Skip to content

Commit

Permalink
Add support for App Mesh Preview Environment
Browse files Browse the repository at this point in the history 
- add appMeshPreview addon policy
- add appmesh-preview-access flag to node groups

Signed-off-by: stefanprodan <stefan.prodan@gmail.com>
  • Loading branch information
@stefanprodan
stefanprodan committed Jun 10, 2020
1 parent 043fff5 commit 23fe673
Show file tree
Hide file tree
Showing 19 changed files with 171 additions and 148 deletions.
4 changes: 4 additions & 0 deletions pkg/apis/eksctl.io/v1alpha5/assets/schema.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -915,6 +915,9 @@
"appMesh": {
"type": "boolean"
},
"appMeshPreview": {
"type": "boolean"
},
"autoScaler": {
"type": "boolean"
},
Expand Down Expand Up @@ -949,6 +952,7 @@
"externalDNS",
"certManager",
"appMesh",
"appMeshPreview",
"ebs",
"fsx",
"efs",
Expand Down
6 changes: 3 additions & 3 deletions pkg/apis/eksctl.io/v1alpha5/schema.go
View file

Large diffs are not rendered by default.

48 changes: 26 additions & 22 deletions pkg/apis/eksctl.io/v1alpha5/types.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -559,17 +559,18 @@ func NewNodeGroup() *NodeGroup {
VolumeType: &DefaultNodeVolumeType,
IAM: &NodeGroupIAM{
WithAddonPolicies: NodeGroupIAMAddonPolicies{
ImageBuilder: Disabled(),
AutoScaler: Disabled(),
ExternalDNS: Disabled(),
CertManager: Disabled(),
AppMesh: Disabled(),
EBS: Disabled(),
FSX: Disabled(),
EFS: Disabled(),
ALBIngress: Disabled(),
XRay: Disabled(),
CloudWatch: Disabled(),
ImageBuilder: Disabled(),
AutoScaler: Disabled(),
ExternalDNS: Disabled(),
CertManager: Disabled(),
AppMesh: Disabled(),
AppMeshPreview: Disabled(),
EBS: Disabled(),
FSX: Disabled(),
EFS: Disabled(),
ALBIngress: Disabled(),
XRay: Disabled(),
CloudWatch: Disabled(),
},
},
SSH: &NodeGroupSSH{
Expand All @@ -594,17 +595,18 @@ func NewManagedNodeGroup() *ManagedNodeGroup {
},
IAM: &NodeGroupIAM{
WithAddonPolicies: NodeGroupIAMAddonPolicies{
ImageBuilder: Disabled(),
AutoScaler: Disabled(),
ExternalDNS: Disabled(),
CertManager: Disabled(),
AppMesh: Disabled(),
EBS: Disabled(),
FSX: Disabled(),
EFS: Disabled(),
ALBIngress: Disabled(),
XRay: Disabled(),
CloudWatch: Disabled(),
ImageBuilder: Disabled(),
AutoScaler: Disabled(),
ExternalDNS: Disabled(),
CertManager: Disabled(),
AppMesh: Disabled(),
AppMeshPreview: Disabled(),
EBS: Disabled(),
FSX: Disabled(),
EFS: Disabled(),
ALBIngress: Disabled(),
XRay: Disabled(),
CloudWatch: Disabled(),
},
},
}
Expand Down Expand Up @@ -840,6 +842,8 @@ type (
// +optional
AppMesh *bool `json:"appMesh"`
// +optional
AppMeshPreview *bool `json:"appMeshPreview"`
// +optional
EBS *bool `json:"ebs"`
// +optional
FSX *bool `json:"fsx"`
Expand Down
3 changes: 3 additions & 0 deletions pkg/apis/eksctl.io/v1alpha5/validation.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -318,6 +318,9 @@ func validateNodeGroupIAM(iam *NodeGroupIAM, value, fieldName, path string) erro
if IsEnabled(iam.WithAddonPolicies.AppMesh) {
return fmtFieldConflictErr(prefix + "appMesh")
}
if IsEnabled(iam.WithAddonPolicies.AppMeshPreview) {
return fmtFieldConflictErr(prefix + "appMeshPreview")
}
if IsEnabled(iam.WithAddonPolicies.EBS) {
return fmtFieldConflictErr(prefix + "ebs")
}
Expand Down
5 changes: 5 additions & 0 deletions pkg/apis/eksctl.io/v1alpha5/zz_generated.deepcopy.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

89 changes: 58 additions & 31 deletions pkg/cfn/builder/api_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -187,6 +187,26 @@ users:
{{end}}
`))

var appMeshActions = []string{
"servicediscovery:CreateService",
"servicediscovery:DeleteService",
"servicediscovery:GetService",
"servicediscovery:GetInstance",
"servicediscovery:RegisterInstance",
"servicediscovery:DeregisterInstance",
"servicediscovery:ListInstances",
"servicediscovery:ListNamespaces",
"servicediscovery:ListServices",
"servicediscovery:GetInstancesHealthStatus",
"servicediscovery:UpdateInstanceCustomHealthStatus",
"servicediscovery:GetOperation",
"route53:GetHealthCheck",
"route53:CreateHealthCheck",
"route53:UpdateHealthCheck",
"route53:ChangeResourceRecordSets",
"route53:DeleteHealthCheck",
}

func kubeconfigBody(authenticator string) string {
var out bytes.Buffer
region := "us-west-2"
Expand Down Expand Up @@ -484,17 +504,18 @@ var _ = Describe("CloudFormation template builder API", func() {
VolumeKmsKeyID: aws.String(""),
IAM: &api.NodeGroupIAM{
WithAddonPolicies: api.NodeGroupIAMAddonPolicies{
ImageBuilder: api.Disabled(),
AutoScaler: api.Disabled(),
ExternalDNS: api.Disabled(),
CertManager: api.Disabled(),
AppMesh: api.Disabled(),
EBS: api.Disabled(),
FSX: api.Disabled(),
EFS: api.Disabled(),
ALBIngress: api.Disabled(),
XRay: api.Disabled(),
CloudWatch: api.Disabled(),
ImageBuilder: api.Disabled(),
AutoScaler: api.Disabled(),
ExternalDNS: api.Disabled(),
CertManager: api.Disabled(),
AppMesh: api.Disabled(),
AppMeshPreview: api.Disabled(),
EBS: api.Disabled(),
FSX: api.Disabled(),
EFS: api.Disabled(),
ALBIngress: api.Disabled(),
XRay: api.Disabled(),
CloudWatch: api.Disabled(),
},
},
SSH: &api.NodeGroupSSH{
Expand Down Expand Up @@ -1043,6 +1064,7 @@ var _ = Describe("CloudFormation template builder API", func() {
Expect(ngTemplate.Resources).ToNot(HaveKey("PolicyExternalDNSChangeSet"))
Expect(ngTemplate.Resources).ToNot(HaveKey("PolicyExternalDNSHostedZones"))
Expect(ngTemplate.Resources).ToNot(HaveKey("PolicyAppMesh"))
Expect(ngTemplate.Resources).ToNot(HaveKey("PolicyAppMeshPreview"))
Expect(ngTemplate.Resources).ToNot(HaveKey("PolicyEBS"))
Expect(ngTemplate.Resources).ToNot(HaveKey("PolicyFSX"))
Expect(ngTemplate.Resources).ToNot(HaveKey("PolicyServiceLinkRole"))
Expand Down Expand Up @@ -1109,33 +1131,38 @@ var _ = Describe("CloudFormation template builder API", func() {
Expect(policy3.PolicyDocument.Statement).To(HaveLen(1))
Expect(policy3.PolicyDocument.Statement[0].Effect).To(Equal("Allow"))
Expect(policy3.PolicyDocument.Statement[0].Resource).To(Equal("*"))
Expect(policy3.PolicyDocument.Statement[0].Action).To(Equal([]string{
"appmesh:*",
"servicediscovery:CreateService",
"servicediscovery:DeleteService",
"servicediscovery:GetService",
"servicediscovery:GetInstance",
"servicediscovery:RegisterInstance",
"servicediscovery:DeregisterInstance",
"servicediscovery:ListInstances",
"servicediscovery:ListNamespaces",
"servicediscovery:ListServices",
"servicediscovery:GetInstancesHealthStatus",
"servicediscovery:UpdateInstanceCustomHealthStatus",
"servicediscovery:GetOperation",
"route53:GetHealthCheck",
"route53:CreateHealthCheck",
"route53:UpdateHealthCheck",
"route53:ChangeResourceRecordSets",
"route53:DeleteHealthCheck",
}))
Expect(policy3.PolicyDocument.Statement[0].Action).To(Equal(append(appMeshActions, "appmesh:*")))

Expect(ngTemplate.Resources).ToNot(HaveKey("PolicyEBS"))
Expect(ngTemplate.Resources).ToNot(HaveKey("PolicyAutoScaling"))
})

})

Context("NodeGroupAppMeshPreview", func() {
cfg, ng := newClusterConfigAndNodegroup(true)

ng.IAM.WithAddonPolicies.AppMeshPreview = api.Enabled()

build(cfg, "eksctl-test-appmesh-preview", ng)

roundtrip()

It("should have correct policies", func() {
Expect(ngTemplate.Resources).To(HaveKey("PolicyAppMeshPreview"))

policy3 := ngTemplate.Resources["PolicyAppMeshPreview"].Properties

Expect(policy3.Roles).To(HaveLen(1))
isRefTo(policy3.Roles[0], "NodeInstanceRole")

Expect(policy3.PolicyDocument.Statement).To(HaveLen(1))
Expect(policy3.PolicyDocument.Statement[0].Effect).To(Equal("Allow"))
Expect(policy3.PolicyDocument.Statement[0].Resource).To(Equal("*"))
Expect(policy3.PolicyDocument.Statement[0].Action).To(Equal(append(appMeshActions, "appmesh-preview:*")))
})
})

Context("NodeGroupAppCertManager", func() {
cfg, ng := newClusterConfigAndNodegroup(true)

Expand Down
47 changes: 27 additions & 20 deletions pkg/cfn/builder/iam_helper.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -90,28 +90,35 @@ func createRole(cfnTemplate cfnTemplate, iamConfig *api.NodeGroupIAM, managed bo
)
}

appMeshActions := []string{
"servicediscovery:CreateService",
"servicediscovery:DeleteService",
"servicediscovery:GetService",
"servicediscovery:GetInstance",
"servicediscovery:RegisterInstance",
"servicediscovery:DeregisterInstance",
"servicediscovery:ListInstances",
"servicediscovery:ListNamespaces",
"servicediscovery:ListServices",
"servicediscovery:GetInstancesHealthStatus",
"servicediscovery:UpdateInstanceCustomHealthStatus",
"servicediscovery:GetOperation",
"route53:GetHealthCheck",
"route53:CreateHealthCheck",
"route53:UpdateHealthCheck",
"route53:ChangeResourceRecordSets",
"route53:DeleteHealthCheck",
}

if api.IsEnabled(iamConfig.WithAddonPolicies.AppMesh) {
cfnTemplate.attachAllowPolicy("PolicyAppMesh", refIR, "*",
[]string{
"appmesh:*",
"servicediscovery:CreateService",
"servicediscovery:DeleteService",
"servicediscovery:GetService",
"servicediscovery:GetInstance",
"servicediscovery:RegisterInstance",
"servicediscovery:DeregisterInstance",
"servicediscovery:ListInstances",
"servicediscovery:ListNamespaces",
"servicediscovery:ListServices",
"servicediscovery:GetInstancesHealthStatus",
"servicediscovery:UpdateInstanceCustomHealthStatus",
"servicediscovery:GetOperation",
"route53:GetHealthCheck",
"route53:CreateHealthCheck",
"route53:UpdateHealthCheck",
"route53:ChangeResourceRecordSets",
"route53:DeleteHealthCheck",
},
append(appMeshActions, "appmesh:*"),
)
}

if api.IsEnabled(iamConfig.WithAddonPolicies.AppMeshPreview) {
cfnTemplate.attachAllowPolicy("PolicyAppMeshPreview", refIR, "*",
append(appMeshActions, "appmesh-preview:*"),
)
}

Expand Down
6 changes: 6 additions & 0 deletions pkg/ctl/cmdutils/nodegroup_filter_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -389,6 +389,7 @@ const expected = `
"externalDNS": false,
"certManager": false,
"appMesh": false,
"appMeshPreview": false,
"ebs": false,
"fsx": false,
"efs": false,
Expand Down Expand Up @@ -428,6 +429,7 @@ const expected = `
"externalDNS": false,
"certManager": false,
"appMesh": false,
"appMeshPreview": false,
"ebs": false,
"fsx": false,
"efs": false,
Expand Down Expand Up @@ -465,6 +467,7 @@ const expected = `
"externalDNS": false,
"certManager": false,
"appMesh": false,
"appMeshPreview": false,
"ebs": false,
"fsx": false,
"efs": false,
Expand Down Expand Up @@ -503,6 +506,7 @@ const expected = `
"externalDNS": false,
"certManager": false,
"appMesh": false,
"appMeshPreview": false,
"ebs": false,
"fsx": false,
"efs": false,
Expand Down Expand Up @@ -543,6 +547,7 @@ const expected = `
"externalDNS": false,
"certManager": false,
"appMesh": false,
"appMeshPreview": false,
"ebs": false,
"fsx": false,
"efs": false,
Expand Down Expand Up @@ -584,6 +589,7 @@ const expected = `
"externalDNS": false,
"certManager": false,
"appMesh": false,
"appMeshPreview": false,
"ebs": false,
"fsx": false,
"efs": false,
Expand Down
2 changes: 2 additions & 0 deletions pkg/ctl/cmdutils/nodegroup_flags.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -67,13 +67,15 @@ func AddCommonCreateNodeGroupIAMAddonsFlags(fs *pflag.FlagSet, ng *api.NodeGroup
ng.IAM.WithAddonPolicies.ExternalDNS = new(bool)
ng.IAM.WithAddonPolicies.ImageBuilder = new(bool)
ng.IAM.WithAddonPolicies.AppMesh = new(bool)
ng.IAM.WithAddonPolicies.AppMeshPreview = new(bool)
ng.IAM.WithAddonPolicies.ALBIngress = new(bool)
ng.IAM.WithAddonPolicies.XRay = new(bool)
ng.IAM.WithAddonPolicies.CloudWatch = new(bool)
fs.BoolVar(ng.IAM.WithAddonPolicies.AutoScaler, "asg-access", false, "enable IAM policy for cluster-autoscaler")
fs.BoolVar(ng.IAM.WithAddonPolicies.ExternalDNS, "external-dns-access", false, "enable IAM policy for external-dns")
fs.BoolVar(ng.IAM.WithAddonPolicies.ImageBuilder, "full-ecr-access", false, "enable full access to ECR")
fs.BoolVar(ng.IAM.WithAddonPolicies.AppMesh, "appmesh-access", false, "enable full access to AppMesh")
fs.BoolVar(ng.IAM.WithAddonPolicies.AppMeshPreview, "appmesh-preview-access", false, "enable full access to AppMesh Preview")
fs.BoolVar(ng.IAM.WithAddonPolicies.ALBIngress, "alb-ingress-access", false, "enable full access for alb-ingress-controller")
}

Expand Down
12 changes: 4 additions & 8 deletions pkg/eks/mocks/CloudFormationAPI.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

12 changes: 4 additions & 8 deletions pkg/eks/mocks/CloudTrailAPI.go
View file

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

0 comments on commit 23fe673

Please sign in to comment.