``` |
There was a problem hiding this comment.
| ``` | |
| ```ts |
Does the PR have any schema changes?Found 54 breaking changes: |
|
The upgrade test failures are expected right now. They complain about a change in the aws provider, which does not skip the metadata API check by default now: https://github.com/pulumi/pulumi-aws/releases/tag/v6.37.1 Once this eks change is released we need to bump the baseline version and then they're green again |
provider/provider_test.go
Outdated
| @@ -142,61 +141,3 @@ func test(t *testing.T, dir string, opts ...providertest.Option) *providertest.P | |||
| ) | |||
| return providertest.NewProviderTest(dir, opts...) | |||
| } | |||
|
|
|||
There was a problem hiding this comment.
This retrieved the dependencies of the current version, but we need the deps of the baseline version
| test.each([ | ||
| [ | ||
| { | ||
| authenticationMode: "CONFIG_MAP", |
There was a problem hiding this comment.
"CONFIG_MAP" is a literal not an enum val is this right?
There was a problem hiding this comment.
Yes, the underlying aws provider does not have enums here
| @@ -35,7 +35,7 @@ func main() { | |||
| return err | |||
| } | |||
|
|
|||
| authMode := "API_AND_CONFIG_MAP" | |||
| authMode := eks.AuthenticationModeApiAndConfigMap | |||
| @@ -53,7 +53,7 @@ | |||
| max_size=1, | |||
| instance_type="t3.small" | |||
| ), | |||
| authentication_mode=eks.AuthenticationMode.AP_I_AN_D_CONFI_G_MAP, | |||
| authentication_mode=eks.AuthenticationMode.API_AND_CONFIG_MAP, | |||
| * The authentication mode of the cluster. Valid values are `CONFIG_MAP`, `API` or `API_AND_CONFIG_MAP` | ||
| * See for more details:\nhttps://docs.aws.amazon.com/eks/latest/userguide/grant-k8s-access.html#set-cam | ||
| */ | ||
| export type AccessEntryType = (typeof AccessEntryType)[keyof typeof AccessEntryType]; |
| @@ -685,3 +685,78 @@ func TestAccCNIAcrossUpdates(t *testing.T) { | |||
| t.Log("Ensuring that re-running `pulumi up` results in no changes and no spurious diffs") | |||
| pt.Up(optup.ExpectNoChanges()) | |||
| } | |||
|
|
|||
| func TestAccAuthenticationMode(t *testing.T) { | |||
There was a problem hiding this comment.
Note: these tests won't run in CI. You'd need to manually add them to the test matrix in our workflow files (eg.
pulumi-eks/.github/workflows/run-acceptance-tests.yml
Lines 422 to 444 in 161e7af
Does the PR have any schema changes?Found 54 breaking changes: |
AWS recently introduced a new method for granting IAM principals access to Kubernetes resources called[ Access Entries](https://docs.aws.amazon.com/eks/latest/userguide/grant-k8s-access.html#authentication-modes). These resources are now the recommended approach for controlling access to EKS clusters. Previously, the aws-auth ConfigMap was the sole method for mapping IAM principals to Kubernetes RBAC. Now, users can choose between using the ConfigMap (access mode CONFIG_MAP), Access Entries (access mode API), or both (access mode API_AND_CONFIG_MAP). This PR adds support for the new access modes as described in this internal doc: https://docs.google.com/document/d/1QS7h2E6lVTf8F6eVoHJOX3KowufvbhLqgRFFzTSb-SU/edit#heading=h.3b4er6mf60f5
Proposed changes
AWS recently introduced a new method for granting IAM principals access to Kubernetes resources called Access Entries. These resources are now the recommended approach for controlling access to EKS clusters.
Previously, the aws-auth ConfigMap was the sole method for mapping IAM principals to Kubernetes RBAC. Now, users can choose between using the ConfigMap (access mode CONFIG_MAP), Access Entries (access mode API), or both (access mode API_AND_CONFIG_MAP).
This PR adds support for the new access modes as described in this internal doc: https://docs.google.com/document/d/1QS7h2E6lVTf8F6eVoHJOX3KowufvbhLqgRFFzTSb-SU/edit#heading=h.3b4er6mf60f5
How to review?
Start by reviewing the schema changes (provider/cmd/pulumi-gen-eks/main.go) and then have a look at the changes to the cluster (nodejs/eks/cluster.ts).
After that have a look at the user facing documentation for migrating between access modes (docs/authentication-mode-migration.md) and the accompanying test for it (examples/tests/authentication-mode-migration/README.md).
Related issues (optional)
Closes #1027