feat(eks): pass helm chart values to aws-load-balancer-controller #29723

mtrspringer · 2024-04-04T11:47:00Z

Issue # (if applicable)

Reason for this change

Need to be able to disable aws-load-balancer-controller wafv2 behavior so it doesn't remove waf associations created by AWS FMS.

Description of changes

I added a values property to the AlbControllerOptions interface for passing optional values to the underlying helm chart.

Description of how you validated changes

I added two tests to validate my changes:

a test to check that values passed appear in the template output
a test to check that values passed do not override values currently set by the AlbController construct

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

lpizzinidev

Looks good, thanks! 👍
Left some minor suggestions for updating the documentation.

packages/aws-cdk-lib/aws-eks/lib/alb-controller.ts

packages/aws-cdk-lib/aws-eks/README.md

paulhcsun · 2024-04-19T21:29:39Z

packages/aws-cdk-lib/aws-eks/lib/alb-controller.ts

+   *
+   * @default - No values are provided to the chart.
+   */
+  readonly values?: {[key: string]: any};


Suggested change

readonly values?: {[key: string]: any};

readonly helmChartValues?: {[key: string]: any};

Can you rename this to helmChartValues? Just having this be values in this context is not clear what these values are being used for. Ideally I'd have like the property within Helm Chart to be named something other than values as well but unfortunately it's too late for that now.

yes that's fine with me. I was using the HelmChartProps as an guide but I can see the value in being specific within the scope of a broader construct that's not limited to helm already.

paulhcsun · 2024-04-19T21:32:35Z

packages/aws-cdk-lib/aws-eks/lib/alb-controller.ts

+   * values: {
+   *  autoscaling: false,
+   *  ingressClassParams: { create: true }
+   * }
+   *
+   * Note that the following values are set by the controller and cannot be overridden:
+   *  - clusterName
+   *  - serviceAccount.create
+   *  - serviceAccount.name
+   *  - region
+   *  - vpcId
+   *  - image.repository
+   *  - image.tag


Do we know the full set of values that can be passed in to the helmChart.values property? If so could we add some stronger typing checks to them? If not then could we add some validation for the values that cannot be overridden?

From your unit test case it seems like Helm Chart will just ignore these values but I would rather prevent these values from being set at all instead of allowing it to be passed in and have it silently fail.

i think the set of values varies (or can potentially vary) depending on the helm chart version. I think defining a type (e.g. AlbControllerHelmChartValues) will create a loose link to the helm chart that has the potential for breaking. Validating the passed values against the keys we know we explicitly set seems like a better approach to me.

Gotcha, thanks for clarifying. Then let's go with the second option to validate the passed values that cannot be overridden.

@paulhcsun i've updated with the requested changes. Assuming the suite passes, would you (or someone else) be able to run/update the integration tests? I ran into some issues with the teardown last time.

Hey @mtrspringer, thanks for making the changes! and ya for sure, I'll give that a run later today.

Hey @mtrspringer, apologies some other items came up. I will run the tests now.

It took a while to run on Friday and looks like it failed due to a credentials related error but it still seems to have updated the snapshots. I've pushed them so hopefully the codebuild will be happy with the new snapshots.

@paulhcsun thanks very much! yes it takes ages, looks like the build is passing though

Pull request has been modified.

paulhcsun · 2024-05-28T20:18:51Z

Hi @mtrspringer, apologies for another delay to getting around to reviewing this. I was oncall last week. Thank you for making the requested changes for validating the values that can be passed to helmChart.values.

Would you mind explaining what the changes within @aws-cdk/sdk-v2-to-v3-adapter are for? I don't remember seeing them during the initial review and I'm not quite sure how they're related to this change.

mtrspringer · 2024-06-07T15:53:16Z

@paulhcsun hi sorry i've been on vacation the last 2 weeks. I dont remember making any changes to those files, maybe they got included when i updated my branch via the github button? im happy to leave them out

mtrspringer · 2024-06-11T10:56:38Z

@paulhcsun looks like they were .d.ts and .js files that somehow got included. i've just removed them so this PR should be ready for review now

TheRealAmazonKendra · 2024-06-18T17:00:48Z

packages/aws-cdk-lib/aws-eks/lib/alb-controller.ts

+   *
+   * @default - No values are provided to the chart.
+   */
+  readonly helmChartValues?: {[key: string]: any};


I don't think that this is quite the right direction here. From what I can tell, only one or two values need to be overridden for your use case and this is basically giving the user carte blanche to override far more than that. I chatted with @paulhcsun about this PR and I'm thinking that it would likely be better to have a function that can be called after instantiation to disable the load balancer wafv2 behavior instead of adding a prop.

In general, we don't want props to contradict one another or allow values that we know are not allowed (i.e. the list of values you added in the docstring).

What I'm really having trouble with here is understanding how those values are being set in the first place, in your use case. Can you explain what's going on in your specific case a bit more so that our suggestions for the fix don't send you in circles?

I would also probably suggest that the function to update this behavior should be scoped to the ALB controller but, again, I'd like to understand better how these fields are being set before saying you should make this code change.

hi @TheRealAmazonKendra thanks for your review.

you are correct that for my specific use case I only need to update one or two values, but my intention with this PR is to address the issue of aws-cdk-lib/aws-eks package not exposing the ability to set whatever values the user wants (apart from the ones it is already setting).

the AlbController is just a thin wrapper around the HelmChart construct, yet its constructor's props do not expose any ability to pass values to the underlying helm chart. IMO this was a poor design choice, as I don't think aws-cdk should be the arbiter of which values can be passed to the aws-load-balancer-controller helm chart.

the initial implementation of the Cluster construct did not include any props related to the albController. They were later added as a convenience due to the fact that it is commonly utilized to integrate with aws elbv2. my assumption is that the AlbController construct was defined at the same time, due to the fact that AlbControllerOptions = Omit<AlbControllerProps, 'cluster'>. However, the lack of an interface exposing configuration of the helm chart's values means that any user leveraging aws firewall manager either cannot use the "official" construct for the helm chart, or they have to accept that aws-load-balancer-controller will periodically disassociate an fms-applied web acl and their albs willbe unprotected until fms can detect & remediate (usually this is a couple minutes, but we have had occurrences of the remediation failing and albs being unprotected for hours).

Due to the fact that a helm chart's values.yml is the way in which every helm chart's default behavior is overridden, i feel that adding a prop for passing values to the AlbController is a valid design choice. There may be other default behaviors of the helm chart beyond waf management that users may want to disable. Due to the fact that the supported values for aws-load-balancer-controller may vary from one version to the next, I didn't feel it was wise to define a type/interface for a subset of configurable values that will then need to be kept up-to-date. I think if users decide to pass values to the AlbController, they are at the point where they know they need to and we should trust that they are able to decide which values to set.

as far as your suggestion for a function to update values after instantiation, this would need to be exposed on both the AlbController construct and the HelmChart construct. i feel like this is not a great approach and it expands the scope of the solution beyond the AlbController construct.

in short, i feel that this is a fix for an overly-restrictive construct props definition.

Hello, I would also want to be able to edit values through this way, in my case for values enableCertManager, cluster.dnsDomain and some more.
I wonder why this functionality wasn't introduced from the beginning...

Necrokefalos · 2024-07-09T08:25:47Z

Hi, any updates or estimation on this? Can i help somehow?

Pull request has been modified.

aws-cdk-automation

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

mtrspringer · 2024-07-09T10:34:32Z

hi @Necrokefalos im still waiting on a response as to what changes, if any, need to be made. good to know that the values also need to be modified for cert-manager as we are looking to adopt that sometime soon. in the meantime i think the integration tests need to be run again before the checks pass. @paulhcsun would you be able to do that again at your earliest convenience? thanks.

…ller

aws-cdk-automation · 2024-07-10T17:26:46Z

The pull request linter fails with the following errors:

❌ Features must contain a change to an integration test file and the resulting snapshot.

PRs must pass status checks before we can provide a meaningful review.

If you would like to request an exemption from the status checks or clarification on feedback, please leave a comment on this PR containing Exemption Request and/or Clarification Request.

aws-cdk-automation · 2024-07-10T17:47:34Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: ab070af
Result: FAILED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

github-actions bot added the beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK label Apr 4, 2024

aws-cdk-automation requested a review from a team April 4, 2024 11:47

github-actions bot added feature-request A feature should be added or improved. p2 labels Apr 4, 2024

aws-cdk-automation previously requested changes Apr 4, 2024

View reviewed changes

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Apr 5, 2024

mtrspringer force-pushed the aws-eks-alb-controller-values branch from ec6de8a to afcd343 Compare April 5, 2024 15:26

lpizzinidev approved these changes Apr 6, 2024

View reviewed changes

packages/aws-cdk-lib/aws-eks/lib/alb-controller.ts Outdated Show resolved Hide resolved

packages/aws-cdk-lib/aws-eks/README.md Outdated Show resolved Hide resolved

aws-cdk-automation added pr/needs-maintainer-review This PR needs a review from a Core Team Member and removed pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. labels Apr 6, 2024

github-actions bot mentioned this pull request Apr 8, 2024

Weekly PR metrics report #29758

Closed

mtrspringer force-pushed the aws-eks-alb-controller-values branch 3 times, most recently from 2926163 to 5e9a3f6 Compare April 16, 2024 09:36

paulhcsun self-assigned this Apr 18, 2024

paulhcsun previously requested changes Apr 19, 2024

View reviewed changes

github-actions bot mentioned this pull request May 1, 2024

Monthly PR metrics report #30026

Closed

mtrspringer force-pushed the aws-eks-alb-controller-values branch from 5e9a3f6 to 4289418 Compare May 13, 2024 16:44

mtrspringer force-pushed the aws-eks-alb-controller-values branch 2 times, most recently from 4625454 to b55781a Compare May 22, 2024 14:05

mtrspringer force-pushed the aws-eks-alb-controller-values branch from b55781a to cd2f5a8 Compare May 24, 2024 12:20

mtrspringer force-pushed the aws-eks-alb-controller-values branch from cd2f5a8 to 0d9c286 Compare June 7, 2024 15:10

mtrspringer force-pushed the aws-eks-alb-controller-values branch 3 times, most recently from bff33f3 to 285af63 Compare June 11, 2024 10:52

TheRealAmazonKendra previously requested changes Jun 18, 2024

View reviewed changes

mtrspringer force-pushed the aws-eks-alb-controller-values branch from 81733cc to 89d6dbd Compare July 9, 2024 10:32

aws-cdk-automation requested changes Jul 9, 2024

View reviewed changes

mtrspringer added 4 commits July 10, 2024 18:24

add support for passing helm chart values to aws-load-balancer-contro…

91bfb8a

…ller

add readme, integration test

bb4116e

fix test stack name

ff93842

changes from code review

ab070af

mtrspringer force-pushed the aws-eks-alb-controller-values branch from 89d6dbd to ab070af Compare July 10, 2024 17:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(eks): pass helm chart values to aws-load-balancer-controller #29723

feat(eks): pass helm chart values to aws-load-balancer-controller #29723

mtrspringer commented Apr 4, 2024

aws-cdk-automation left a comment

lpizzinidev left a comment

paulhcsun Apr 19, 2024 •

edited

Loading

mtrspringer Apr 26, 2024

paulhcsun Apr 19, 2024

mtrspringer Apr 26, 2024

paulhcsun Apr 26, 2024

mtrspringer May 13, 2024

paulhcsun May 14, 2024

paulhcsun May 17, 2024

paulhcsun May 21, 2024 •

edited

Loading

mtrspringer May 24, 2024

paulhcsun commented May 28, 2024

mtrspringer commented Jun 7, 2024

mtrspringer commented Jun 11, 2024

TheRealAmazonKendra Jun 18, 2024

TheRealAmazonKendra Jun 18, 2024

mtrspringer Jun 25, 2024

Necrokefalos Jun 28, 2024

Necrokefalos commented Jul 9, 2024

aws-cdk-automation left a comment

mtrspringer commented Jul 9, 2024

aws-cdk-automation commented Jul 10, 2024

aws-cdk-automation commented Jul 10, 2024

	readonly values?: {[key: string]: any};
	readonly helmChartValues?: {[key: string]: any};

feat(eks): pass helm chart values to aws-load-balancer-controller #29723

Are you sure you want to change the base?

feat(eks): pass helm chart values to aws-load-balancer-controller #29723

Conversation

mtrspringer commented Apr 4, 2024

Issue # (if applicable)

Reason for this change

Description of changes

Description of how you validated changes

Checklist

aws-cdk-automation left a comment

Choose a reason for hiding this comment

lpizzinidev left a comment

Choose a reason for hiding this comment

paulhcsun Apr 19, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

paulhcsun May 21, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

paulhcsun commented May 28, 2024

mtrspringer commented Jun 7, 2024

mtrspringer commented Jun 11, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Necrokefalos commented Jul 9, 2024

aws-cdk-automation left a comment

Choose a reason for hiding this comment

mtrspringer commented Jul 9, 2024

aws-cdk-automation commented Jul 10, 2024

aws-cdk-automation commented Jul 10, 2024

AWS CodeBuild CI Report

paulhcsun Apr 19, 2024 •

edited

Loading

paulhcsun May 21, 2024 •

edited

Loading