✨ feat: support setting EKS AuthenticationMode #5108

adammw · 2024-08-27T07:17:17Z

What type of PR is this?

/kind feature

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Addresses part of #4854

Special notes for your reviewer:

Checklist:

Release note:

Added support for setting EKS AuthenticationMode (required for migrating to EKS Access Entries)

k8s-ci-robot · 2024-08-27T07:17:23Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign nrb for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot · 2024-08-27T07:17:25Z

Welcome @adammw!

It looks like this is your first PR to kubernetes-sigs/cluster-api-provider-aws 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/cluster-api-provider-aws has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2024-08-27T07:17:26Z

Hi @adammw. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

bsideup · 2024-08-29T15:39:29Z

A much appreciated change, given that ConfigMap-based approach is deprecated:
https://docs.aws.amazon.com/eks/latest/userguide/auth-configmap.html

richardcase · 2024-09-12T11:17:21Z

/ok-to-test

richardcase · 2024-09-30T09:44:36Z

/test pull-cluster-api-provider-aws-e2e
/test pull-cluster-api-provider-aws-e2e-eks

richardcase

Thanks for this @adammw

As well as setting the authentication mode, it would be great if there was a way to declaratively specify the access entries for the cluster.

richardcase · 2024-09-30T09:47:54Z

controlplane/eks/api/v1beta1/awsmanagedcontrolplane_types.go

@@ -165,6 +165,10 @@ type AWSManagedControlPlaneSpec struct { //nolint: maligned
 	// +optional
 	OIDCIdentityProviderConfig *OIDCIdentityProviderConfig `json:"oidcIdentityProviderConfig,omitempty"`

+	// AccessConfig specifies the access configuration information for the cluster
+	// +optional
+	AccessConfig *AccessConfig `json:"accessConfig,omitempty"`


You only need to add new API types to the latest API version (so v1beta2) in this case. This can be removed.

Due to the roundtripping requirement only having the field in the latest version of the API will probably cause the "fuzzing" test to fail. So you'll need to store & store the new API fields. Feel free to ping here or in slack if you need a hand.

Yeah i originally had that but yes the fuzzing test was failing, and it was unclear how to get the fuzzer to ignore that field for roundtrip.

richardcase · 2024-09-30T15:56:37Z

/test pull-cluster-api-provider-aws-e2e

adammw · 2024-10-01T04:57:43Z

it would be great if there was a way to declaratively specify the access entries for the cluster.

Yep, but also becomes a much larger PR so working on the smaller part first.

christophercorn · 2024-11-01T17:52:03Z

Hi, when will this be released?

richardcase · 2024-11-02T08:58:08Z

/test pull-cluster-api-provider-aws-e2e

k0da · 2024-11-20T15:42:23Z

Just to provide feedback: I've built image out of the proposed code and it works like a charm in real deployment.

k0da · 2025-01-21T08:48:38Z

@adammw Do you plan to continue work on this?

adammw · 2025-01-21T22:54:02Z

@k0da At this point I'm just waiting for review or understand what needs to change before merging

richardcase · 2025-01-22T09:10:22Z

@adammw @k0da - from my side the API changes need to be removed from v1beta1 and the conversions updated to handle the new field so that the fuzzy round trip tests pass.

k8s-ci-robot · 2025-02-28T23:49:21Z

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

richardcase · 2025-03-04T17:27:26Z

@adammw @k0da - just following up on this. Anything i can help with?

k8s-triage-robot · 2025-06-02T18:05:02Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-ci-robot · 2025-06-12T16:45:19Z

@adammw: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-cluster-api-provider-aws-e2e-blocking	`62e4137`	link	true	`/test pull-cluster-api-provider-aws-e2e-blocking`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

joshfrench · 2025-07-02T13:26:19Z

@richardcase I picked this up and addressed the remaining feedback in #5578

k8s-triage-robot · 2025-08-01T13:38:33Z

The Kubernetes project currently lacks enough active contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle rotten
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

k8s-ci-robot added kind/feature Categorizes issue or PR as related to a new feature. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Aug 27, 2024

k8s-ci-robot added the needs-priority label Aug 27, 2024

k8s-ci-robot requested review from enxebre and fabriziopandini August 27, 2024 07:17

k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Aug 27, 2024

feat: support setting EKS AuthenticationMode

904ed61

adammw force-pushed the adammw/auth-config branch from 8e9df3e to 904ed61 Compare September 5, 2024 06:09

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Sep 5, 2024

adammw added 3 commits September 6, 2024 15:33

Add GCFLAGS

fe7b9a9

Add debug log line

f36e389

Add webhook validation for access config

49e7a7b

This comment was marked as outdated.

Sign in to view

adammw changed the title ~~feat: support setting EKS AuthenticationMode~~ ✨ feat: support setting EKS AuthenticationMode Sep 12, 2024

add unit tests

3e5754c

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Sep 12, 2024

adammw added 3 commits September 17, 2024 16:04

Make revive happy on naming

c192252

fix failing test with invalid mocked input

e2353cd

add accessConfig to v1beta1 type as well

62e4137

richardcase reviewed Sep 30, 2024

View reviewed changes

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 28, 2025

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Jun 2, 2025

joshfrench mentioned this pull request Jul 2, 2025

✨ feat: Support setting EKS authentication mode #5578

Open

5 tasks

joshfrench mentioned this pull request Jul 2, 2025

📖 OIDC identity provider description matches field name #5579

Open

5 tasks

k8s-ci-robot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Aug 1, 2025

✨ feat: support setting EKS AuthenticationMode #5108

Are you sure you want to change the base?

✨ feat: support setting EKS AuthenticationMode #5108

Conversation

adammw commented Aug 27, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

k8s-ci-robot commented Aug 27, 2024

Uh oh!

k8s-ci-robot commented Aug 27, 2024

Uh oh!

k8s-ci-robot commented Aug 27, 2024

Uh oh!

bsideup commented Aug 29, 2024

Uh oh!

This comment was marked as outdated.

richardcase commented Sep 12, 2024

Uh oh!

richardcase commented Sep 30, 2024

Uh oh!

richardcase left a comment

Choose a reason for hiding this comment

Uh oh!

richardcase Sep 30, 2024

Choose a reason for hiding this comment

Uh oh!

adammw Oct 1, 2024

Choose a reason for hiding this comment

Uh oh!

richardcase commented Sep 30, 2024

Uh oh!

adammw commented Oct 1, 2024

Uh oh!

christophercorn commented Nov 1, 2024

Uh oh!

richardcase commented Nov 2, 2024

Uh oh!

k0da commented Nov 20, 2024

Uh oh!

k0da commented Jan 21, 2025

Uh oh!

adammw commented Jan 21, 2025

Uh oh!

richardcase commented Jan 22, 2025

Uh oh!

k8s-ci-robot commented Feb 28, 2025

Uh oh!

richardcase commented Mar 4, 2025

Uh oh!

k8s-triage-robot commented Jun 2, 2025

Uh oh!

k8s-ci-robot commented Jun 12, 2025

Uh oh!

joshfrench commented Jul 2, 2025

Uh oh!

k8s-triage-robot commented Aug 1, 2025

Uh oh!

Uh oh!

adammw commented Aug 27, 2024 •

edited

Loading