Skip to content

Commit 17aebd7

Browse files
joshfrenchjoshfrench
committed
feat: support setting EKS AuthenticationMode
1 parent c622f18 commit 17aebd7

21 files changed

+646
-191
lines changed

‎Dockerfile‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,11 +41,10 @@ COPY ./ ./
4141
ARG package=.
4242
ARG ARCH
4343
ARG LDFLAGS
44-
ARG GCFLAGS
4544
RUN --mount=type=cache,target=/root/.cache/go-build \
4645
--mount=type=cache,target=/go/pkg/mod \
4746
--mount=type=cache,target=/root/.local/share/golang \
48-
CGO_ENABLED=0 GOOS=linux GOARCH=${ARCH} go build -gcflags "${GCFLAGS}" -ldflags "${LDFLAGS} -extldflags '-static'" -o manager ${package}
47+
CGO_ENABLED=0 GOOS=linux GOARCH=${ARCH} go build -ldflags "${LDFLAGS} -extldflags '-static'" -o manager ${package}
4948
ENTRYPOINT [ "/start.sh", "/workspace/manager" ]
5049

5150
# Copy the controller-manager into a thin image

‎Makefile‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -137,9 +137,6 @@ RBAC_ROOT ?= $(MANIFEST_ROOT)/rbac
137137
# Allow overriding the imagePullPolicy
138138
PULL_POLICY ?= Always
139139

140-
# Allow overriding the GCFLAGS
141-
GCFLAGS ?=
142-
143140
# Set build time variables including version details
144141
LDFLAGS := $(shell source ./hack/version.sh; version::ldflags)
145142

@@ -390,12 +387,12 @@ binaries: managers clusterawsadm ## Builds and installs all binaries
390387

391388
.PHONY: clusterawsadm
392389
clusterawsadm: ## Build clusterawsadm binary
393-
go build -gcflags "$(GCFLAGS)" -ldflags "$(LDFLAGS)" -o $(BIN_DIR)/clusterawsadm ./cmd/clusterawsadm
390+
go build -ldflags "$(LDFLAGS)" -o $(BIN_DIR)/clusterawsadm ./cmd/clusterawsadm
394391

395392

396393
.PHONY: docker-build
397394
docker-build: docker-pull-prerequisites ## Build the docker image for controller-manager
398-
docker build --build-arg ARCH=$(ARCH) --build-arg builder_image=$(GO_CONTAINER_IMAGE) --build-arg GCFLAGS="$(GCFLAGS)" --build-arg LDFLAGS="$(LDFLAGS)" . -t $(CORE_CONTROLLER_IMG)-$(ARCH):$(TAG)
395+
docker build --build-arg ARCH=$(ARCH) --build-arg builder_image=$(GO_CONTAINER_IMAGE) --build-arg LDFLAGS="$(LDFLAGS)" . -t $(CORE_CONTROLLER_IMG)-$(ARCH):$(TAG)
399396

400397
.PHONY: docker-build-all ## Build all the architecture docker images
401398
docker-build-all: $(addprefix docker-build-,$(ALL_ARCH))
@@ -414,7 +411,7 @@ managers: ## Alias for manager-aws-infrastructure
414411

415412
.PHONY: manager-aws-infrastructure
416413
manager-aws-infrastructure: ## Build manager binary
417-
CGO_ENABLED=0 GOARCH=${ARCH} go build -gcflags "${GCFLAGS}" -ldflags "${LDFLAGS} -extldflags '-static'" -o $(BIN_DIR)/manager .
414+
CGO_ENABLED=0 GOARCH=${ARCH} go build -ldflags "${LDFLAGS} -extldflags '-static'" -o $(BIN_DIR)/manager .
418415

419416
##@ test:
420417

‎config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanes.yaml‎

Lines changed: 13 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -67,21 +67,6 @@ spec:
6767
description: AWSManagedControlPlaneSpec defines the desired state of an
6868
Amazon EKS Cluster.
6969
properties:
70-
accessConfig:
71-
description: AccessConfig specifies the access configuration information
72-
for the cluster
73-
properties:
74-
authenticationMode:
75-
default: CONFIG_MAP
76-
description: |-
77-
AuthenticationMode specifies the desired authentication mode for the cluster
78-
Defaults to CONFIG_MAP
79-
enum:
80-
- CONFIG_MAP
81-
- API
82-
- API_AND_CONFIG_MAP
83-
type: string
84-
type: object
8570
additionalTags:
8671
additionalProperties:
8772
type: string
@@ -2265,15 +2250,22 @@ spec:
22652250
for the cluster
22662251
properties:
22672252
authenticationMode:
2268-
default: CONFIG_MAP
2253+
default: config_map
22692254
description: |-
22702255
AuthenticationMode specifies the desired authentication mode for the cluster
2271-
Defaults to CONFIG_MAP
2256+
Defaults to config_map
22722257
enum:
2273-
- CONFIG_MAP
2274-
- API
2275-
- API_AND_CONFIG_MAP
2258+
- config_map
2259+
- api
2260+
- api_and_config_map
22762261
type: string
2262+
bootstrapClusterCreatorAdminPermissions:
2263+
default: true
2264+
description: |-
2265+
BootstrapClusterCreatorAdminPermissions grants cluster admin permissions
2266+
to the IAM identity creating the cluster. Only applied during creation,
2267+
ignored when updating existing clusters. Defaults to true.
2268+
type: boolean
22772269
type: object
22782270
additionalTags:
22792271
additionalProperties:
@@ -3083,7 +3075,7 @@ spec:
30833075
type: object
30843076
oidcIdentityProviderConfig:
30853077
description: |-
3086-
OIDCIdentityProviderConfig is used to specify the oidc provider config
3078+
IdentityProviderconfig is used to specify the oidc provider config
30873079
to be attached with this eks cluster
30883080
properties:
30893081
clientId:

‎config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanetemplates.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,28 @@ spec:
5353
description: AWSManagedControlPlaneSpec defines the desired state
5454
of an Amazon EKS Cluster.
5555
properties:
56+
accessConfig:
57+
description: AccessConfig specifies the access configuration
58+
information for the cluster
59+
properties:
60+
authenticationMode:
61+
default: config_map
62+
description: |-
63+
AuthenticationMode specifies the desired authentication mode for the cluster
64+
Defaults to config_map
65+
enum:
66+
- config_map
67+
- api
68+
- api_and_config_map
69+
type: string
70+
bootstrapClusterCreatorAdminPermissions:
71+
default: true
72+
description: |-
73+
BootstrapClusterCreatorAdminPermissions grants cluster admin permissions
74+
to the IAM identity creating the cluster. Only applied during creation,
75+
ignored when updating existing clusters. Defaults to true.
76+
type: boolean
77+
type: object
5678
additionalTags:
5779
additionalProperties:
5880
type: string

‎controlplane/eks/api/v1beta1/awsmanagedcontrolplane_types.go‎

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -165,10 +165,6 @@ type AWSManagedControlPlaneSpec struct { //nolint: maligned
165165
// +optional
166166
OIDCIdentityProviderConfig *OIDCIdentityProviderConfig `json:"oidcIdentityProviderConfig,omitempty"`
167167

168-
// AccessConfig specifies the access configuration information for the cluster
169-
// +optional
170-
AccessConfig *AccessConfig `json:"accessConfig,omitempty"`
171-
172168
// DisableVPCCNI indicates that the Amazon VPC CNI should be disabled. With EKS clusters the
173169
// Amazon VPC CNI is automatically installed into the cluster. For clusters where you want
174170
// to use an alternate CNI this option provides a way to specify that the Amazon VPC CNI
@@ -216,15 +212,6 @@ type EndpointAccess struct {
216212
Private *bool `json:"private,omitempty"`
217213
}
218214

219-
// AccessConfig represents the access configuration information for the cluster
220-
type AccessConfig struct {
221-
// AuthenticationMode specifies the desired authentication mode for the cluster
222-
// Defaults to CONFIG_MAP
223-
// +kubebuilder:default=CONFIG_MAP
224-
// +kubebuilder:validation:Enum=CONFIG_MAP;API;API_AND_CONFIG_MAP
225-
AuthenticationMode EKSAuthenticationMode `json:"authenticationMode,omitempty"`
226-
}
227-
228215
// EncryptionConfig specifies the encryption configuration for the EKS clsuter.
229216
type EncryptionConfig struct {
230217
// Provider specifies the ARN or alias of the CMK (in AWS KMS)

‎controlplane/eks/api/v1beta1/conversion.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,7 @@ func (r *AWSManagedControlPlane) ConvertTo(dstRaw conversion.Hub) error {
117117

118118
dst.Spec.Partition = restored.Spec.Partition
119119
dst.Spec.RestrictPrivateSubnets = restored.Spec.RestrictPrivateSubnets
120+
dst.Spec.AccessConfig = restored.Spec.AccessConfig
120121
dst.Spec.RolePath = restored.Spec.RolePath
121122
dst.Spec.RolePermissionsBoundary = restored.Spec.RolePermissionsBoundary
122123
dst.Status.Version = restored.Status.Version

‎controlplane/eks/api/v1beta1/types.go‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -79,21 +79,6 @@ var (
7979
EKSTokenMethodAWSCli = EKSTokenMethod("aws-cli")
8080
)
8181

82-
// EKSAuthenticationMode defines the authentication mode for the cluster
83-
type EKSAuthenticationMode string
84-
85-
var (
86-
// EKSAuthenticationModeConfigMap indicates that only `aws-auth` ConfigMap will be used for authentication
87-
EKSAuthenticationModeConfigMap = EKSAuthenticationMode("CONFIG_MAP")
88-
89-
// EKSAuthenticationModeAPI indicates that only AWS Access Entries will be used for authentication
90-
EKSAuthenticationModeAPI = EKSAuthenticationMode("API")
91-
92-
// EKSAuthenticationModeAPIAndConfigMap indicates that both `aws-auth` ConfigMap and AWS Access Entries will
93-
// be used for authentication
94-
EKSAuthenticationModeAPIAndConfigMap = EKSAuthenticationMode("API_AND_CONFIG_MAP")
95-
)
96-
9782
var (
9883
// DefaultEKSControlPlaneRole is the name of the default IAM role to use for the EKS control plane
9984
// if no other role is supplied in the spec and if iam role creation is not enabled. The default

0 commit comments

Comments
 (0)