Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement native method for management of aws-auth ConfigMap #53

Closed
jrsdav opened this issue Mar 3, 2022 · 0 comments
Closed

Implement native method for management of aws-auth ConfigMap #53

jrsdav opened this issue Mar 3, 2022 · 0 comments
Assignees
Labels
type/task Indicates a chore or a small item of work

Comments

@jrsdav
Copy link
Contributor

jrsdav commented Mar 3, 2022

Problem Summary

This Terraform module relies on an parent module for the creation of an EKS cluster. Starting with v18.0.0, the module no longer supports management of the aws-auth ConfigMap.

In order for us to stay up to date with the EKS parent module, an alternative method of managing the aws-auth ConfigMap is necessary.

In addition to this issue, versions <=v17.X.X of the EKS parent module address an issue where IAM Path's are not recognized using the aws-iam-authenticator plugin, by stripping any IAM Paths in the role arn used by worker nodes.

This issue has since been fixed by AWS and IAM Paths are now properly recognized in the aws-auth ConfigMap for EKS clusters. However, even though the role arn with the stripped IAM Path is still usable by the worker nodes, the EKS API does not recognize them and thinks the cluster is in a degraded state.

This results in the nodes showing a Degraded status and EKS does not allow their configuration to be changed/updated (changing ASG settings, for instance).

Proposed Changes

This terraform module needs the ability to manage the aws-auth ConfigMap in order to add a role mapping for management by the StreamNative Control Plane.

We should bring this functionality native to our module, which will:

  1. Enable us to upgrade to newer versions of the EKS parent module (>= v18.X.X)
  2. Remove the custom logic used in versions <= v17.X.X that removes IAM Paths from the worker node role ARN
@jrsdav jrsdav added the type/task Indicates a chore or a small item of work label Mar 3, 2022
@jrsdav jrsdav self-assigned this Mar 3, 2022
@maxsxu maxsxu closed this as completed Nov 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type/task Indicates a chore or a small item of work
Projects
None yet
Development

No branches or pull requests

2 participants