feat(eks): control plane logs

packages/@aws-cdk/aws-eks/README.md

@@ -386,6 +386,36 @@ A convenience method for mapping a role to the `system:masters` group is also av
 cluster.awsAuth.addMastersRole(role)
 ```
 
+### Kubernetes Control Plane Logging
+
+Amazon [EKS control plane logging](https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html)
+provides audit and diagnostic logs directly from the Kubernetes control plane
+to CloudWatch Logs in your account.
+
+By default, cluster control plane logs aren't sent to CloudWatch Logs. You must
+enable each log type individually to send logs for your cluster. You can activate
+all control plane logs by having the property `controlPlaneLogging: true`,
+then the following setting will be applied:
+
+```ts
+new eks.Cluster(this, 'Cluster', {
+  controlPlaneLoggingOptions: {
+    api: true,
+    audit: true,
+    authenticator: true,
+    controllerManager: true,
+    scheduler: true,
+  }
+});
+```
+
+For more details about the log types available check the
+[API reference documentation](https://docs.aws.amazon.com/eks/latest/APIReference/API_LogSetup.html).
+
+**NOTE**: the control plane logging is only available if the cluster
+has the `kubectlEnabled: true` (which is the default), because there is still no
+CloudFormation support to change that configuration.
+
 ### Cluster Security Group
 
 When you create an Amazon EKS cluster, a

packages/@aws-cdk/aws-eks/lib/cluster-resource-handler/common.ts

@@ -14,6 +14,22 @@ export interface EksUpdateId {
 
 export type ResourceEvent = AWSLambda.CloudFormationCustomResourceEvent & EksUpdateId;
 
+/**
+ * Decodes encoded true/false values
+ */
+function decodeBooleans(object: object) {
+  return JSON.parse(JSON.stringify(object), (_k, v) => {
+    switch (v) {
+      case 'TRUE:BOOLEAN':
+        return true;
+      case 'FALSE:BOOLEAN':
+        return false;
+      default:
+        return v;
+    }
+  });
+}
+
 export abstract class ResourceHandler {
   protected readonly requestId: string;
   protected readonly logicalResourceId: string;
@@ -33,6 +49,10 @@ export abstract class ResourceHandler {
       throw new Error('AssumeRoleArn must be provided');
     }
 
+    if (event.ResourceProperties.Config) {
+      this.event.ResourceProperties.Config = decodeBooleans(event.ResourceProperties.Config);
+    }
+
     eks.configureAssumeRole({
       RoleArn: roleToAssume,
       RoleSessionName: `AWSCDK.EKSCluster.${this.requestType}.${this.requestId}`,

packages/@aws-cdk/aws-eks/lib/cluster-resource.ts

@@ -3,6 +3,54 @@ import { ArnComponents, Construct, CustomResource, Lazy, Stack, Token } from '@a
 import { CLUSTER_RESOURCE_TYPE } from './cluster-resource-handler/consts';
 import { ClusterResourceProvider } from './cluster-resource-provider';
 import { CfnClusterProps } from './eks.generated';
+import { ControlPlaneLogging } from './logging';
+
+/**
+ * Configuration props for EKS Cluster custom resource.
+ */
+export interface ClusterResourceProps extends CfnClusterProps {
+  /**
+   * Enable or disable exporting the Kubernetes control plane logs for your cluster to CloudWatch Logs.
+   *
+   * @see https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html
+   *
+   * @default - Fully disabled, meaning that cluster control plane logs are not exported to CloudWatch Logs.
+   */
+  readonly logging?: ControlPlaneLogging;
+}
+
+/**
+ * The available cluster control plane log types.
+ */
+export type LogKind = keyof ControlPlaneLogging;
+
+/**
+ * An object representing the enabled or disabled Kubernetes control plane logs for your cluster.
+ */
+export interface LogSetup {
+  /**
+   * If a log type is enabled, that log type exports its control plane logs to CloudWatch Logs.
+   * If a log type is not enabled, that log type does not export its control plane logs.
+   * Each individual log type can be enabled or disabled independently.
+   */
+  readonly enabled: boolean;
+
+  /**
+   * The available cluster control plane log types.
+   */
+  readonly types: LogKind[];
+}
+
+/**
+ * An object representing the logging configuration for resources in your cluster.
+ */
+export interface Logging {
+
+  /**
+   * The cluster control plane logging configuration for your cluster.
+   */
+  clusterLogging: LogSetup[];
+}
 
 /**
  * A low-level CFN resource Amazon EKS cluster implemented through a custom
@@ -32,7 +80,7 @@ export class ClusterResource extends Construct {
 
   private readonly trustedPrincipals: string[] = [];
 
-  constructor(scope: Construct, id: string, props: CfnClusterProps) {
+  constructor(scope: Construct, id: string, props: ClusterResourceProps) {
     super(scope, id);
 
     const stack = Stack.of(this);
@@ -113,11 +161,39 @@ export class ClusterResource extends Construct {
       resources: [ '*' ],
     }));
 
+    const enabledLogTypes: LogKind[] = [];
+    const disabledLogTypes: LogKind[] = [];
+    for (const [key, value] of Object.entries(props.logging || {})) {
+      if (value === true) {
+        enabledLogTypes.push(key as LogKind);
+      } else {
+        disabledLogTypes.push(key as LogKind);
+      }
+    }
+    let logging: undefined | Logging;
+    if (enabledLogTypes.length > 0) {
+      logging = {
+        clusterLogging: [
+          {
+            enabled: true,
+            types: enabledLogTypes,
+          },
+          {
+            enabled: false,
+            types: disabledLogTypes,
+          },
+        ],
+      };
+    }
+
     const resource = new CustomResource(this, 'Resource', {
       resourceType: CLUSTER_RESOURCE_TYPE,
       serviceToken: provider.serviceToken,
       properties: {
-        Config: props,
+        Config: encodeValues({
+          ...props,
+          logging,
+        }),
         AssumeRoleArn: this.creationRole.roleArn,
 
         // IMPORTANT: increment this number when you add new attributes to the
@@ -169,3 +245,22 @@ export function clusterArnComponents(clusterName: string): ArnComponents {
     resourceName: clusterName,
   };
 }
+
+/**
+ * Encodes values (specially boolean) as special strings
+ *
+ * Because CloudFormation converts every input as string for custom resources,
+ * we will use these encoded values to cast them into proper types.
+ */
+function encodeValues(object: object) {
+  return JSON.parse(JSON.stringify(object), (_k, v) => {
+    switch (v) {
+      case true:
+        return 'TRUE:BOOLEAN';
+      case false:
+        return 'FALSE:BOOLEAN';
+      default:
+        return v;
+    }
+  });
+}

packages/@aws-cdk/aws-eks/lib/cluster.ts

@@ -11,6 +11,7 @@ import { HelmChart, HelmChartOptions } from './helm-chart';
 import { KubernetesPatch } from './k8s-patch';
 import { KubernetesResource } from './k8s-resource';
 import { KubectlProvider } from './kubectl-provider';
+import { ControlPlaneLogging } from './logging';
 import { Nodegroup, NodegroupOptions  } from './managed-nodegroup';
 import { ServiceAccount, ServiceAccountOptions } from './service-account';
 import { LifecycleLabel, renderAmazonLinuxUserData, renderBottlerocketUserData } from './user-data';
@@ -244,6 +245,21 @@ export interface ClusterProps extends ClusterOptions {
    */
   readonly kubectlEnabled?: boolean;
 
+  /**
+   * Enable or disable exporting the Kubernetes control plane logs for your cluster to CloudWatch Logs.
+   *
+   * @default false Cluster control plane logs are not exported to CloudWatch Logs.
+   */
+  readonly controlPlaneLogging?: boolean;
+
+  /**
+   * EKS control plane logging options.
+   *
+   * @default - none
+   * @see https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html
+   */
+  readonly controlPlaneLoggingOptions?: ControlPlaneLogging;
+
   /**
    * Number of instances to allocate as an initial capacity for this cluster.
    * Instance type can be configured through `defaultCapacityInstanceType`,
@@ -349,6 +365,11 @@ export class Cluster extends Resource implements ICluster {
    */
   public readonly kubectlEnabled: boolean;
 
+  /**
+   * The Control Plane logging configuration for your cluster.
+   */
+  public readonly controlPlaneLogging?: ControlPlaneLogging;
+
   /**
    * The auto scaling group that hosts the default capacity for this cluster.
    * This will be `undefined` if the `defaultCapacityType` is not `EC2` or
@@ -441,9 +462,33 @@ export class Cluster extends Resource implements ICluster {
     let resource;
     this.kubectlEnabled = props.kubectlEnabled === undefined ? true : props.kubectlEnabled;
     if (this.kubectlEnabled) {
-      resource = new ClusterResource(this, 'Resource', clusterProps);
+      let logging: undefined | ControlPlaneLogging;
+      if (props.controlPlaneLogging === true && !props.controlPlaneLoggingOptions) {
+        logging = {
+          api: true,
+          audit: true,
+          authenticator: true,
+          controllerManager: true,
+          scheduler: true,
+        };
+      } else if (Object.keys(props.controlPlaneLoggingOptions || {}).length > 0) {
+        if (props.controlPlaneLogging === false) {
+          throw new Error('Cannot configure control plane logging if "controlPlaneLogging" is false');
+        }
+        logging = props.controlPlaneLoggingOptions;
+      }
+      this.controlPlaneLogging = logging;
+      resource = new ClusterResource(this, 'Resource', {
+        ...clusterProps,
+        logging,
+      });
       this._clusterResource = resource;
     } else {
+      if (props.controlPlaneLogging || props.controlPlaneLoggingOptions) {
+        throw new Error('Cannot configure control plane logging if kubectl is disabled');
+      } else {
+        this.controlPlaneLogging = undefined;
+      }
       resource = new CfnCluster(this, 'Resource', clusterProps);
     }
 

packages/@aws-cdk/aws-eks/lib/helm-chart.ts

@@ -99,7 +99,10 @@ export class HelmChart extends Construct {
         Release: props.release ?? this.node.uniqueId.slice(-53).toLowerCase(), // Helm has a 53 character limit for the name
         Chart: props.chart,
         Version: props.version,
-        Wait: props.wait ?? false,
+        // We will only pass down to the custom resource an explicit value
+        // if wait is set to true. Falsy values will not because
+        // that is the default behavior.
+        Wait: props.wait || undefined,
         Timeout: timeout,
         Values: (props.values ? stack.toJsonString(props.values) : undefined),
         Namespace: props.namespace ?? 'default',

packages/@aws-cdk/aws-eks/lib/index.ts

@@ -1,6 +1,7 @@
 export * from './aws-auth';
 export * from './aws-auth-mapping';
 export * from './cluster';
+export * from './logging';
 export * from './eks.generated';
 export * from './fargate-profile';
 export * from './helm-chart';

packages/@aws-cdk/aws-eks/lib/logging.ts

@@ -0,0 +1,50 @@
+/**
+ * EKS cluster control plane logging configuration
+ */
+export interface ControlPlaneLogging {
+  /**
+   * Kubernetes API server component logs – Your cluster's API server is the
+   * control plane component that exposes the Kubernetes API.
+   *
+   * @default false
+   * @see https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
+   */
+  readonly api?: boolean;
+
+  /**
+   * Audit (audit) – Kubernetes audit logs provide a record of the individual
+   * users, administrators, or system components that have affected your cluster.
+   *
+   * @default false
+   * @see https://kubernetes.io/docs/tasks/debug-application-cluster/audit/
+   */
+  readonly audit?: boolean;
+
+  /**
+   * Authenticator – Authenticator logs are unique to Amazon EKS. These logs
+   * represent the control plane component that Amazon EKS uses for Kubernetes
+   * Role Based Access Control (RBAC) authentication using IAM credentials.
+   *
+   * @default false
+   * @see https://kubernetes.io/docs/admin/authorization/rbac/
+   */
+  readonly authenticator?: boolean;
+
+  /**
+   * Controller manager – The controller manager manages the core control
+   * loops that are shipped with Kubernetes.
+   *
+   * @default false
+   * @see https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/
+   */
+  readonly controllerManager?: boolean;
+
+  /**
+   * Scheduler – The scheduler component manages when and where to run
+   * pods in your cluster.
+   *
+   * @default false
+   * @see https://kubernetes.io/docs/reference/command-line-tools-reference/kube-scheduler/
+   */
+  readonly scheduler?: boolean;
+}