Skip to content

Commit 25b8d6a

Browse files
PCP-4205: 🐛 fix: separate control plane logging and vpc config updates (#954)
* fix: separate control plane logging and vpc config updates * fix: set PublicCIDRs to [] when private only EP
1 parent 28a50bf commit 25b8d6a

File tree

2 files changed

+121
-8
lines changed

2 files changed

+121
-8
lines changed

pkg/cloud/services/eks/cluster.go

Lines changed: 33 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,10 @@ func (s *Service) reconcileCluster(ctx context.Context) error {
120120
return errors.Wrap(err, "failed reconciling cluster config")
121121
}
122122

123+
if err := s.reconcileLogging(cluster.Logging); err != nil {
124+
return errors.Wrap(err, "failed reconciling logging")
125+
}
126+
123127
if err := s.reconcileEKSEncryptionConfig(cluster.EncryptionConfig); err != nil {
124128
return errors.Wrap(err, "failed reconciling eks encryption config")
125129
}
@@ -296,7 +300,9 @@ func makeVpcConfig(subnets infrav1.Subnets, endpointAccess ekscontrolplanev1.End
296300
SubnetIds: subnetIds,
297301
}
298302

299-
if len(cidrs) > 0 {
303+
isPrivateOnlyEndPoint := !aws.BoolValue(vpcConfig.EndpointPublicAccess) && aws.BoolValue(vpcConfig.EndpointPrivateAccess)
304+
305+
if len(cidrs) > 0 || isPrivateOnlyEndPoint {
300306
vpcConfig.PublicAccessCidrs = cidrs
301307
}
302308
sg, ok := securityGroups[infrav1.SecurityGroupEKSNodeAdditional]
@@ -439,11 +445,6 @@ func (s *Service) reconcileClusterConfig(cluster *eks.Cluster) error {
439445
var needsUpdate bool
440446
input := eks.UpdateClusterConfigInput{Name: aws.String(s.scope.KubernetesClusterName())}
441447

442-
if updateLogging := s.reconcileLogging(cluster.Logging); updateLogging != nil {
443-
needsUpdate = true
444-
input.Logging = updateLogging
445-
}
446-
447448
updateVpcConfig, err := s.reconcileVpcConfig(cluster.ResourcesVpcConfig)
448449
if err != nil {
449450
return errors.Wrap(err, "couldn't create vpc config for cluster")
@@ -475,15 +476,39 @@ func (s *Service) reconcileClusterConfig(cluster *eks.Cluster) error {
475476
return nil
476477
}
477478

478-
func (s *Service) reconcileLogging(logging *eks.Logging) *eks.Logging {
479+
func (s *Service) reconcileLogging(logging *eks.Logging) error {
480+
input := eks.UpdateClusterConfigInput{Name: aws.String(s.scope.KubernetesClusterName())}
481+
479482
for _, logSetup := range logging.ClusterLogging {
480483
for _, l := range logSetup.Types {
481484
enabled := s.scope.ControlPlane.Spec.Logging.IsLogEnabled(*l)
482485
if enabled != *logSetup.Enabled {
483-
return makeEksLogging(s.scope.ControlPlane.Spec.Logging)
486+
input.Logging = makeEksLogging(s.scope.ControlPlane.Spec.Logging)
484487
}
485488
}
486489
}
490+
491+
if input.Logging != nil {
492+
if err := input.Validate(); err != nil {
493+
return errors.Wrap(err, "created invalid UpdateClusterConfigInput")
494+
}
495+
496+
if err := wait.WaitForWithRetryable(wait.NewBackoff(), func() (bool, error) {
497+
if _, err := s.EKSClient.UpdateClusterConfig(&input); err != nil {
498+
if aerr, ok := err.(awserr.Error); ok {
499+
return false, aerr
500+
}
501+
return false, err
502+
}
503+
conditions.MarkTrue(s.scope.ControlPlane, ekscontrolplanev1.EKSControlPlaneUpdatingCondition)
504+
record.Eventf(s.scope.ControlPlane, "InitiatedUpdateEKSControlPlane", "Initiated logging update for EKS control plane %s", s.scope.KubernetesClusterName())
505+
return true, nil
506+
}); err != nil {
507+
record.Warnf(s.scope.ControlPlane, "FailedUpdateEKSControlPlane", "Failed to update EKS control plane logging: %v", err)
508+
return errors.Wrapf(err, "failed to update EKS cluster")
509+
}
510+
}
511+
487512
return nil
488513
}
489514

pkg/cloud/services/eks/cluster_test.go

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -234,6 +234,94 @@ func TestMakeVPCConfig(t *testing.T) {
234234
PublicAccessCidrs: []*string{aws.String("10.0.0.0/24")},
235235
},
236236
},
237+
{
238+
name: "private only endpoint access",
239+
input: input{
240+
subnets: []infrav1.SubnetSpec{
241+
{
242+
ID: idOne,
243+
CidrBlock: "10.0.10.0/24",
244+
AvailabilityZone: "us-west-2a",
245+
IsPublic: false,
246+
},
247+
{
248+
ID: idTwo,
249+
CidrBlock: "10.0.10.1/24",
250+
AvailabilityZone: "us-west-2b",
251+
IsPublic: false,
252+
},
253+
},
254+
endpointAccess: ekscontrolplanev1.EndpointAccess{
255+
Private: aws.Bool(true),
256+
PublicCIDRs: []*string{},
257+
},
258+
},
259+
expect: &eks.VpcConfigRequest{
260+
SubnetIds: []*string{&idOne, &idTwo},
261+
PublicAccessCidrs: []*string{},
262+
EndpointPrivateAccess: aws.Bool(true),
263+
},
264+
},
265+
{
266+
name: "public and private endpoint access",
267+
input: input{
268+
subnets: []infrav1.SubnetSpec{
269+
{
270+
ID: idOne,
271+
CidrBlock: "10.0.10.0/24",
272+
AvailabilityZone: "us-west-2a",
273+
IsPublic: false,
274+
},
275+
{
276+
ID: idTwo,
277+
CidrBlock: "10.0.10.1/24",
278+
AvailabilityZone: "us-west-2b",
279+
IsPublic: false,
280+
},
281+
},
282+
endpointAccess: ekscontrolplanev1.EndpointAccess{
283+
Private: aws.Bool(true),
284+
Public: aws.Bool(true),
285+
PublicCIDRs: []*string{},
286+
},
287+
},
288+
expect: &eks.VpcConfigRequest{
289+
SubnetIds: []*string{&idOne, &idTwo},
290+
PublicAccessCidrs: nil,
291+
EndpointPrivateAccess: aws.Bool(true),
292+
EndpointPublicAccess: aws.Bool(true),
293+
},
294+
},
295+
{
296+
name: "public only endpoint access",
297+
input: input{
298+
subnets: []infrav1.SubnetSpec{
299+
{
300+
ID: idOne,
301+
CidrBlock: "10.0.10.0/24",
302+
AvailabilityZone: "us-west-2a",
303+
IsPublic: false,
304+
},
305+
{
306+
ID: idTwo,
307+
CidrBlock: "10.0.10.1/24",
308+
AvailabilityZone: "us-west-2b",
309+
IsPublic: false,
310+
},
311+
},
312+
endpointAccess: ekscontrolplanev1.EndpointAccess{
313+
Private: aws.Bool(false),
314+
Public: aws.Bool(true),
315+
PublicCIDRs: []*string{},
316+
},
317+
},
318+
expect: &eks.VpcConfigRequest{
319+
SubnetIds: []*string{&idOne, &idTwo},
320+
PublicAccessCidrs: nil,
321+
EndpointPrivateAccess: aws.Bool(false),
322+
EndpointPublicAccess: aws.Bool(true),
323+
},
324+
},
237325
}
238326
for _, tc := range testCases {
239327
t.Run(tc.name, func(t *testing.T) {

0 commit comments

Comments
 (0)