diff --git a/humans.txt b/humans.txt index 5d5f2989e2..6d85120c66 100644 --- a/humans.txt +++ b/humans.txt @@ -39,6 +39,7 @@ Roli Schilter @rndstr Mitchel Humpherys @mgalgs Fred Cox @mcfedr Adam Johnson @adamjohnson01 +Paul Maddox @paulmaddox Patrick Spek @tyil /* Thanks */ diff --git a/pkg/apis/eksctl.io/v1alpha5/defaults.go b/pkg/apis/eksctl.io/v1alpha5/defaults.go index 76e8429efb..3662dff079 100644 --- a/pkg/apis/eksctl.io/v1alpha5/defaults.go +++ b/pkg/apis/eksctl.io/v1alpha5/defaults.go @@ -64,6 +64,9 @@ func SetNodeGroupDefaults(_ int, ng *NodeGroup) error { if ng.IAM.WithAddonPolicies.ALBIngress == nil { ng.IAM.WithAddonPolicies.ALBIngress = Disabled() } + if ng.IAM.WithAddonPolicies.XRay == nil { + ng.IAM.WithAddonPolicies.XRay = Disabled() + } if ng.IAM.WithAddonPolicies.EBS == nil { ng.IAM.WithAddonPolicies.EBS = Disabled() } diff --git a/pkg/apis/eksctl.io/v1alpha5/types.go b/pkg/apis/eksctl.io/v1alpha5/types.go index 73e986082a..69f2312d00 100644 --- a/pkg/apis/eksctl.io/v1alpha5/types.go +++ b/pkg/apis/eksctl.io/v1alpha5/types.go @@ -355,6 +355,7 @@ func (c *ClusterConfig) NewNodeGroup() *NodeGroup { FSX: Disabled(), EFS: Disabled(), ALBIngress: Disabled(), + XRay: Disabled(), }, }, SSH: &NodeGroupSSH{ @@ -476,6 +477,8 @@ type ( EFS *bool `json:"efs"` // +optional ALBIngress *bool `json:"albIngress"` + // +optional + XRay *bool `json:"xRay"` } // NodeGroupSSH holds all the ssh access configuration to a NodeGroup diff --git a/pkg/apis/eksctl.io/v1alpha5/validation.go b/pkg/apis/eksctl.io/v1alpha5/validation.go index c036eb0aeb..3c2e9ca296 100644 --- a/pkg/apis/eksctl.io/v1alpha5/validation.go +++ b/pkg/apis/eksctl.io/v1alpha5/validation.go @@ -40,6 +40,9 @@ func validateNodeGroupIAM(i int, ng *NodeGroup, value, fieldName, path string) e if IsEnabled(ng.IAM.WithAddonPolicies.ALBIngress) { return fmt.Errorf("%s.albIngress cannot be set at the same time", p) } + if IsEnabled(ng.IAM.WithAddonPolicies.XRay) { + return fmt.Errorf("%s.xRay cannot be set at the same time", p) + } } return nil } diff --git a/pkg/apis/eksctl.io/v1alpha5/zz_generated.deepcopy.go b/pkg/apis/eksctl.io/v1alpha5/zz_generated.deepcopy.go index 3403c81e9d..d12c6d09fa 100644 --- a/pkg/apis/eksctl.io/v1alpha5/zz_generated.deepcopy.go +++ b/pkg/apis/eksctl.io/v1alpha5/zz_generated.deepcopy.go @@ -414,6 +414,11 @@ func (in *NodeGroupIAMAddonPolicies) DeepCopyInto(out *NodeGroupIAMAddonPolicies *out = new(bool) **out = **in } + if in.XRay != nil { + in, out := &in.XRay, &out.XRay + *out = new(bool) + **out = **in + } return } diff --git a/pkg/cfn/builder/api_test.go b/pkg/cfn/builder/api_test.go index d962b8505c..02d0fc359d 100644 --- a/pkg/cfn/builder/api_test.go +++ b/pkg/cfn/builder/api_test.go @@ -389,6 +389,7 @@ var _ = Describe("CloudFormation template builder API", func() { FSX: api.Disabled(), EFS: api.Disabled(), ALBIngress: api.Disabled(), + XRay: api.Disabled(), }, }, SSH: &api.NodeGroupSSH{ @@ -962,6 +963,39 @@ var _ = Describe("CloudFormation template builder API", func() { }) + Context("NodeGroupXRay", func() { + cfg, ng := newClusterConfigAndNodegroup(true) + + ng.IAM.WithAddonPolicies.XRay = api.Enabled() + + build(cfg, "eksctl-test-megaapps-cluster", ng) + + roundtrip() + + It("should have correct policies", func() { + Expect(ngTemplate.Resources).ToNot(BeEmpty()) + + Expect(ngTemplate.Resources).To(HaveKey("PolicyXRay")) + + policy := ngTemplate.Resources["PolicyXRay"].Properties + + Expect(policy.Roles).To(HaveLen(1)) + isRefTo(policy.Roles[0], "NodeInstanceRole") + + Expect(policy.PolicyDocument.Statement).To(HaveLen(1)) + Expect(policy.PolicyDocument.Statement[0].Effect).To(Equal("Allow")) + Expect(policy.PolicyDocument.Statement[0].Resource).To(Equal("*")) + Expect(policy.PolicyDocument.Statement[0].Action).To(Equal([]string{ + "xray:PutTraceSegments", + "xray:PutTelemetryRecords", + "xray:GetSamplingRules", + "xray:GetSamplingTargets", + "xray:GetSamplingStatisticSummaries", + })) + }) + + }) + Context("NodeGroupEBS", func() { cfg, ng := newClusterConfigAndNodegroup(true) diff --git a/pkg/cfn/builder/iam.go b/pkg/cfn/builder/iam.go index b07fb19f72..c72d3dc10d 100644 --- a/pkg/cfn/builder/iam.go +++ b/pkg/cfn/builder/iam.go @@ -343,6 +343,18 @@ func (n *NodeGroupResourceSet) addResourcesForIAM() { ) } + if api.IsEnabled(n.spec.IAM.WithAddonPolicies.XRay) { + n.rs.attachAllowPolicy("PolicyXRay", refIR, "*", + []string{ + "xray:PutTraceSegments", + "xray:PutTelemetryRecords", + "xray:GetSamplingRules", + "xray:GetSamplingTargets", + "xray:GetSamplingStatisticSummaries", + }, + ) + } + n.rs.defineOutputFromAtt(outputs.NodeGroupInstanceProfileARN, "NodeInstanceProfile.Arn", true, func(v string) error { n.spec.IAM.InstanceProfileARN = v return nil diff --git a/pkg/ctl/cmdutils/nodegroup_filter_test.go b/pkg/ctl/cmdutils/nodegroup_filter_test.go index 8d7f658d50..6ec5636a0c 100644 --- a/pkg/ctl/cmdutils/nodegroup_filter_test.go +++ b/pkg/ctl/cmdutils/nodegroup_filter_test.go @@ -344,7 +344,8 @@ const expected = ` "ebs": false, "fsx": false, "efs": false, - "albIngress": false + "albIngress": false, + "xRay": false } } }, @@ -379,7 +380,8 @@ const expected = ` "ebs": false, "fsx": false, "efs": false, - "albIngress": false + "albIngress": false, + "xRay": false } } }, @@ -412,7 +414,8 @@ const expected = ` "ebs": false, "fsx": false, "efs": false, - "albIngress": false + "albIngress": false, + "xRay": false } }, "clusterDNS": "1.2.3.4" @@ -446,7 +449,8 @@ const expected = ` "ebs": false, "fsx": false, "efs": false, - "albIngress": false + "albIngress": false, + "xRay": false } } }, @@ -482,7 +486,8 @@ const expected = ` "ebs": false, "fsx": false, "efs": false, - "albIngress": false + "albIngress": false, + "xRay": false } }, "clusterDNS": "4.2.8.14" @@ -519,7 +524,8 @@ const expected = ` "ebs": false, "fsx": false, "efs": false, - "albIngress": false + "albIngress": false, + "xRay": false } } } diff --git a/pkg/ctl/cmdutils/nodegroup_flags.go b/pkg/ctl/cmdutils/nodegroup_flags.go index 382d40b735..f9a4923da1 100644 --- a/pkg/ctl/cmdutils/nodegroup_flags.go +++ b/pkg/ctl/cmdutils/nodegroup_flags.go @@ -57,6 +57,7 @@ func AddCommonCreateNodeGroupIAMAddonsFlags(fs *pflag.FlagSet, ng *api.NodeGroup ng.IAM.WithAddonPolicies.ImageBuilder = new(bool) ng.IAM.WithAddonPolicies.AppMesh = new(bool) ng.IAM.WithAddonPolicies.ALBIngress = new(bool) + ng.IAM.WithAddonPolicies.XRay = new(bool) fs.BoolVar(ng.IAM.WithAddonPolicies.AutoScaler, "asg-access", false, "enable IAM policy for cluster-autoscaler") fs.BoolVar(ng.IAM.WithAddonPolicies.ExternalDNS, "external-dns-access", false, "enable IAM policy for external-dns") fs.BoolVar(ng.IAM.WithAddonPolicies.ImageBuilder, "full-ecr-access", false, "enable full access to ECR")