fix: #957 Use aws eks get-token instead of aws-iam-authenticator by schollii · Pull Request #1235 · terraform-aws-modules/terraform-aws-eks

schollii · 2021-02-11T15:56:49Z

PR o'clock

Description

Updated local.tf to use aws eks get-token, and updated the variables.tf default/docs for the two vars used

Checklist

CI tests are passing: the code formatting is correct in my test using terraform 0.14.6, maybe version issue? the tflint does not seem to be in a file I changed
README.md has been updated after any changes to variables and outputs: the docs folder does not mention authenticator.

nathanblair · 2021-06-08T15:53:54Z

Is there any feedback from maintainers on this? The corresponding issue has been closed as "stale".

Would the maintainers rather the branch be updated so it passes CI? I am willing to help with that so this external aws-iam-authenticator dependency can be removed.

Yasumoto · 2021-07-02T01:35:51Z

I'm also happy to pitch in to get this over the finish line if that's helpful! I know y'all maintainers are the ones that'll need to do most of the work and are surely busy!

It'd be awesome to only depend on the aws CLI tools 🙏🏼 Thanks for all the hard work on this, folks!

Yasumoto · 2021-07-06T20:53:31Z

I merged the main branch against this PR at https://github.com/schollii/terraform-aws-eks/pull/1

@schollii if you have time, any chance you could take a look and refresh this PR to make it easier to land this? 🙏🏼

schollii · 2021-07-06T21:09:16Z

@Yasumoto I fixed the conflict, if that's what you mean.

Yasumoto · 2021-07-06T22:57:45Z

Exactly, thanks so much @schollii !

lisfo4ka

@schollii @Yasumoto folks, thanks a lot for this really useful change!
I've tested it and it works absolutely great. Please, provide minor fixes according to the comments below and I assume we can merge it.

lisfo4ka · 2021-09-09T23:44:10Z

 | <a name="input_cluster_endpoint_private_access_sg"></a> [cluster\_endpoint\_private\_access\_sg](#input\_cluster\_endpoint\_private\_access\_sg) | List of security group IDs which can access the Amazon EKS private API server endpoint. To use this `cluster_endpoint_private_access` and `cluster_create_endpoint_private_access_sg_rule` must be set to `true`. | `list(string)` | `null` | no |
 | <a name="input_cluster_endpoint_public_access"></a> [cluster\_endpoint\_public\_access](#input\_cluster\_endpoint\_public\_access) | Indicates whether or not the Amazon EKS public API server endpoint is enabled. When it's set to `false` ensure to have a proper private access with `cluster_endpoint_private_access = true`. | `bool` | `true` | no |
-| <a name="input_cluster_endpoint_public_access_cidrs"></a> [cluster\_endpoint\_public\_access\_cidrs](#input\_cluster\_endpoint\_public\_access\_cidrs) | List of CIDR blocks which can access the Amazon EKS public API server endpoint. | `list(string)` | <pre>[<br>  "0.0.0.0/0"<br>]</pre> | no |
+| <a name="input_cluster_endpoint_public_access_cidrs"></a> [cluster\_endpoint\_public\_access\_cidrs](#input\_cluster\_endpoint\_public\_access\_cidrs) | List of CIDR blocks which can access the Amazon EKS public API server endpoint. You likely need to set `cluster_endpoint_private_access` to true so the nodes can join the cluster (see _API server endpoint access options_ table in [EKS User Guide](https://docs.aws.amazon.com/eks/latest/userguide/cluster-endpoint.html) for details). | `list(string)` | <pre>[<br>  "0.0.0.0/0"<br>]</pre> | no |


I'm not sure if this comment makes sense in case cluster_endpoint_public_access=true, is it?

it doesnt, you can use all 3 scenarios which have behaviour as in screen:

@lisfo4ka @daroga0002 My change is correct: If you set public CIDR but private is false, then worker nodes have no choice but to access API server through the public access point, ie internet, but their IP will be prevented (since you set the IP filter and you don't have a way to determine WAN IP of nodes). So they will never join the cluster. If you set IP filter, you HAVE to have private = true so they can directly access the API server from within the VPC.

what ip filter you are talking?

lisfo4ka · 2021-09-09T23:46:32Z

@@ -1,3 +1,6 @@
+data "aws_region" "this" {


let's put this in a single line
data "aws_region" "current" {}

lisfo4ka · 2021-09-09T23:49:33Z

+    "--cluster-name",
+    var.cluster_name
+  ]
  kubeconfig = var.create_eks ? templatefile("${path.module}/templates/kubeconfig.tpl", {


please, add empty line

schollii · 2021-09-17T01:27:32Z

@lisfo4ka fixes made, and one fix ignored because I gave explanation of why it would be wrong to remove that comment; but if you prefer, I can create a separate PR just for that one, since it has nothing to do with the primary issue of this PR, it ended up on the same PR kind of by mistake

daroga0002 · 2021-09-17T08:48:52Z

I dont understand what IP filter you writing. In general if you set public only then it also works (especially as this is default behaviour).

Please also rebase branch to current master

Fixes #957

schollii · 2021-09-17T16:40:58Z

The rebase was a bit of a headache because the local.tf was renamed meanwhile to locals.tf. The latest is code has more changes that what I did originally. I deleted this fork and recreated it and create PR #1590, was way easier given the small number of mods.

I create PR #1592 re public API endpoint IP filtering, it ended up in here by mistake.

github-actions · 2022-11-12T02:31:09Z

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

schollii changed the title ~~Use aws eks get-token instead of aws-iam-authenticator~~ fix: #957 Use aws eks get-token instead of aws-iam-authenticator Feb 11, 2021

daroga0002 mentioned this pull request Aug 26, 2021

support for client.authentication.k8s.io/v1beta1 #1526

Closed

lisfo4ka reviewed Sep 10, 2021

View reviewed changes

schollii mentioned this pull request Sep 17, 2021

Docs should clarify private endpoint need to be true when public endpoint is IP filtered #1111

Closed

4 tasks

schollii added 2 commits September 17, 2021 08:52

Different default when using latest AWS API

1f58d2d

Use aws eks get-token instead of obsolete aws authenticator

4c185e9

Fixes #957

schollii closed this Sep 17, 2021

github-actions Bot locked as resolved and limited conversation to collaborators Nov 12, 2022

Uh oh!

Conversation

schollii commented Feb 11, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR o'clock

Description

Checklist

Uh oh!

nathanblair commented Jun 8, 2021

Uh oh!

Yasumoto commented Jul 2, 2021

Uh oh!

Yasumoto commented Jul 6, 2021

Uh oh!

schollii commented Jul 6, 2021

Uh oh!

Yasumoto commented Jul 6, 2021

Uh oh!

lisfo4ka left a comment

Choose a reason for hiding this comment

Uh oh!

lisfo4ka Sep 9, 2021

Choose a reason for hiding this comment

Uh oh!

daroga0002 Sep 10, 2021

Choose a reason for hiding this comment

Uh oh!

schollii Sep 17, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

daroga0002 Sep 17, 2021

Choose a reason for hiding this comment

Uh oh!

lisfo4ka Sep 9, 2021

Choose a reason for hiding this comment

Uh oh!

schollii Sep 17, 2021

Choose a reason for hiding this comment

Uh oh!

lisfo4ka Sep 9, 2021

Choose a reason for hiding this comment

Uh oh!

schollii Sep 17, 2021

Choose a reason for hiding this comment

Uh oh!

schollii commented Sep 17, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

daroga0002 commented Sep 17, 2021

Uh oh!

schollii commented Sep 17, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Nov 12, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

schollii commented Feb 11, 2021 •

edited

Loading

schollii Sep 17, 2021 •

edited

Loading

schollii commented Sep 17, 2021 •

edited

Loading

schollii commented Sep 17, 2021 •

edited

Loading