feat(eks): connect all custom resources to the cluster VPC #10200

iliapolo · 2020-09-05T16:20:57Z

Allow all our lambda handlers to be provisioned inside the cluster VPC.

The KubectlProvider handlers were already placed inside the VPC is they could have, the missing was to include the ClusterHandler. This is now possible via the placeClusterHandlerInVpc (names are welcome) property.

Default value remains false because if the VPC happens to be isolated (i.e no outbound internet access) this would break the deployment. (See #12171)

Closes #9509

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

mergify · 2020-09-05T16:21:33Z

Title does not follow the guidelines of Conventional Commits. Please adjust title before merge.

oleksii-boiko-ua · 2020-09-07T06:01:34Z

is it possible to add ability to define proxy for lambda functions as aws doesn't have vpc endpoints for api's, for example to reach eks api from private network?

iliapolo · 2020-09-07T19:55:32Z

@alexey-boyko Yes it will be possible

oleksii-boiko-ua · 2020-09-09T08:00:00Z

@alexey-boyko Yes it will be possible

cool thanks, ping me if you need me to test

oleksii-boiko-ua · 2020-10-27T10:00:51Z

@iliapolo hello, any plans to merge it this year?

iliapolo · 2020-10-27T12:22:59Z

@alexey-boyko Yes it is on our roadmap for this quarter.

gitpod-io · 2020-12-13T11:31:45Z

iliapolo · 2020-12-15T20:51:04Z

packages/@aws-cdk/aws-eks/lib/kubectl-provider.ts

@@ -97,6 +97,8 @@ export class KubectlProvider extends NestedStack {

    const provider = new cr.Provider(this, 'Provider', {
      onEventHandler: handler,
+      vpc: cluster.kubectlPrivateSubnets ? cluster.vpc : undefined,


This isn't related to the placeClusterHandlerInVpc property. But seems like we should have done this when we introduced private endpoints, consolidating all the related functions into the same network.

iliapolo · 2020-12-15T20:51:56Z

packages/@aws-cdk/aws-eks/test/integ.eks-cluster-handlers-vpc.ts

+const CLUSTER_VERSION = eks.KubernetesVersion.V1_18;
+
+
+class EksAllHandlersInVpcStack extends TestStack {


Reluctantly, adding another integ test because this property affects the cluster deployment and operation.

eladb · 2020-12-21T12:03:36Z

packages/@aws-cdk/aws-eks/lib/cluster.ts

+   *
+   * @default false
+   */
+  readonly placeClusterHandlerInVpc?: boolean;


It would make sense to use a similar prefix:

Suggested change

readonly placeClusterHandlerInVpc?: boolean;

readonly clusterHandlerVpc?: boolean;

eladb · 2020-12-21T12:32:28Z

packages/@aws-cdk/aws-eks/README.md

@@ -459,7 +460,18 @@ If the endpoint does not expose private access (via `EndpointAccess.PUBLIC`) **o

 #### Cluster Handler

-The `ClusterHandler` is a Lambda function responsible to interact the EKS API in order to control the cluster lifecycle. At the moment, this function cannot be provisioned inside the VPC. See [Attach all Lambda Function to a VPC](https://github.com/aws/aws-cdk/issues/9509) for more details.
+The `ClusterHandler` is a Lambda function responsible to interact with the EKS API in order to control the cluster lifecycle. To provision this function inside the VPC, set the `placeClusterHandlerInVpc` property to `true`. This will place the function inside the private subnets of the VPC based on the selection strategy specified in the [`vpcSubnets`](https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-eks.Cluster.html#vpcsubnetsspan-classapi-icon-api-icon-experimental-titlethis-api-element-is-experimental-it-may-change-without-noticespan) property.


What about the kubectl handler?

eladb · 2020-12-21T12:33:47Z

Okay now just saw the PR description

mergify · 2020-12-21T12:33:58Z

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

aws-cdk-automation · 2020-12-21T19:00:10Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
Commit ID: 9407f5e
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2020-12-21T19:04:38Z

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

Allow all our lambda handlers to be provisioned inside the cluster VPC. The `KubectlProvider` handlers were already placed inside the VPC is they could have, the missing was to include the `ClusterHandler`. This is now possible via the `placeClusterHandlerInVpc` (names are welcome) property. Default value remains `false` because if the VPC happens to be isolated (i.e no outbound internet access) this would break the deployment. (See aws#12171) Closes aws#9509 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Following #10200, our `KubectlProvider` functions are now provisioned inside a VPC when applicable. A somewhat unintended side effect is that the provider framework will **create** and use a dedicated security group for its functions. This can violate organizational policies that don't allow CDK to create security groups. We can easily avoid this by simply reusing the `kubectlSecurityGroup`, which must be defined in this case, and passing it to the provider. Fixes #12952 ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

mergify bot added the contribution/core This is a PR that came from AWS. label Sep 5, 2020

SomayaB assigned iliapolo Sep 8, 2020

iliapolo mentioned this pull request Sep 15, 2020

[aws-eks] Construct Library custom resources can't be used within vpc #9509

Closed

2 tasks

mid work

18716b0

iliapolo force-pushed the epolon/eks-vpc-all-functions branch from 84a0b92 to 18716b0 Compare December 13, 2020 20:17

iliapolo added 5 commits December 14, 2020 13:10

tests and integ

e118ff0

Merge branch 'master' into epolon/eks-vpc-all-functions

9b59197

integ

90bcfec

Merge branch 'master' into epolon/eks-vpc-all-functions

6689a47

integ test for when all handlers are inside the vpc

fed2509

iliapolo commented Dec 15, 2020

View reviewed changes

iliapolo added 5 commits December 20, 2020 21:04

start wrapping up

07bc09e

whoopsy

b9840c6

Merge branch 'master' into epolon/eks-vpc-all-functions

0c93866

mid work

cd3dc87

integ

d40f718

github-actions bot added the @aws-cdk/aws-eks Related to Amazon Elastic Kubernetes Service label Dec 21, 2020

iliapolo marked this pull request as ready for review December 21, 2020 11:27

fix default doc

68a625d

iliapolo requested a review from eladb December 21, 2020 11:35

eladb suggested changes Dec 21, 2020

View reviewed changes

eladb approved these changes Dec 21, 2020

View reviewed changes

Merge branch 'master' into epolon/eks-vpc-all-functions

9407f5e

mergify bot merged commit eaa8222 into master Dec 21, 2020

mergify bot deleted the epolon/eks-vpc-all-functions branch December 21, 2020 19:04

starchx mentioned this pull request Jan 20, 2021

(aws-eks) Proxy settings in kubectlEnvironment should be passed onto provider-framework Lambda #12608

Closed

pkwarren mentioned this pull request Feb 9, 2021

(eks): KubectlProvider creates un-necessary security group for the provider function #12952

Closed

iliapolo mentioned this pull request Feb 21, 2021

fix(eks): KubectlProvider creates un-necessary security group #13178

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(eks): connect all custom resources to the cluster VPC #10200

feat(eks): connect all custom resources to the cluster VPC #10200

iliapolo commented Sep 5, 2020 •

edited

Loading

mergify bot commented Sep 5, 2020

oleksii-boiko-ua commented Sep 7, 2020

iliapolo commented Sep 7, 2020

oleksii-boiko-ua commented Sep 9, 2020

oleksii-boiko-ua commented Oct 27, 2020

iliapolo commented Oct 27, 2020

gitpod-io bot commented Dec 13, 2020 •

edited

Loading

iliapolo Dec 15, 2020 •

edited

Loading

iliapolo Dec 15, 2020

eladb Dec 21, 2020

eladb Dec 21, 2020

eladb commented Dec 21, 2020

mergify bot commented Dec 21, 2020

aws-cdk-automation commented Dec 21, 2020

mergify bot commented Dec 21, 2020

		const CLUSTER_VERSION = eks.KubernetesVersion.V1_18;


		class EksAllHandlersInVpcStack extends TestStack {

	readonly placeClusterHandlerInVpc?: boolean;
	readonly clusterHandlerVpc?: boolean;

feat(eks): connect all custom resources to the cluster VPC #10200

feat(eks): connect all custom resources to the cluster VPC #10200

Conversation

iliapolo commented Sep 5, 2020 • edited Loading

mergify bot commented Sep 5, 2020

oleksii-boiko-ua commented Sep 7, 2020

iliapolo commented Sep 7, 2020

oleksii-boiko-ua commented Sep 9, 2020

oleksii-boiko-ua commented Oct 27, 2020

iliapolo commented Oct 27, 2020

gitpod-io bot commented Dec 13, 2020 • edited Loading

iliapolo Dec 15, 2020 • edited Loading

Choose a reason for hiding this comment

iliapolo Dec 15, 2020

Choose a reason for hiding this comment

eladb Dec 21, 2020

Choose a reason for hiding this comment

eladb Dec 21, 2020

Choose a reason for hiding this comment

eladb commented Dec 21, 2020

mergify bot commented Dec 21, 2020

aws-cdk-automation commented Dec 21, 2020

AWS CodeBuild CI Report

mergify bot commented Dec 21, 2020

iliapolo commented Sep 5, 2020 •

edited

Loading

gitpod-io bot commented Dec 13, 2020 •

edited

Loading

iliapolo Dec 15, 2020 •

edited

Loading