[aws-eks] expose EncryptionConfig in eks.Cluster Construct

[nicolai86]

❓ General Issue

Cloudformation supports passing in an EncryptionConfig when creating an EKS cluster.
CDK only exposes EncryptionConfig in the CfnCluster construct, not the high level eks.Cluster Construct.

The Question

Can we expose encryptionConfig as part of ClusterProps to allow this to be managed with the higher level CDK construct?

Environment

• CDK CLI Version: 1.51.0
• Module Version: 1.51.0
• Node.js Version: v12.18.2
• OS: OSX Mojave
• Language (Version): TypeScript

Other information

CfnCluster exposes EncryptionConfig
https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-eks.CfnClusterProps.html#encryptionconfig
ClusterProps does not expose EncryptionConfig
https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-eks.ClusterProps.html

[davidsung]

Hi @iliapolo , I could contribute PR for this issue if nobody else started working on this. Could you help reviewing my PR? I have done all the logic and need to finish the integration test before submitting the PR. Thanks a lot!

[iliapolo]

@davidsung that would be great! Happy to review

[SaikiranDaripelli]

Is there any workaround until this is merged? as it is not possible to edit the config after cluster creation.

[iliapolo]

@SaikiranDaripelli If you are using kubectlEnabled: false, you can use escape hatches to manipulate the underlying CFN configuration.

If you are using kubectlEnabled: true (or just omitted) there currently is no way since it is implemented with a custom resource.

However, I wouldn't recommend using kubectlEnabled: false and escape hatches as this will soon be deprecated and eventually removed. See discussion here: #9332.

I dont imagine it would take very long for this PR to be merged. Stay tuned.

[eladb]

#9472

[arul-gupta]

There also seems to an issue with AWS lambda runtime used to create custom resource. The latest nodejs12.x runtime uses AWS-SDK v2.631.0 which doesn't seem to have support for encryption. I get the following error:

Failed to create resource. Error: Unexpected key 'encryptionConfig' found in params
at invokeUserFunction (/var/task/framework.js:85:19)
at process._tickCallback (internal/process/next_tick.js:68:7)
Remote function error: UnexpectedParameter: Unexpected key 'encryptionConfig' found in params
at ParamValidator.fail (/var/runtime/node_modules/aws-sdk/lib/param_validator.js:50:37)
at ParamValidator.validateStructure (/var/runtime/node_modules/aws-sdk/lib/param_validator.js:77:14)
at ParamValidator.validateMember (/var/runtime/node_modules/aws-sdk/lib/param_validator.js:88:21)
at ParamValidator.validate (/var/runtime/node_modules/aws-sdk/lib/param_validator.js:34:10)
at Request.VALIDATE_PARAMETERS (/var/runtime/node_modules/aws-sdk/lib/event_listeners.js:126:42)
at Request.callListeners (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:106:20)
at callNextListener (/var/runtime/node_modules/aws-sdk/lib/sequential_executor.js:96:12)
at /var/runtime/node_modules/aw

AWS-SDK added support for envelope encryption only in v2.634.0.

[eladb]

Indeed this API is still not supported by the AWS Lambda node.js runtime. Let's wait until lambda the SDK version in their runtime and then we can merge this.

[davidsung]

As figured out by @pahud, the aws-sdk version in the Lambda node12.x runtime env in most AWS regions is now 2.712.0 (already tested on us-east-1, us-east-2, ap-southeast-1, ap-northeast-1, ap-southeast-2, eu-central-1, eu-west-1, eu-west-2, sa-east-1). We thought the docs https://docs.aws.amazon.com/lambda/latest/dg/lambda-runtimes.html is outdated.

Tested with Lambda function:

const aws = require('aws-sdk');

exports.handler = async (event) => {
  console.log("request:", JSON.stringify(event, undefined, 2));
  const response = {
    statusCode: 200,
    body: JSON.stringify({version: aws.VERSION}),
  };
  return response;
};

[eladb]

Thanks for testing this. I am following up with the Lambda team to validate.

[davidsung]

@eladb Kindly take note that the version specified in the Lambda runtime docs has been updated to 2.721.0