✨ feat: Support setting EKS authentication mode #5578

joshfrench · 2025-07-02T13:24:50Z

What type of PR is this?
/kind feature

What this PR does / why we need it:
Support setting EKS AuthenticationMode.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Partially addresses #4854

Special notes for your reviewer:
This PR just finishes the work started in #5108 by rebasing, removing the API changes to v1beta1, and fixing the fuzzy tests. There were two seemingly unrelated changes in the original PR that I've removed:

Add CGFLAGS to build command (I'm dropping this as unrelated)
One documentation fix that I'll resubmit in its own PR

Checklist:

Release note:

Added support for setting EKS AuthenticationMode (required for migrating to EKS Access Entries)

k8s-ci-robot · 2025-07-02T13:24:59Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign fabriziopandini for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot · 2025-07-02T13:24:59Z

Welcome @joshfrench!

It looks like this is your first PR to kubernetes-sigs/cluster-api-provider-aws 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/cluster-api-provider-aws has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2025-07-02T13:25:00Z

Hi @joshfrench. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

punkwalker

@joshfrench
Thank you for working on this.This will unblock my work for EKS Hybrid Node Cluster #5245.
Just few suggestion/question. Otherwise LGTM.

punkwalker · 2025-07-03T16:43:42Z

controlplane/eks/api/v1beta2/awsmanagedcontrolplane_types.go

+type AccessConfig struct {
+	// AuthenticationMode specifies the desired authentication mode for the cluster
+	// Defaults to CONFIG_MAP
+	// +kubebuilder:default=CONFIG_MAP
+	// +kubebuilder:validation:Enum=CONFIG_MAP;API;API_AND_CONFIG_MAP
+	AuthenticationMode EKSAuthenticationMode `json:"authenticationMode,omitempty"`
+}
+


As we are creating a AccessConfig, I suggest we add bootstrapClusterCreatorAdminPermissions as well,
If we do not plan to support this field, do we really need the AccessConfig struct?

WDYT @nrb @damdo ?

bootstrapClusterCreationAdminPermissions can only be set at cluster creation; the UpdateAccessConfigRequest API doesn't allow changing this. I don't have a strong opinion on adding the new field vs. removing the struct, but we'll need to account for that.

(For additional context, #5583 adds AccessEntry definitions to this struct but now I'm second-guessing where those should live.)

Here is what I think,
We have spec.iamAuthenticatorConfig in ManagedControlPlane. This is used for adding entries in aws-auth configmap.

Similary, we should have separate spec.AccessEntries for role/user mapping and spec.authenticationMode to specify access mode. Because, the default value for mode is CONFIG_MAP which would be required for creating mapping from [spec.iamAuthenticatorConfig].

@joshfrench Let me know what you think?

Also, bootstrapClusterCreatorAdminPermissions can be part of AuthenticationMode struct and have default value true as in CONFIG_MAP mode, regardless of the value, clusterCreator will have admin permissions.

@AndiDog Please share your thoughts.

@punkwalker Agreed that spec.AccessEntries should be a separate field (still planning to handle that in a separate PR.)

To clarify, you are suggesting we add bootstrapClusterCreatorAdminPermissions to AccessConfig and default it to true?

type AccessConfig struct { // +kubebuilder:default=CONFIG_MAP // +kubebuilder:validation:Enum=CONFIG_MAP;API;API_AND_CONFIG_MAP AuthenticationMode EKSAuthenticationMode `json:"authenticationMode,omitempty"` // +kubebuilder:default=true BootstrapClusterCreatorAdminPermissions bool `json:"bootstrapClusterCreatorAdminPermissions"` }

That feels right to me, since it matches the shape of the EKS API.

My question was what we should do if the user changes bootstrapClusterCreatorAdminPermissions on an existing cluster. The UpdateAccessConfig API doesn't allow it, because it makes no sense once the cluster has been boostrapped already. The only valid use of UpdateAccessConfig is to change the authentication mode.

So if a user changes bootstrapClusterCreationAdminPermissions on an existing cluster we could:

Ignore bootstrapClusterCreatorAdminPermissions entirely and only submit the request if it changes the authentication mode

Submit the request if it changes the authentication mode and log a warning if bootstrapClusterCreatorAdminPermissions also changes

Fail validation and return an error if bootstrapClusterCreationAdminPermissions changes, regardless of whether the authentication mode also changes

1 feels bad, 2 is low friction, 3 is the most explicit. Thoughts?

punkwalker · 2025-07-03T16:53:01Z

pkg/cloud/services/eks/cluster.go

+	expectedAuthenticationMode := string(s.scope.ControlPlane.Spec.AccessConfig.AuthenticationMode)
+	currentAuthenticationMode := string(accessConfig.AuthenticationMode)


Do we need this type conversion? Should be enough to compare the values as we already have a Type for AuthenticationMode.

one of these is from the AWS ekstypes pkg, the other from our own v1beta2

joshfrench · 2025-07-03T18:10:31Z

@punkwalker Thanks for the feedback, I'll be able to circle back to this next week.

AndiDog · 2025-07-15T13:30:09Z

controlplane/eks/api/v1beta2/awsmanagedcontrolplane_types.go

@@ -249,6 +253,15 @@ type EndpointAccess struct {
 	Private *bool `json:"private,omitempty"`
 }

+// AccessConfig represents the access configuration information for the cluster
+type AccessConfig struct {


Suggested change

type AccessConfig struct {

type Access struct {

(and JSON field name access)

All YAML is "config", so I'd remove that word unless it's part of "official" AWS terminology, for instance.

The upstream types and API docs both use AccessConfig.

This reverts commit 62e4137.

k8s-ci-robot requested review from AndiDog and faiq July 2, 2025 13:24

k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jul 2, 2025

This was referenced Jul 2, 2025

✨ feat: support setting EKS AuthenticationMode #5108

Open

📖 OIDC identity provider description matches field name #5579

Open

WIP: ✨ feat: Support Access Entries #5583

Open

punkwalker reviewed Jul 3, 2025

View reviewed changes

AndiDog reviewed Jul 15, 2025

View reviewed changes

joshfrench mentioned this pull request Jul 19, 2025

✨ Add EKS Pod Identities to AWSManagedControlPlane #4906

Open

5 tasks

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 4, 2025

adammw and others added 10 commits August 5, 2025 11:24

feat: support setting EKS AuthenticationMode

d224304

Add GCFLAGS

092811a

Add debug log line

b289e83

Add webhook validation for access config

32efafb

add unit tests

52d0e7c

Make revive happy on naming

277cd1a

fix failing test with invalid mocked input

7b51517

add accessConfig to v1beta1 type as well

67241e7

Revert "add accessConfig to v1beta1 type as well"

f5554f1

This reverts commit 62e4137.

preserve AccessConfig during AWSManagedControlPlane API conversions

910914e

joshfrench added 3 commits August 5, 2025 11:35

cruft

7cbcc9f

fix comment

d9d523c

rebase main

0b3fa84

joshfrench force-pushed the auth-config branch from 49a398a to 0b3fa84 Compare August 8, 2025 19:56

k8s-ci-robot removed do-not-merge/contains-merge-commits needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Aug 8, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

✨ feat: Support setting EKS authentication mode #5578

✨ feat: Support setting EKS authentication mode #5578

Uh oh!

joshfrench commented Jul 2, 2025

Uh oh!

k8s-ci-robot commented Jul 2, 2025

Uh oh!

k8s-ci-robot commented Jul 2, 2025

Uh oh!

k8s-ci-robot commented Jul 2, 2025

Uh oh!

punkwalker left a comment •

edited

Loading

Uh oh!

punkwalker Jul 3, 2025

Uh oh!

joshfrench Jul 7, 2025

Uh oh!

punkwalker Aug 8, 2025 •

edited

Loading

Uh oh!

joshfrench Aug 8, 2025

Uh oh!

punkwalker Jul 3, 2025

Uh oh!

joshfrench Jul 7, 2025

Uh oh!

joshfrench commented Jul 3, 2025

Uh oh!

AndiDog Jul 15, 2025

Uh oh!

joshfrench Jul 17, 2025

Uh oh!

Uh oh!

		expectedAuthenticationMode := string(s.scope.ControlPlane.Spec.AccessConfig.AuthenticationMode)
		currentAuthenticationMode := string(accessConfig.AuthenticationMode)

✨ feat: Support setting EKS authentication mode #5578

Are you sure you want to change the base?

✨ feat: Support setting EKS authentication mode #5578

Uh oh!

Conversation

joshfrench commented Jul 2, 2025

Uh oh!

k8s-ci-robot commented Jul 2, 2025

Uh oh!

k8s-ci-robot commented Jul 2, 2025

Uh oh!

k8s-ci-robot commented Jul 2, 2025

Uh oh!

punkwalker left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

punkwalker Jul 3, 2025

Choose a reason for hiding this comment

Uh oh!

joshfrench Jul 7, 2025

Choose a reason for hiding this comment

Uh oh!

punkwalker Aug 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

joshfrench Aug 8, 2025

Choose a reason for hiding this comment

Uh oh!

punkwalker Jul 3, 2025

Choose a reason for hiding this comment

Uh oh!

joshfrench Jul 7, 2025

Choose a reason for hiding this comment

Uh oh!

joshfrench commented Jul 3, 2025

Uh oh!

AndiDog Jul 15, 2025

Choose a reason for hiding this comment

Uh oh!

joshfrench Jul 17, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

punkwalker left a comment •

edited

Loading

punkwalker Aug 8, 2025 •

edited

Loading