Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

WIP: feat: eks pod identity support for controllers #5205

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

WIP: feat: eks pod identity support for controllers #5205

wants to merge 2 commits into from

Conversation

richardcase
Copy link
Member

@richardcase richardcase commented Nov 4, 2024 •
edited
Loading

What type of PR is this?

/kind feature

What this PR does / why we need it:

This adds support for using EKS pod identity for the CAPA controller when the management cluster is an EKS cluster.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Special notes for your reviewer:

This is in addition to #4906 .

Checklist:

  • squashed commits
  • includes documentation
  • includes emojis
  • adds unit tests
  • adds or updates e2e tests

Release note:

Add support for using EKS pod identity for the controller credentials.

@richardcase
feat: eks pod identity support for controllers
02e6fa4 
This adds support for using EKS pod identity for the CAPA controller
when the management cluster is an EKS cluster

Signed-off-by: Richard Case <[email protected]>
@k8s-ci-robot k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/feature Categorizes issue or PR as related to a new feature. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Nov 4, 2024
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from richardcase. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot requested review from faiq and nrb November 4, 2024 19:25
@k8s-ci-robot k8s-ci-robot added needs-priority size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Nov 4, 2024
@richardcase
wip: eks pod identity support
352d969 
Signed-off-by: Richard Case <[email protected]>
@k8s-ci-robot
Copy link
Contributor

@richardcase: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
pull-cluster-api-provider-aws-test 352d969 link true /test pull-cluster-api-provider-aws-test

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Copilot
Copilot AI reviewed Nov 19, 2024
View reviewed changes
Copy link

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot reviewed 6 out of 21 changed files in this pull request and generated 2 suggestions.

Files not reviewed (15)
  • cmd/clusterawsadm/cloudformation/bootstrap/control_plane.go: Evaluated as low risk
  • cmd/clusterawsadm/cloudformation/bootstrap/node.go: Evaluated as low risk
  • cmd/clusterawsadm/cloudformation/bootstrap/cluster_api_controller.go: Evaluated as low risk
  • cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_extra_statements.yaml: Evaluated as low risk
  • cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_eks_default_roles.yaml: Evaluated as low risk
  • cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_bootstrap_user.yaml: Evaluated as low risk
  • cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_different_instance_profiles.yaml: Evaluated as low risk
  • cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_all_secret_backends.yaml: Evaluated as low risk
  • cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_s3_bucket.yaml: Evaluated as low risk
  • cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_eks_kms_prefix.yaml: Evaluated as low risk
  • cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_eks_console.yaml: Evaluated as low risk
  • cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_allow_assume_role.yaml: Evaluated as low risk
  • cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_custom_bootstrap_user.yaml: Evaluated as low risk
  • cmd/clusterawsadm/cloudformation/bootstrap/fixtures/default.yaml: Evaluated as low risk
  • cmd/clusterawsadm/cloudformation/bootstrap/fixtures/with_ssm_secret_backend.yaml: Evaluated as low risk
Comments skipped due to low confidence (1)

cmd/clusterawsadm/cmd/controller/credentials/use_pod_identity.go:65

  • The function 'usePodIdentity' and its helper functions are not covered by tests.
func usePodIdentity(region, clusterName, namespace, serviceAccount, roleName string) error {

cmd/clusterawsadm/cmd/controller/credentials/use_pod_identity.go

fmt.Printf("Creating pod association for service account %s.....\n", serviceAccount)

createInpuut := &eks.CreatePodIdentityAssociationInput{
Copy link
Preview

Copilot AI Nov 19, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The variable name 'createInpuut' contains a typo. It should be 'createInput'.

Suggested change
createInpuut := &eks.CreatePodIdentityAssociationInput{
createInput := &eks.CreatePodIdentityAssociationInput{

Copilot is powered by AI, so mistakes are possible. Review output carefully before use.

Positive Feedback
Negative Feedback

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Please select one or more of the options
cmd/clusterawsadm/cmd/controller/credentials/use_pod_identity.go

newCmd := &cobra.Command{
Use: "use-pod-identity",
Short: "Enable EKS pod identiy with CAPA",
Copy link
Preview

Copilot AI Nov 19, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The word 'identiy' contains a typo. It should be 'identity'.

Suggested change
Short: "Enable EKS pod identiy with CAPA",
Short: "Enable EKS pod identity with CAPA",

Copilot is powered by AI, so mistakes are possible. Review output carefully before use.

Positive Feedback
Negative Feedback

Provide additional feedback

Please help us improve GitHub Copilot by sharing more details about this comment.

Please select one or more of the options
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

Copilot Copilot left review comments

@faiq faiq Awaiting requested review from faiq

@nrb nrb Awaiting requested review from nrb

Assignees
No one assigned
Labels
cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. kind/feature Categorizes issue or PR as related to a new feature. needs-priority release-note Denotes a PR that will be considered when it comes time to generate release notes. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@richardcase @k8s-ci-robot