Skip to content

Commit d64a798

Browse files
TiberiuGCTiberiuGC
committed
fix logic for updating aws-auth configmap
1 parent 4d0d67e commit d64a798

File tree

4 files changed

+108
-60
lines changed

4 files changed

+108
-60
lines changed

‎integration/tests/accessentries/accessentries_test.go‎

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -50,8 +50,8 @@ var (
5050
namespaceRoleARN string
5151
err error
5252

53-
apiEnabledCluster = "accessentries-api-enabled-2"
54-
apiDisabledCluster = "accessentries-api-disabled-2"
53+
apiEnabledCluster = "accessentries-api-enabled"
54+
apiDisabledCluster = "accessentries-api-disabled"
5555
)
5656

5757
func init() {
@@ -123,24 +123,39 @@ var _ = Describe("(Integration) [AccessEntries Test]", func() {
123123
cfg = makeClusterConfig(apiDisabledCluster)
124124
})
125125

126-
It("should create a cluster with authenticationMode set to CONFIG_MAP", func() {
126+
It("should create a cluster with authenticationMode set to CONFIG_MAP and allow self-managed nodes to join via aws-auth", func() {
127127
cfg.AccessConfig.AuthenticationMode = ekstypes.AuthenticationModeConfigMap
128-
128+
cfg.NodeGroups = append(cfg.NodeGroups, &api.NodeGroup{
129+
NodeGroupBase: &api.NodeGroupBase{
130+
Name: "aws-auth-ng",
131+
ScalingConfig: &api.ScalingConfig{
132+
DesiredCapacity: aws.Int(1),
133+
},
134+
},
135+
})
129136
data, err := json.Marshal(cfg)
130137
Expect(err).NotTo(HaveOccurred())
131138

132139
Expect(params.EksctlCreateCmd.
133140
WithArgs(
134141
"cluster",
135142
"--config-file", "-",
136-
"--without-nodegroup",
137143
"--verbose", "4",
138144
).
139145
WithoutArg("--region", params.Region).
140146
WithStdin(bytes.NewReader(data))).To(RunSuccessfully())
141147

142148
Expect(ctl.RefreshClusterStatus(context.Background(), cfg)).NotTo(HaveOccurred())
143149
Expect(ctl.IsAccessEntryEnabled()).To(BeFalse())
150+
151+
Expect(params.EksctlGetCmd.WithArgs(
152+
"nodegroup",
153+
"--cluster", apiDisabledCluster,
154+
"--name", "aws-auth-ng",
155+
"-o", "yaml",
156+
)).To(runner.RunSuccessfullyWithOutputStringLines(
157+
ContainElement(ContainSubstring("Status: CREATE_COMPLETE")),
158+
))
144159
})
145160

146161
It("should fail early when trying to create access entries", func() {

‎pkg/actions/nodegroup/create.go‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ import (
99
"github.com/aws/aws-sdk-go-v2/aws"
1010
"github.com/aws/aws-sdk-go-v2/service/ec2"
1111
ec2types "github.com/aws/aws-sdk-go-v2/service/ec2/types"
12+
ekstypes "github.com/aws/aws-sdk-go-v2/service/eks/types"
1213

1314
"github.com/kris-nova/logger"
1415
"github.com/pkg/errors"
@@ -253,7 +254,7 @@ func (m *Manager) nodeCreationTasks(ctx context.Context, isOwnedCluster, skipEgr
253254
allNodeGroupTasks := &tasks.TaskTree{
254255
Parallel: true,
255256
}
256-
disableAccessEntryCreation := !m.accessEntry.IsEnabled() || updateAuthConfigMap != nil
257+
disableAccessEntryCreation := !m.accessEntry.IsEnabled()
257258
nodeGroupTasks := m.stackManager.NewUnmanagedNodeGroupTask(ctx, cfg.NodeGroups, !awsNodeUsesIRSA, skipEgressRules, disableAccessEntryCreation, vpcImporter)
258259
if nodeGroupTasks.Len() > 0 {
259260
allNodeGroupTasks.Append(nodeGroupTasks)
@@ -285,19 +286,28 @@ func (m *Manager) postNodeCreationTasks(ctx context.Context, clientSet kubernete
285286
timeoutCtx, cancel := context.WithTimeout(ctx, m.ctl.AWSProvider.WaitTimeout())
286287
defer cancel()
287288

288-
if (!m.accessEntry.IsEnabled() && !api.IsDisabled(options.UpdateAuthConfigMap)) || api.IsEnabled(options.UpdateAuthConfigMap) {
289+
// authorize self-managed nodes to join the cluster via aws-auth configmap
290+
// if EKS access entries are disabled OR
291+
if (!m.accessEntry.IsEnabled() && !api.IsDisabled(options.UpdateAuthConfigMap)) ||
292+
// if explicitly requested by the user
293+
api.IsEnabled(options.UpdateAuthConfigMap) {
289294
if err := eks.UpdateAuthConfigMap(m.cfg.NodeGroups, clientSet); err != nil {
290295
return err
291296
}
292297
}
293-
if !api.IsDisabled(options.UpdateAuthConfigMap) {
298+
299+
// only wait for self-managed nodes to join if either authorization method is being used
300+
if m.accessEntry.IsEnabled() || !api.IsDisabled(options.UpdateAuthConfigMap) {
294301
for _, ng := range m.cfg.NodeGroups {
295302
if err := eks.WaitForNodes(timeoutCtx, clientSet, ng); err != nil {
296303
return err
297304
}
298305
}
306+
} else {
307+
logger.Warning(fmt.Sprintf("cluster autenticationMode is %s; setting --update-auth-configmap to false will prevent self-managed nodes to join the cluster until authorized", ekstypes.AuthenticationModeConfigMap))
299308
}
300309
logger.Success("created %d nodegroup(s) in cluster %q", len(m.cfg.NodeGroups), m.cfg.Metadata.Name)
310+
301311
for _, ng := range m.cfg.ManagedNodeGroups {
302312
if err := eks.WaitForNodes(timeoutCtx, clientSet, ng); err != nil {
303313
if m.cfg.PrivateCluster.Enabled {
@@ -308,8 +318,8 @@ func (m *Manager) postNodeCreationTasks(ctx context.Context, clientSet kubernete
308318
}
309319
}
310320
}
311-
312321
logger.Success("created %d managed nodegroup(s) in cluster %q", len(m.cfg.ManagedNodeGroups), m.cfg.Metadata.Name)
322+
313323
return nil
314324
}
315325

‎pkg/actions/nodegroup/create_test.go‎

Lines changed: 62 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import (
1414
ekstypes "github.com/aws/aws-sdk-go-v2/service/eks/types"
1515
. "github.com/onsi/ginkgo/v2"
1616
. "github.com/onsi/gomega"
17+
"github.com/onsi/gomega/types"
1718
"github.com/pkg/errors"
1819
"github.com/stretchr/testify/mock"
1920
"k8s.io/apimachinery/pkg/runtime"
@@ -494,7 +495,7 @@ var _ = DescribeTable("Create", func(t ngEntry) {
494495
},
495496
}),
496497

497-
Entry("fails to create nodegroup when authenticationMode is API and updateAuthConfigMap is false", ngEntry{
498+
Entry("[Nodegroup authorization error] when authenticationMode is API and updateAuthConfigMap is false", ngEntry{
498499
opts: nodegroup.CreateOpts{
499500
UpdateAuthConfigMap: api.Disabled(),
500501
},
@@ -506,15 +507,13 @@ var _ = DescribeTable("Create", func(t ngEntry) {
506507
},
507508
refreshCluster: true,
508509
expectedCalls: func(e expectedCalls) {
509-
Expect(e.kubeProvider.NewRawClientCallCount()).To(Equal(0))
510-
Expect(e.kubeProvider.ServerVersionCallCount()).To(Equal(0))
511-
Expect(e.nodeGroupFilter.SetOnlyLocalCallCount()).To(Equal(0))
510+
expectedSetupCalls(e, 0)
512511
},
513512

514513
expectedErr: errors.New("--update-auth-configmap is not supported when authenticationMode is set to API"),
515514
}),
516515

517-
Entry("fails to create nodegroup when authenticationMode is API and updateAuthConfigMap is true", ngEntry{
516+
Entry("[Nodegroup authorization error] when authenticationMode is API and updateAuthConfigMap is true", ngEntry{
518517
opts: nodegroup.CreateOpts{
519518
UpdateAuthConfigMap: api.Enabled(),
520519
},
@@ -526,32 +525,28 @@ var _ = DescribeTable("Create", func(t ngEntry) {
526525
},
527526
refreshCluster: true,
528527
expectedCalls: func(e expectedCalls) {
529-
Expect(e.kubeProvider.NewRawClientCallCount()).To(Equal(0))
530-
Expect(e.kubeProvider.ServerVersionCallCount()).To(Equal(0))
531-
Expect(e.nodeGroupFilter.SetOnlyLocalCallCount()).To(Equal(0))
528+
expectedSetupCalls(e, 0)
532529
},
533530

534531
expectedErr: errors.New("--update-auth-configmap is not supported when authenticationMode is set to API"),
535532
}),
536533

537-
Entry("creates nodegroup using access entries when authenticationMode is API_AND_CONFIG_MAP and updateAuthConfigMap is not supplied", ngEntry{
534+
Entry("[Nodegroup authorization via aws-auth ConfigMap] when authenticationMode is CONFIG_MAP and updateAuthConfigMap is not supplied", ngEntry{
538535
mockCalls: func(m mockCalls) {
539536
mockProviderWithConfig(m.mockProvider, defaultOutput, nil, nil, &ekstypes.AccessConfigResponse{
540-
AuthenticationMode: ekstypes.AuthenticationModeApiAndConfigMap,
537+
AuthenticationMode: ekstypes.AuthenticationModeConfigMap,
541538
})
542539
defaultProviderMocks(m.mockProvider, defaultOutput)
543540
},
541+
refreshCluster: true,
544542
expectedCalls: func(e expectedCalls) {
545-
Expect(e.kubeProvider.NewRawClientCallCount()).To(Equal(1))
546-
Expect(e.nodeGroupFilter.SetOnlyLocalCallCount()).To(Equal(1))
547-
Expect(e.nodeGroupTaskCreator.NewUnmanagedNodeGroupTaskCallCount()).To(Equal(1))
548-
_, _, _, _, disableAccessEntryCreation, _ := e.nodeGroupTaskCreator.NewUnmanagedNodeGroupTaskArgsForCall(0)
549-
Expect(disableAccessEntryCreation).To(BeFalse())
550-
Expect(getIAMIdentities(e.clientset)).To(HaveLen(0))
543+
expectedSetupCalls(e, 1)
544+
expectAccessEntriesCreationDisabled(e, true)
545+
expectConfigMapIAMIdentities(e, 1)
551546
},
552547
}),
553548

554-
Entry("creates nodegroup using aws-auth ConfigMap when authenticationMode is CONFIG_MAP and updateAuthConfigMap is true", ngEntry{
549+
Entry("[Nodegroup authorization via aws-auth ConfigMap] when authenticationMode is CONFIG_MAP and updateAuthConfigMap is true", ngEntry{
555550
mockCalls: func(m mockCalls) {
556551
mockProviderWithConfig(m.mockProvider, defaultOutput, nil, nil, &ekstypes.AccessConfigResponse{
557552
AuthenticationMode: ekstypes.AuthenticationModeConfigMap,
@@ -562,24 +557,28 @@ var _ = DescribeTable("Create", func(t ngEntry) {
562557
UpdateAuthConfigMap: api.Enabled(),
563558
},
564559
refreshCluster: true,
565-
expectedCalls: expectedCallsForAWSAuth,
560+
expectedCalls: func(e expectedCalls) {
561+
expectedSetupCalls(e, 1)
562+
expectAccessEntriesCreationDisabled(e, true)
563+
expectConfigMapIAMIdentities(e, 1)
564+
},
566565
}),
567566

568-
Entry("creates nodegroup using aws-auth ConfigMap when authenticationMode is CONFIG_MAP and updateAuthConfigMap is not supplied", ngEntry{
567+
Entry("[Nodegroup authorization via access entries] when authenticationMode is API_AND_CONFIG_MAP and updateAuthConfigMap is not supplied", ngEntry{
569568
mockCalls: func(m mockCalls) {
570569
mockProviderWithConfig(m.mockProvider, defaultOutput, nil, nil, &ekstypes.AccessConfigResponse{
571-
AuthenticationMode: ekstypes.AuthenticationModeConfigMap,
570+
AuthenticationMode: ekstypes.AuthenticationModeApiAndConfigMap,
572571
})
573572
defaultProviderMocks(m.mockProvider, defaultOutput)
574573
},
575-
opts: nodegroup.CreateOpts{
576-
UpdateAuthConfigMap: api.Enabled(),
574+
expectedCalls: func(e expectedCalls) {
575+
expectedSetupCalls(e, 1)
576+
expectAccessEntriesCreationDisabled(e, false)
577+
expectConfigMapIAMIdentities(e, 0)
577578
},
578-
refreshCluster: true,
579-
expectedCalls: expectedCallsForAWSAuth,
580579
}),
581580

582-
Entry("creates nodegroup but does not use either aws-auth ConfigMap or access entries when authenticationMode is API_AND_CONFIG_MAP and updateAuthConfigMap is false", ngEntry{
581+
Entry("[Nodegroup authorization via access entries] when authenticationMode is API_AND_CONFIG_MAP and updateAuthConfigMap is false", ngEntry{
583582
mockCalls: func(m mockCalls) {
584583
mockProviderWithConfig(m.mockProvider, defaultOutput, nil, nil, &ekstypes.AccessConfigResponse{
585584
AuthenticationMode: ekstypes.AuthenticationModeApiAndConfigMap,
@@ -591,48 +590,46 @@ var _ = DescribeTable("Create", func(t ngEntry) {
591590
UpdateAuthConfigMap: api.Disabled(),
592591
},
593592
expectedCalls: func(e expectedCalls) {
594-
Expect(e.kubeProvider.NewRawClientCallCount()).To(Equal(1))
595-
Expect(e.nodeGroupFilter.SetOnlyLocalCallCount()).To(Equal(1))
596-
Expect(e.nodeGroupTaskCreator.NewUnmanagedNodeGroupTaskCallCount()).To(Equal(1))
597-
_, _, _, _, disableAccessEntryCreation, _ := e.nodeGroupTaskCreator.NewUnmanagedNodeGroupTaskArgsForCall(0)
598-
Expect(disableAccessEntryCreation).To(BeTrue())
599-
Expect(getIAMIdentities(e.clientset)).To(HaveLen(0))
593+
expectedSetupCalls(e, 1)
594+
expectAccessEntriesCreationDisabled(e, false)
595+
expectConfigMapIAMIdentities(e, 0)
600596
},
601597
}),
602598

603-
Entry("creates nodegroup but does not use either aws-auth ConfigMap or access entries when authenticationMode is CONFIG_MAP and updateAuthConfigMap is false", ngEntry{
599+
Entry("[Nodegroup authorization via both methods] when authenticationMode is API_AND_CONFIG_MAP and updateAuthConfigMap is true", ngEntry{
604600
mockCalls: func(m mockCalls) {
605601
mockProviderWithConfig(m.mockProvider, defaultOutput, nil, nil, &ekstypes.AccessConfigResponse{
606-
AuthenticationMode: ekstypes.AuthenticationModeConfigMap,
602+
AuthenticationMode: ekstypes.AuthenticationModeApiAndConfigMap,
607603
})
608604
defaultProviderMocks(m.mockProvider, defaultOutput)
609605
},
610606
refreshCluster: true,
611607
opts: nodegroup.CreateOpts{
612-
UpdateAuthConfigMap: api.Disabled(),
608+
UpdateAuthConfigMap: api.Enabled(),
613609
},
614610
expectedCalls: func(e expectedCalls) {
615-
Expect(e.kubeProvider.NewRawClientCallCount()).To(Equal(1))
616-
Expect(e.nodeGroupFilter.SetOnlyLocalCallCount()).To(Equal(1))
617-
Expect(e.nodeGroupTaskCreator.NewUnmanagedNodeGroupTaskCallCount()).To(Equal(1))
618-
_, _, _, _, disableAccessEntryCreation, _ := e.nodeGroupTaskCreator.NewUnmanagedNodeGroupTaskArgsForCall(0)
619-
Expect(disableAccessEntryCreation).To(BeTrue())
620-
Expect(getIAMIdentities(e.clientset)).To(HaveLen(0))
611+
expectedSetupCalls(e, 1)
612+
expectAccessEntriesCreationDisabled(e, false)
613+
expectConfigMapIAMIdentities(e, 1)
621614
},
622615
}),
623616

624-
Entry("authorizes nodegroups using aws-auth ConfigMap when authenticationMode is API_AND_CONFIG_MAP and updateAuthConfigMap is true", ngEntry{
617+
Entry("[Nodegroup authorization via neither method] when authenticationMode is CONFIG_MAP and updateAuthConfigMap is false", ngEntry{
625618
mockCalls: func(m mockCalls) {
626619
mockProviderWithConfig(m.mockProvider, defaultOutput, nil, nil, &ekstypes.AccessConfigResponse{
627-
AuthenticationMode: ekstypes.AuthenticationModeApiAndConfigMap,
620+
AuthenticationMode: ekstypes.AuthenticationModeConfigMap,
628621
})
629622
defaultProviderMocks(m.mockProvider, defaultOutput)
630623
},
631624
refreshCluster: true,
632625
opts: nodegroup.CreateOpts{
633-
UpdateAuthConfigMap: api.Enabled(),
626+
UpdateAuthConfigMap: api.Disabled(),
627+
},
628+
expectedCalls: func(e expectedCalls) {
629+
expectedSetupCalls(e, 1)
630+
expectAccessEntriesCreationDisabled(e, true)
631+
expectConfigMapIAMIdentities(e, 0)
634632
},
635-
expectedCalls: expectedCallsForAWSAuth,
636633
}),
637634

638635
Entry("[happy path] creates nodegroup with no options", ngEntry{
@@ -744,14 +741,29 @@ func getIAMIdentities(clientset kubernetes.Interface) []iam.Identity {
744741
return identities
745742
}
746743

747-
func expectedCallsForAWSAuth(e expectedCalls) {
748-
Expect(e.kubeProvider.NewRawClientCallCount()).To(Equal(1))
749-
Expect(e.nodeGroupFilter.SetOnlyLocalCallCount()).To(Equal(1))
750-
Expect(e.nodeGroupTaskCreator.NewUnmanagedNodeGroupTaskCallCount()).To(Equal(1))
744+
func expectedSetupCalls(e expectedCalls, callCount int) {
745+
Expect(e.kubeProvider.NewRawClientCallCount()).To(Equal(callCount))
746+
Expect(e.nodeGroupFilter.SetOnlyLocalCallCount()).To(Equal(callCount))
747+
Expect(e.nodeGroupTaskCreator.NewUnmanagedNodeGroupTaskCallCount()).To(Equal(callCount))
748+
}
749+
750+
func expectAccessEntriesCreationDisabled(e expectedCalls, shouldDisable bool) {
751+
var match types.GomegaMatcher
752+
if shouldDisable {
753+
match = BeTrue()
754+
} else {
755+
match = BeFalse()
756+
}
751757
_, _, _, _, disableAccessEntryCreation, _ := e.nodeGroupTaskCreator.NewUnmanagedNodeGroupTaskArgsForCall(0)
752-
Expect(disableAccessEntryCreation).To(BeTrue())
758+
Expect(disableAccessEntryCreation).To(match)
759+
}
760+
761+
func expectConfigMapIAMIdentities(e expectedCalls, iamIdentitiesCount int) {
753762
identities := getIAMIdentities(e.clientset)
754-
Expect(identities).To(HaveLen(1))
763+
Expect(identities).To(HaveLen(iamIdentitiesCount))
764+
if iamIdentitiesCount == 0 {
765+
return
766+
}
755767
for _, id := range identities {
756768
roleIdentity, ok := id.(iam.RoleIdentity)
757769
Expect(ok).To(BeTrue())

‎pkg/ctl/create/cluster.go‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import (
88
"sync"
99

1010
"github.com/aws/aws-sdk-go-v2/aws"
11+
ekstypes "github.com/aws/aws-sdk-go-v2/service/eks/types"
1112

1213
"github.com/aws/amazon-ec2-instance-selector/v2/pkg/selector"
1314
"github.com/kris-nova/logger"
@@ -426,18 +427,28 @@ func doCreateCluster(cmd *cmdutils.Cmd, ngFilter *filter.NodeGroupFilter, params
426427
} else {
427428
ngCtx, cancel := context.WithTimeout(ctx, cmd.ProviderConfig.WaitTimeout)
428429
defer cancel()
430+
431+
// authorize self-managed nodes to join the cluster via aws-auth configmap
432+
// only if EKS access entries are disabled
433+
if cfg.AccessConfig.AuthenticationMode == ekstypes.AuthenticationModeConfigMap {
434+
if err := eks.UpdateAuthConfigMap(cfg.NodeGroups, clientSet); err != nil {
435+
return err
436+
}
437+
}
438+
429439
for _, ng := range cfg.NodeGroups {
430-
// wait for nodes to join
431440
if err := eks.WaitForNodes(ngCtx, clientSet, ng); err != nil {
432441
return err
433442
}
434443
}
444+
logger.Success("created %d nodegroup(s) in cluster %q", len(cfg.NodeGroups), cfg.Metadata.Name)
435445

436446
for _, ng := range cfg.ManagedNodeGroups {
437447
if err := eks.WaitForNodes(ngCtx, clientSet, ng); err != nil {
438448
return err
439449
}
440450
}
451+
logger.Success("created %d managed nodegroup(s) in cluster %q", len(cfg.ManagedNodeGroups), cfg.Metadata.Name)
441452
}
442453
}
443454
if postNodegroupAddons != nil && postNodegroupAddons.Len() > 0 {

0 commit comments

Comments
 (0)