Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add create cluster flag for enabling IRSA #12741

Merged
merged 1 commit into from
Nov 15, 2021
Merged

Add create cluster flag for enabling IRSA #12741

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions cmd/kops/create_cluster.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -219,6 +219,11 @@ func NewCmdCreateCluster(f *util.Factory, out io.Writer) *cobra.Command {
return nil, cobra.ShellCompDirectiveNoFileComp
})
}
cmd.Flags().StringVar(&options.DiscoveryStore, "discovery-store", options.DiscoveryStore, "A public location where we publish OIDC-compatible discovery information under a cluster-specific directory. Enables IRSA in AWS.")
cmd.RegisterFlagCompletionFunc("discovery-store", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
// TODO complete vfs paths
return nil, cobra.ShellCompDirectiveNoFileComp
})

var validClouds []string
{
Expand Down
1 change: 1 addition & 0 deletions docs/cli/kops_create_cluster.md
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions docs/releases/1.23-NOTES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,9 @@ This is a document to gather the release notes prior to the release.

# Other changes of note

* The `kops create cluster` command has a new `--discovery-store` flag for specifying a public store for the OIDC-compatible discovery documents.
If this flag is used in AWS, it will enable IRSA.

* If `externalDns.provider` is `external-dns`, then `externalDns.watchIngress` will now default to `true`.

# Full change list since 1.22.0 release
Expand Down
17 changes: 17 additions & 0 deletions upup/pkg/fi/cloudup/new_cluster.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@ import (
"k8s.io/kops/upup/pkg/fi/cloudup/azure"
"k8s.io/kops/upup/pkg/fi/cloudup/gce"
"k8s.io/kops/upup/pkg/fi/cloudup/openstack"
"k8s.io/kops/util/pkg/vfs"
)

const (
Expand All @@ -57,6 +58,8 @@ type NewClusterOptions struct {
Channel string
// ConfigBase is the location where we will store the configuration. It defaults to the state store.
ConfigBase string
// DiscoveryStore is the location where we will store public OIDC-compatible discovery documents, under a cluster-specific directory. It defaults to not publishing discovery documents.
DiscoveryStore string
// KubernetesVersion is the version of Kubernetes to deploy. It defaults to the version recommended by the channel.
KubernetesVersion string
// AdminAccess is the set of CIDR blocks permitted to connect to the Kubernetes API. It defaults to "0.0.0.0/0" and "::/0".
Expand Down Expand Up @@ -255,6 +258,20 @@ func NewCluster(opt *NewClusterOptions, clientset simple.Clientset) (*NewCluster
}
}

if opt.DiscoveryStore != "" {
discoveryPath, err := vfs.Context.BuildVfsPath(opt.DiscoveryStore)
if err != nil {
return nil, fmt.Errorf("error building DiscoveryStore for cluster: %v", err)
}
cluster.Spec.ServiceAccountIssuerDiscovery = &api.ServiceAccountIssuerDiscoveryConfig{
DiscoveryStore: discoveryPath.Join(cluster.Name).Path(),
}
if cluster.Spec.CloudProvider == string(api.CloudProviderAWS) {
cluster.Spec.ServiceAccountIssuerDiscovery.EnableAWSOIDCProvider = true
cluster.Spec.IAM.UseServiceAccountExternalPermissions = fi.Bool(true)
}
}

err = setupVPC(opt, &cluster)
if err != nil {
return nil, err
Expand Down