Skip to content

Commit 9dc6e0b

Browse files
Add support for deletion protection on EKS clusters
1 parent 21a3341 commit 9dc6e0b

17 files changed

+160
-10
lines changed

generator/ServiceModels/eks/eks-2017-11-01.api.json

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -229,7 +229,8 @@
229229
{"shape":"ResourceNotFoundException"},
230230
{"shape":"ClientException"},
231231
{"shape":"ServerException"},
232-
{"shape":"ServiceUnavailableException"}
232+
{"shape":"ServiceUnavailableException"},
233+
{"shape":"InvalidRequestException"}
233234
]
234235
},
235236
"DeleteEksAnywhereSubscription":{
@@ -1345,7 +1346,8 @@
13451346
"zonalShiftConfig":{"shape":"ZonalShiftConfigResponse"},
13461347
"remoteNetworkConfig":{"shape":"RemoteNetworkConfigResponse"},
13471348
"computeConfig":{"shape":"ComputeConfigResponse"},
1348-
"storageConfig":{"shape":"StorageConfigResponse"}
1349+
"storageConfig":{"shape":"StorageConfigResponse"},
1350+
"deletionProtection":{"shape":"BoxedBoolean"}
13491351
}
13501352
},
13511353
"ClusterHealth":{
@@ -1603,7 +1605,8 @@
16031605
"zonalShiftConfig":{"shape":"ZonalShiftConfigRequest"},
16041606
"remoteNetworkConfig":{"shape":"RemoteNetworkConfigRequest"},
16051607
"computeConfig":{"shape":"ComputeConfigRequest"},
1606-
"storageConfig":{"shape":"StorageConfigRequest"}
1608+
"storageConfig":{"shape":"StorageConfigRequest"},
1609+
"deletionProtection":{"shape":"BoxedBoolean"}
16071610
}
16081611
},
16091612
"CreateClusterResponse":{
@@ -3852,7 +3855,8 @@
38523855
"computeConfig":{"shape":"ComputeConfigRequest"},
38533856
"kubernetesNetworkConfig":{"shape":"KubernetesNetworkConfigRequest"},
38543857
"storageConfig":{"shape":"StorageConfigRequest"},
3855-
"remoteNetworkConfig":{"shape":"RemoteNetworkConfigRequest"}
3858+
"remoteNetworkConfig":{"shape":"RemoteNetworkConfigRequest"},
3859+
"deletionProtection":{"shape":"BoxedBoolean"}
38563860
}
38573861
},
38583862
"UpdateClusterConfigResponse":{
@@ -4031,7 +4035,8 @@
40314035
"ComputeConfig",
40324036
"StorageConfig",
40334037
"KubernetesNetworkConfig",
4034-
"RemoteNetworkConfig"
4038+
"RemoteNetworkConfig",
4039+
"DeletionProtection"
40354040
]
40364041
},
40374042
"UpdateParams":{
@@ -4102,7 +4107,8 @@
41024107
"UpgradePolicyUpdate",
41034108
"ZonalShiftConfigUpdate",
41044109
"AutoModeUpdate",
4105-
"RemoteNetworkConfigUpdate"
4110+
"RemoteNetworkConfigUpdate",
4111+
"DeletionProtectionUpdate"
41064112
]
41074113
},
41084114
"UpgradePolicyRequest":{

generator/ServiceModels/eks/eks-2017-11-01.docs.json

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -306,17 +306,20 @@
306306
"refs": {
307307
"AccessConfigResponse$bootstrapClusterCreatorAdminPermissions": "<p>Specifies whether or not the cluster creator IAM principal was set as a cluster admin access entry during cluster creation time.</p>",
308308
"BlockStorage$enabled": "<p>Indicates if the block storage capability is enabled on your EKS Auto Mode cluster. If the block storage capability is enabled, EKS Auto Mode will create and delete EBS volumes in your Amazon Web Services account.</p>",
309+
"Cluster$deletionProtection": "<p>The current deletion protection setting for the cluster. When <code>true</code>, deletion protection is enabled and the cluster cannot be deleted until protection is disabled. When <code>false</code>, the cluster can be deleted normally. This setting only applies to clusters in an active state.</p>",
309310
"ComputeConfigRequest$enabled": "<p>Request to enable or disable the compute capability on your EKS Auto Mode cluster. If the compute capability is enabled, EKS Auto Mode will create and delete EC2 Managed Instances in your Amazon Web Services account.</p>",
310311
"ComputeConfigResponse$enabled": "<p>Indicates if the compute capability is enabled on your EKS Auto Mode cluster. If the compute capability is enabled, EKS Auto Mode will create and delete EC2 Managed Instances in your Amazon Web Services account.</p>",
311312
"CreateAccessConfigRequest$bootstrapClusterCreatorAdminPermissions": "<p>Specifies whether or not the cluster creator IAM principal was set as a cluster admin access entry during cluster creation time. The default value is <code>true</code>.</p>",
312313
"CreateClusterRequest$bootstrapSelfManagedAddons": "<p>If you set this value to <code>False</code> when creating a cluster, the default networking add-ons will not be installed.</p> <p>The default networking add-ons include <code>vpc-cni</code>, <code>coredns</code>, and <code>kube-proxy</code>.</p> <p>Use this option when you plan to install third-party alternative add-ons or self-manage the default networking add-ons.</p>",
314+
"CreateClusterRequest$deletionProtection": "<p>Indicates whether to enable deletion protection for the cluster. When enabled, the cluster cannot be deleted unless deletion protection is first disabled. This helps prevent accidental cluster deletion. Default value is <code>false</code>.</p>",
313315
"CreatePodIdentityAssociationRequest$disableSessionTags": "<p>Disable the automatic sessions tags that are appended by EKS Pod Identity.</p> <p>EKS Pod Identity adds a pre-defined set of session tags when it assumes the role. You can use these tags to author a single role that can work across resources by allowing access to Amazon Web Services resources based on matching tags. By default, EKS Pod Identity attaches six tags, including tags for cluster name, namespace, and service account name. For the list of tags added by EKS Pod Identity, see <a href=\"https://docs.aws.amazon.com/eks/latest/userguide/pod-id-abac.html#pod-id-abac-tags\">List of session tags added by EKS Pod Identity</a> in the <i>Amazon EKS User Guide</i>.</p> <p>Amazon Web Services compresses inline session policies, managed policy ARNs, and session tags into a packed binary format that has a separate limit. If you receive a <code>PackedPolicyTooLarge</code> error indicating the packed binary format has exceeded the size limit, you can attempt to reduce the size by disabling the session tags added by EKS Pod Identity.</p>",
314316
"DescribeClusterVersionsRequest$defaultOnly": "<p>Filter to show only default versions.</p>",
315317
"DescribeClusterVersionsRequest$includeAll": "<p>Include all available versions in the response.</p>",
316318
"ElasticLoadBalancing$enabled": "<p>Indicates if the load balancing capability is enabled on your EKS Auto Mode cluster. If the load balancing capability is enabled, EKS Auto Mode will create and delete load balancers in your Amazon Web Services account.</p>",
317319
"LogSetup$enabled": "<p>If a log type is enabled, that log type exports its control plane logs to CloudWatch Logs . If a log type isn't enabled, that log type doesn't export its control plane logs. Each individual log type can be enabled or disabled independently.</p>",
318320
"NodeRepairConfig$enabled": "<p>Specifies whether to enable node auto repair for the node group. Node auto repair is disabled by default.</p>",
319321
"PodIdentityAssociation$disableSessionTags": "<p>The state of the automatic sessions tags. The value of <i>true</i> disables these tags.</p> <p>EKS Pod Identity adds a pre-defined set of session tags when it assumes the role. You can use these tags to author a single role that can work across resources by allowing access to Amazon Web Services resources based on matching tags. By default, EKS Pod Identity attaches six tags, including tags for cluster name, namespace, and service account name. For the list of tags added by EKS Pod Identity, see <a href=\"https://docs.aws.amazon.com/eks/latest/userguide/pod-id-abac.html#pod-id-abac-tags\">List of session tags added by EKS Pod Identity</a> in the <i>Amazon EKS User Guide</i>.</p>",
322+
"UpdateClusterConfigRequest$deletionProtection": "<p>Specifies whether to enable or disable deletion protection for the cluster. When enabled (<code>true</code>), the cluster cannot be deleted until deletion protection is explicitly disabled. When disabled (<code>false</code>), the cluster can be deleted normally.</p>",
320323
"UpdatePodIdentityAssociationRequest$disableSessionTags": "<p>Disable the automatic sessions tags that are appended by EKS Pod Identity.</p> <p>EKS Pod Identity adds a pre-defined set of session tags when it assumes the role. You can use these tags to author a single role that can work across resources by allowing access to Amazon Web Services resources based on matching tags. By default, EKS Pod Identity attaches six tags, including tags for cluster name, namespace, and service account name. For the list of tags added by EKS Pod Identity, see <a href=\"https://docs.aws.amazon.com/eks/latest/userguide/pod-id-abac.html#pod-id-abac-tags\">List of session tags added by EKS Pod Identity</a> in the <i>Amazon EKS User Guide</i>.</p> <p>Amazon Web Services compresses inline session policies, managed policy ARNs, and session tags into a packed binary format that has a separate limit. If you receive a <code>PackedPolicyTooLarge</code> error indicating the packed binary format has exceeded the size limit, you can attempt to reduce the size by disabling the session tags added by EKS Pod Identity.</p>",
321324
"VpcConfigRequest$endpointPublicAccess": "<p>Set this value to <code>false</code> to disable public access to your cluster's Kubernetes API server endpoint. If you disable public access, your cluster's Kubernetes API server can only receive requests from within the cluster VPC. The default value for this parameter is <code>true</code>, which enables public access for your Kubernetes API server. The endpoint domain name and IP address family depends on the value of the <code>ipFamily</code> for the cluster. For more information, see <a href=\"https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html\">Cluster API server endpoint</a> in the <i> <i>Amazon EKS User Guide</i> </i>.</p>",
322325
"VpcConfigRequest$endpointPrivateAccess": "<p>Set this value to <code>true</code> to enable private access for your cluster's Kubernetes API server endpoint. If you enable private access, Kubernetes API requests from within your cluster's VPC use the private VPC endpoint. The default value for this parameter is <code>false</code>, which disables private access for your Kubernetes API server. If you disable private access and you have nodes or Fargate pods in the cluster, then ensure that <code>publicAccessCidrs</code> includes the necessary CIDR blocks for communication with the nodes or Fargate pods. For more information, see <a href=\"https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html\">Cluster API server endpoint</a> in the <i> <i>Amazon EKS User Guide</i> </i>.</p>",

generator/ServiceModels/eks/eks-2017-11-01.normal.json

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -241,7 +241,8 @@
241241
{"shape":"ResourceNotFoundException"},
242242
{"shape":"ClientException"},
243243
{"shape":"ServerException"},
244-
{"shape":"ServiceUnavailableException"}
244+
{"shape":"ServiceUnavailableException"},
245+
{"shape":"InvalidRequestException"}
245246
],
246247
"documentation":"<p>Deletes an Amazon EKS cluster control plane.</p> <p>If you have active services in your cluster that are associated with a load balancer, you must delete those services before deleting the cluster so that the load balancers are deleted properly. Otherwise, you can have orphaned resources in your VPC that prevent you from being able to delete the VPC. For more information, see <a href=\"https://docs.aws.amazon.com/eks/latest/userguide/delete-cluster.html\">Deleting a cluster</a> in the <i>Amazon EKS User Guide</i>.</p> <p>If you have managed node groups or Fargate profiles attached to the cluster, you must delete them first. For more information, see <code>DeleteNodgroup</code> and <code>DeleteFargateProfile</code>.</p>"
247248
},
@@ -1740,6 +1741,10 @@
17401741
"storageConfig":{
17411742
"shape":"StorageConfigResponse",
17421743
"documentation":"<p>Indicates the current configuration of the block storage capability on your EKS Auto Mode cluster. For example, if the capability is enabled or disabled. If the block storage capability is enabled, EKS Auto Mode will create and delete EBS volumes in your Amazon Web Services account. For more information, see EKS Auto Mode block storage capability in the <i>Amazon EKS User Guide</i>.</p>"
1744+
},
1745+
"deletionProtection":{
1746+
"shape":"BoxedBoolean",
1747+
"documentation":"<p>The current deletion protection setting for the cluster. When <code>true</code>, deletion protection is enabled and the cluster cannot be deleted until protection is disabled. When <code>false</code>, the cluster can be deleted normally. This setting only applies to clusters in an active state.</p>"
17431748
}
17441749
},
17451750
"documentation":"<p>An object representing an Amazon EKS cluster.</p>"
@@ -2201,6 +2206,10 @@
22012206
"storageConfig":{
22022207
"shape":"StorageConfigRequest",
22032208
"documentation":"<p>Enable or disable the block storage capability of EKS Auto Mode when creating your EKS Auto Mode cluster. If the block storage capability is enabled, EKS Auto Mode will create and delete EBS volumes in your Amazon Web Services account.</p>"
2209+
},
2210+
"deletionProtection":{
2211+
"shape":"BoxedBoolean",
2212+
"documentation":"<p>Indicates whether to enable deletion protection for the cluster. When enabled, the cluster cannot be deleted unless deletion protection is first disabled. This helps prevent accidental cluster deletion. Default value is <code>false</code>.</p>"
22042213
}
22052214
}
22062215
},
@@ -5672,7 +5681,11 @@
56725681
"shape":"StorageConfigRequest",
56735682
"documentation":"<p>Update the configuration of the block storage capability of your EKS Auto Mode cluster. For example, enable the capability.</p>"
56745683
},
5675-
"remoteNetworkConfig":{"shape":"RemoteNetworkConfigRequest"}
5684+
"remoteNetworkConfig":{"shape":"RemoteNetworkConfigRequest"},
5685+
"deletionProtection":{
5686+
"shape":"BoxedBoolean",
5687+
"documentation":"<p>Specifies whether to enable or disable deletion protection for the cluster. When enabled (<code>true</code>), the cluster cannot be deleted until deletion protection is explicitly disabled. When disabled (<code>false</code>), the cluster can be deleted normally.</p>"
5688+
}
56765689
}
56775690
},
56785691
"UpdateClusterConfigResponse":{
@@ -5917,7 +5930,8 @@
59175930
"ComputeConfig",
59185931
"StorageConfig",
59195932
"KubernetesNetworkConfig",
5920-
"RemoteNetworkConfig"
5933+
"RemoteNetworkConfig",
5934+
"DeletionProtection"
59215935
]
59225936
},
59235937
"UpdateParams":{
@@ -6010,7 +6024,8 @@
60106024
"UpgradePolicyUpdate",
60116025
"ZonalShiftConfigUpdate",
60126026
"AutoModeUpdate",
6013-
"RemoteNetworkConfigUpdate"
6027+
"RemoteNetworkConfigUpdate",
6028+
"DeletionProtectionUpdate"
60146029
]
60156030
},
60166031
"UpgradePolicyRequest":{

sdk/src/Services/EKS/Generated/Model/Cluster.cs

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ public partial class Cluster
4141
private ComputeConfigResponse _computeConfig;
4242
private ConnectorConfigResponse _connectorConfig;
4343
private DateTime? _createdAt;
44+
private bool? _deletionProtection;
4445
private List<EncryptionConfig> _encryptionConfig = AWSConfigs.InitializeCollections ? new List<EncryptionConfig>() : null;
4546
private string _endpoint;
4647
private ClusterHealth _health;
@@ -192,6 +193,27 @@ internal bool IsSetCreatedAt()
192193
return this._createdAt.HasValue;
193194
}
194195

196+
/// <summary>
197+
/// Gets and sets the property DeletionProtection.
198+
/// <para>
199+
/// The current deletion protection setting for the cluster. When <c>true</c>, deletion
200+
/// protection is enabled and the cluster cannot be deleted until protection is disabled.
201+
/// When <c>false</c>, the cluster can be deleted normally. This setting only applies
202+
/// to clusters in an active state.
203+
/// </para>
204+
/// </summary>
205+
public bool DeletionProtection
206+
{
207+
get { return this._deletionProtection.GetValueOrDefault(); }
208+
set { this._deletionProtection = value; }
209+
}
210+
211+
// Check to see if DeletionProtection property is set
212+
internal bool IsSetDeletionProtection()
213+
{
214+
return this._deletionProtection.HasValue;
215+
}
216+
195217
/// <summary>
196218
/// Gets and sets the property EncryptionConfig.
197219
/// <para>

sdk/src/Services/EKS/Generated/Model/CreateClusterRequest.cs

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,7 @@ public partial class CreateClusterRequest : AmazonEKSRequest
9393
private bool? _bootstrapSelfManagedAddons;
9494
private string _clientRequestToken;
9595
private ComputeConfigRequest _computeConfig;
96+
private bool? _deletionProtection;
9697
private List<EncryptionConfig> _encryptionConfig = AWSConfigs.InitializeCollections ? new List<EncryptionConfig>() : null;
9798
private KubernetesNetworkConfigRequest _kubernetesNetworkConfig;
9899
private Logging _logging;
@@ -192,6 +193,26 @@ internal bool IsSetComputeConfig()
192193
return this._computeConfig != null;
193194
}
194195

196+
/// <summary>
197+
/// Gets and sets the property DeletionProtection.
198+
/// <para>
199+
/// Indicates whether to enable deletion protection for the cluster. When enabled, the
200+
/// cluster cannot be deleted unless deletion protection is first disabled. This helps
201+
/// prevent accidental cluster deletion. Default value is <c>false</c>.
202+
/// </para>
203+
/// </summary>
204+
public bool DeletionProtection
205+
{
206+
get { return this._deletionProtection.GetValueOrDefault(); }
207+
set { this._deletionProtection = value; }
208+
}
209+
210+
// Check to see if DeletionProtection property is set
211+
internal bool IsSetDeletionProtection()
212+
{
213+
return this._deletionProtection.HasValue;
214+
}
215+
195216
/// <summary>
196217
/// Gets and sets the property EncryptionConfig.
197218
/// <para>

sdk/src/Services/EKS/Generated/Model/Internal/MarshallTransformations/ClusterUnmarshaller.cs

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,12 @@ public Cluster Unmarshall(JsonUnmarshallerContext context)
108108
unmarshalledObject.CreatedAt = unmarshaller.Unmarshall(context);
109109
continue;
110110
}
111+
if (context.TestExpression("deletionProtection", targetDepth))
112+
{
113+
var unmarshaller = BoolUnmarshaller.Instance;
114+
unmarshalledObject.DeletionProtection = unmarshaller.Unmarshall(context);
115+
continue;
116+
}
111117
if (context.TestExpression("encryptionConfig", targetDepth))
112118
{
113119
var unmarshaller = new ListUnmarshaller<EncryptionConfig, EncryptionConfigUnmarshaller>(EncryptionConfigUnmarshaller.Instance);

sdk/src/Services/EKS/Generated/Model/Internal/MarshallTransformations/CreateClusterRequestMarshaller.cs

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,12 @@ public IRequest Marshall(CreateClusterRequest publicRequest)
106106
context.Writer.WriteObjectEnd();
107107
}
108108

109+
if(publicRequest.IsSetDeletionProtection())
110+
{
111+
context.Writer.WritePropertyName("deletionProtection");
112+
context.Writer.Write(publicRequest.DeletionProtection);
113+
}
114+
109115
if(publicRequest.IsSetEncryptionConfig())
110116
{
111117
context.Writer.WritePropertyName("encryptionConfig");

sdk/src/Services/EKS/Generated/Model/Internal/MarshallTransformations/DeleteClusterResponseUnmarshaller.cs

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,10 @@ public override AmazonServiceException UnmarshallException(JsonUnmarshallerConte
8585
{
8686
return ClientExceptionUnmarshaller.Instance.Unmarshall(contextCopy, errorResponse);
8787
}
88+
if (errorResponse.Code != null && errorResponse.Code.Equals("InvalidRequestException"))
89+
{
90+
return InvalidRequestExceptionUnmarshaller.Instance.Unmarshall(contextCopy, errorResponse);
91+
}
8892
if (errorResponse.Code != null && errorResponse.Code.Equals("ResourceInUseException"))
8993
{
9094
return ResourceInUseExceptionUnmarshaller.Instance.Unmarshall(contextCopy, errorResponse);

sdk/src/Services/EKS/Generated/Model/Internal/MarshallTransformations/UpdateClusterConfigRequestMarshaller.cs

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,12 @@ public IRequest Marshall(UpdateClusterConfigRequest publicRequest)
103103
context.Writer.WriteObjectEnd();
104104
}
105105

106+
if(publicRequest.IsSetDeletionProtection())
107+
{
108+
context.Writer.WritePropertyName("deletionProtection");
109+
context.Writer.Write(publicRequest.DeletionProtection);
110+
}
111+
106112
if(publicRequest.IsSetKubernetesNetworkConfig())
107113
{
108114
context.Writer.WritePropertyName("kubernetesNetworkConfig");

0 commit comments

Comments
 (0)