-
Notifications
You must be signed in to change notification settings - Fork 1.4k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #7421 from cPu1/access-entries
Support EKS Access entries
- Loading branch information
Showing
98 changed files
with
5,455 additions
and
700 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| package accessentry | ||
|
|
||
| import ( | ||
| "fmt" | ||
|
|
||
| "github.com/kris-nova/logger" | ||
|
|
||
| ekstypes "github.com/aws/aws-sdk-go-v2/service/eks/types" | ||
|
|
||
| api "github.com/weaveworks/eksctl/pkg/apis/eksctl.io/v1alpha5" | ||
| ) | ||
|
|
||
| // Service is a service for access entries. | ||
| type Service struct { | ||
| // ClusterStateGetter returns the cluster state. | ||
| ClusterStateGetter | ||
| } | ||
|
|
||
| // ClusterStateGetter returns the cluster state. | ||
| type ClusterStateGetter interface { | ||
| GetClusterState() *ekstypes.Cluster | ||
| } | ||
|
|
||
| // IsEnabled reports whether the cluster has access entries enabled. | ||
| func (s *Service) IsEnabled() bool { | ||
| cluster := s.GetClusterState() | ||
| return cluster.AccessConfig != nil && IsEnabled(cluster.AccessConfig.AuthenticationMode) | ||
| } | ||
|
|
||
| // IsAWSAuthDisabled reports whether the cluster has authentication mode set to API. | ||
| func (s *Service) IsAWSAuthDisabled() bool { | ||
| accessConfig := s.GetClusterState().AccessConfig | ||
| return accessConfig == nil || accessConfig.AuthenticationMode == ekstypes.AuthenticationModeApi | ||
| } | ||
|
|
||
| // IsEnabled reports whether the authenticationMode indicates that the cluster has access entries enabled. | ||
| func IsEnabled(authenticationMode ekstypes.AuthenticationMode) bool { | ||
| return authenticationMode != ekstypes.AuthenticationModeConfigMap | ||
| } | ||
|
|
||
| // ValidateAPIServerAccess validates whether the API server is accessible for clusterConfig, and logs warning messages | ||
| // for operations that might fail later. | ||
| func ValidateAPIServerAccess(clusterConfig *api.ClusterConfig) error { | ||
| if !api.IsDisabled(clusterConfig.AccessConfig.BootstrapClusterCreatorAdminPermissions) { | ||
| return nil | ||
| } | ||
|
|
||
| const ( | ||
| apiServerConnectivityMsg = "eksctl features that require connectivity to the Kubernetes API server will fail" | ||
| bootstrapFalseMsg = "bootstrapClusterCreatorAdminPermissions is false" | ||
| ) | ||
| switch clusterConfig.AccessConfig.AuthenticationMode { | ||
| case ekstypes.AuthenticationModeConfigMap: | ||
| if len(clusterConfig.NodeGroups) > 0 { | ||
| return fmt.Errorf("cannot create self-managed nodegroups when authenticationMode is %s and %s", ekstypes.AuthenticationModeConfigMap, bootstrapFalseMsg) | ||
| } | ||
| logger.Warning("%s; %s", bootstrapFalseMsg, apiServerConnectivityMsg) | ||
| default: | ||
| if len(clusterConfig.AccessConfig.AccessEntries) == 0 { | ||
| if len(clusterConfig.NodeGroups) > 0 { | ||
| return fmt.Errorf("cannot create self-managed nodegroups when %s and no access entries are configured", bootstrapFalseMsg) | ||
| } | ||
| logger.Warning("%s and no access entries are configured; %s", bootstrapFalseMsg, apiServerConnectivityMsg) | ||
| return nil | ||
| } | ||
| logger.Warning("%s; if no configured access entries allow access to the Kubernetes API server, %s", bootstrapFalseMsg, apiServerConnectivityMsg) | ||
| } | ||
| return nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| package accessentry_test | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| . "github.com/onsi/ginkgo/v2" | ||
| . "github.com/onsi/gomega" | ||
| ) | ||
|
|
||
| func TestAccessEntry(t *testing.T) { | ||
| RegisterFailHandler(Fail) | ||
| RunSpecs(t, "Access Entry Suite") | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| package accessentry | ||
|
|
||
| import ( | ||
| "context" | ||
| "crypto/sha1" | ||
| "encoding/base32" | ||
| "errors" | ||
| "fmt" | ||
| "strings" | ||
|
|
||
| api "github.com/weaveworks/eksctl/pkg/apis/eksctl.io/v1alpha5" | ||
| "github.com/weaveworks/eksctl/pkg/utils/tasks" | ||
| ) | ||
|
|
||
| // CreatorInterface creates access entries. | ||
| // | ||
| //go:generate go run github.com/maxbrunsfeld/counterfeiter/v6 -generate | ||
| //counterfeiter:generate -o fakes/fake_creator.go . CreatorInterface | ||
| type CreatorInterface interface { | ||
| // Create creates access entries. | ||
| Create(ctx context.Context, accessEntries []api.AccessEntry) error | ||
| // CreateTasks creates a TaskTree for creating access entries. | ||
| CreateTasks(ctx context.Context, accessEntries []api.AccessEntry) *tasks.TaskTree | ||
| } | ||
|
|
||
| // A Creator creates access entries. | ||
| type Creator struct { | ||
| ClusterName string | ||
| StackCreator StackCreator | ||
| } | ||
|
|
||
| // Create creates the specified access entries. | ||
| func (m *Creator) Create(ctx context.Context, accessEntries []api.AccessEntry) error { | ||
| taskTree := m.CreateTasks(ctx, accessEntries) | ||
| if errs := taskTree.DoAllSync(); len(errs) > 0 { | ||
| var allErrs []string | ||
| for _, err := range errs { | ||
| allErrs = append(allErrs, err.Error()) | ||
| } | ||
| return errors.New(strings.Join(allErrs, "\n")) | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
| // CreateTasks creates a TaskTree for creating access entries. | ||
| func (m *Creator) CreateTasks(ctx context.Context, accessEntries []api.AccessEntry) *tasks.TaskTree { | ||
| taskTree := &tasks.TaskTree{ | ||
| Parallel: true, | ||
| } | ||
| for _, ae := range accessEntries { | ||
| taskTree.Append(&accessEntryTask{ | ||
| ctx: ctx, | ||
| info: fmt.Sprintf("create access entry for principal ARN %s", ae.PrincipalARN), | ||
| clusterName: m.ClusterName, | ||
| accessEntry: ae, | ||
| stackCreator: m.StackCreator, | ||
| }) | ||
| } | ||
| return taskTree | ||
| } | ||
|
|
||
| // MakeStackName creates a stack name for the specified access entry. | ||
| func MakeStackName(clusterName string, accessEntry api.AccessEntry) string { | ||
| s := sha1.Sum([]byte(accessEntry.PrincipalARN.String())) | ||
| return fmt.Sprintf("eksctl-%s-accessentry-%s", clusterName, base32.StdEncoding.WithPadding(base32.NoPadding).EncodeToString(s[:])) | ||
| } |
Oops, something went wrong.