Add OIDC, pod IAM and AWS IAM support for snow

pkg/aws/creds_test.go

@@ -35,6 +35,8 @@ func TestAwsCredentialsFile(t *testing.T) {
 
 func TestAwsCredentialsFileEnvNotSet(t *testing.T) {
 	tt := newAwsTest(t)
+	setupContext(t, aws.EksaAwsCredentialsFileKey, credentialsFile)
+	os.Unsetenv(aws.EksaAwsCredentialsFileKey)
 	_, err := aws.AwsCredentialsFile()
 	tt.Expect(err).To((MatchError(ContainSubstring("env 'EKSA_AWS_CREDENTIALS_FILE' is not set or is empty"))))
 }
@@ -55,6 +57,8 @@ func TestAwsCABundlesFile(t *testing.T) {
 
 func TestAwsCABundlesFileEnvNotSet(t *testing.T) {
 	tt := newAwsTest(t)
+	setupContext(t, aws.EksaAwsCABundlesFileKey, "testdata/valid_certificates")
+	os.Unsetenv(aws.EksaAwsCABundlesFileKey)
 	_, err := aws.AwsCABundlesFile()
 	tt.Expect(err).To((MatchError(ContainSubstring("env 'EKSA_AWS_CA_BUNDLES_FILE' is not set or is empty"))))
 }

pkg/clusterapi/apibuilder.go

@@ -135,7 +135,8 @@ func KubeadmControlPlane(clusterSpec *cluster.Spec, infrastructureObject APIObje
 					Etcd: etcd,
 					APIServer: bootstrapv1.APIServer{
 						ControlPlaneComponent: bootstrapv1.ControlPlaneComponent{
-							ExtraArgs: map[string]string{},
+							ExtraArgs:    map[string]string{},
+							ExtraVolumes: []bootstrapv1.HostPathMount{},
 						},
 					},
 					ControllerManager: bootstrapv1.ControlPlaneComponent{
@@ -161,14 +162,12 @@ func KubeadmControlPlane(clusterSpec *cluster.Spec, infrastructureObject APIObje
 		},
 	}
 
-	if clusterSpec.Cluster.Spec.RegistryMirrorConfiguration != nil {
-		containerdFiles, containerdCommands, err := registryMirrorConfig(clusterSpec.Cluster.Spec.RegistryMirrorConfiguration)
-		if err != nil {
-			return nil, fmt.Errorf("failed setting registry mirror configuration: %v", err)
-		}
-		kcp.Spec.KubeadmConfigSpec.Files = append(kcp.Spec.KubeadmConfigSpec.Files, containerdFiles...)
-		kcp.Spec.KubeadmConfigSpec.PreKubeadmCommands = append(kcp.Spec.KubeadmConfigSpec.PreKubeadmCommands, containerdCommands...)
+	if err := SetRegistryMirrorInKubeadmControlPlane(kcp, clusterSpec.Cluster.Spec.RegistryMirrorConfiguration); err != nil {
+		return nil, err
 	}
+
+	SetIdentityAuthInKubeadmControlPlane(kcp, clusterSpec)
+
 	return kcp, nil
 }
 
@@ -207,14 +206,11 @@ func KubeadmConfigTemplate(clusterSpec *cluster.Spec, workerNodeGroupConfig v1al
 			},
 		},
 	}
-	if clusterSpec.Cluster.Spec.RegistryMirrorConfiguration != nil {
-		containerdFiles, containerdCommands, err := registryMirrorConfig(clusterSpec.Cluster.Spec.RegistryMirrorConfiguration)
-		if err != nil {
-			return nil, fmt.Errorf("failed setting registry mirror configuration: %v", err)
-		}
-		kct.Spec.Template.Spec.Files = append(kct.Spec.Template.Spec.Files, containerdFiles...)
-		kct.Spec.Template.Spec.PreKubeadmCommands = append(kct.Spec.Template.Spec.PreKubeadmCommands, containerdCommands...)
+
+	if err := SetRegistryMirrorInKubeadmConfigTemplate(kct, clusterSpec.Cluster.Spec.RegistryMirrorConfiguration); err != nil {
+		return nil, err
 	}
+
 	return kct, nil
 }
 

pkg/clusterapi/apibuilder_test.go

@@ -217,7 +217,8 @@ func wantKubeadmControlPlane() *controlplanev1.KubeadmControlPlane {
 					},
 					APIServer: bootstrapv1.APIServer{
 						ControlPlaneComponent: bootstrapv1.ControlPlaneComponent{
-							ExtraArgs: map[string]string{},
+							ExtraArgs:    map[string]string{},
+							ExtraVolumes: []bootstrapv1.HostPathMount{},
 						},
 					},
 					ControllerManager: bootstrapv1.ControlPlaneComponent{
@@ -244,14 +245,6 @@ func wantKubeadmControlPlane() *controlplanev1.KubeadmControlPlane {
 	}
 }
 
-func wantRegistryMirrorCommands() []string {
-	return []string{
-		"cat /etc/containerd/config_append.toml >> /etc/containerd/config.toml",
-		"sudo systemctl daemon-reload",
-		"sudo systemctl restart containerd",
-	}
-}
-
 // TODO: add unstacked etcd test
 func TestKubeadmControlPlane(t *testing.T) {
 	tt := newApiBuilerTest(t)
@@ -261,82 +254,6 @@ func TestKubeadmControlPlane(t *testing.T) {
 	tt.Expect(got).To(Equal(want))
 }
 
-var registryMirrorTests = []struct {
-	name                 string
-	registryMirrorConfig *v1alpha1.RegistryMirrorConfiguration
-	wantFiles            []bootstrapv1.File
-}{
-	{
-		name: "with ca cert",
-		registryMirrorConfig: &v1alpha1.RegistryMirrorConfiguration{
-			Endpoint:      "1.2.3.4",
-			Port:          "443",
-			CACertContent: "xyz",
-		},
-		wantFiles: []bootstrapv1.File{
-			{
-				Path:  "/etc/containerd/config_append.toml",
-				Owner: "root:root",
-				Content: `[plugins."io.containerd.grpc.v1.cri".registry.mirrors]
-  [plugins."io.containerd.grpc.v1.cri".registry.mirrors."public.ecr.aws"]
-    endpoint = ["https://1.2.3.4:443"]
-  [plugins."io.containerd.grpc.v1.cri".registry.configs."1.2.3.4:443".tls]
-    ca_file = "/etc/containerd/certs.d/1.2.3.4:443/ca.crt"`,
-			},
-			{
-				Path:    "/etc/containerd/certs.d/1.2.3.4:443/ca.crt",
-				Owner:   "root:root",
-				Content: "xyz",
-			},
-		},
-	},
-	{
-		name: "with insecure skip",
-		registryMirrorConfig: &v1alpha1.RegistryMirrorConfiguration{
-			Endpoint:           "1.2.3.4",
-			Port:               "443",
-			InsecureSkipVerify: true,
-		},
-		wantFiles: []bootstrapv1.File{
-			{
-				Path:  "/etc/containerd/config_append.toml",
-				Owner: "root:root",
-				Content: `[plugins."io.containerd.grpc.v1.cri".registry.mirrors]
-  [plugins."io.containerd.grpc.v1.cri".registry.mirrors."public.ecr.aws"]
-    endpoint = ["https://1.2.3.4:443"]
-  [plugins."io.containerd.grpc.v1.cri".registry.configs."1.2.3.4:443".tls]
-    insecure_skip_verify = true`,
-			},
-		},
-	},
-	{
-		name: "with ca cert and insecure skip",
-		registryMirrorConfig: &v1alpha1.RegistryMirrorConfiguration{
-			Endpoint:           "1.2.3.4",
-			Port:               "443",
-			CACertContent:      "xyz",
-			InsecureSkipVerify: true,
-		},
-		wantFiles: []bootstrapv1.File{
-			{
-				Path:  "/etc/containerd/config_append.toml",
-				Owner: "root:root",
-				Content: `[plugins."io.containerd.grpc.v1.cri".registry.mirrors]
-  [plugins."io.containerd.grpc.v1.cri".registry.mirrors."public.ecr.aws"]
-    endpoint = ["https://1.2.3.4:443"]
-  [plugins."io.containerd.grpc.v1.cri".registry.configs."1.2.3.4:443".tls]
-    ca_file = "/etc/containerd/certs.d/1.2.3.4:443/ca.crt"
-    insecure_skip_verify = true`,
-			},
-			{
-				Path:    "/etc/containerd/certs.d/1.2.3.4:443/ca.crt",
-				Owner:   "root:root",
-				Content: "xyz",
-			},
-		},
-	},
-}
-
 func TestKubeadmControlPlaneWithRegistryMirror(t *testing.T) {
 	for _, tt := range registryMirrorTests {
 		t.Run(tt.name, func(t *testing.T) {

pkg/clusterapi/identity.go

@@ -0,0 +1,121 @@
+package clusterapi
+
+import (
+	bootstrapv1 "sigs.k8s.io/cluster-api/bootstrap/kubeadm/api/v1beta1"
+	controlplanev1 "sigs.k8s.io/cluster-api/controlplane/kubeadm/api/v1beta1"
+
+	"github.com/aws/eks-anywhere/pkg/api/v1alpha1"
+	"github.com/aws/eks-anywhere/pkg/cluster"
+)
+
+const awsIamKubeconfig = `
+# clusters refers to the remote service.
+clusters:
+	- name: aws-iam-authenticator
+	cluster:
+		certificate-authority: /var/aws-iam-authenticator/cert.pem
+		server: https://localhost:21362/authenticate
+# users refers to the API Server's webhook configuration
+# (we don't need to authenticate the API server).
+users:
+	- name: apiserver
+# kubeconfig files require a context. Provide one for the API Server.
+current-context: webhook
+contexts:
+- name: webhook
+	context:
+	cluster: aws-iam-authenticator
+	user: apiserver
+`
+
+var awsIamMounts = []bootstrapv1.HostPathMount{
+	{
+		Name:      "authconfig",
+		HostPath:  "/var/lib/kubeadm/aws-iam-authenticator/",
+		MountPath: "/etc/kubernetes/aws-iam-authenticator/",
+		ReadOnly:  false,
+	},
+	{
+		Name:      "awsiamcert",
+		HostPath:  "/var/lib/kubeadm/aws-iam-authenticator/pki/",
+		MountPath: "/var/aws-iam-authenticator/",
+		ReadOnly:  false,
+	},
+}
+
+var awsIamFiles = []bootstrapv1.File{
+	{
+		Path:        "/var/lib/kubeadm/aws-iam-authenticator/kubeconfig.yaml",
+		Owner:       "root:root",
+		Permissions: "0640",
+		Content:     awsIamKubeconfig,
+	},
+	{
+		Path:        "/var/lib/kubeadm/aws-iam-authenticator/pki/cert.pem",
+		Owner:       "root:root",
+		Permissions: "0640",
+		ContentFrom: &bootstrapv1.FileSource{
+			Secret: bootstrapv1.SecretFileSource{
+				Name: "aws-iam-authenticator-ca",
+				Key:  "cert.pem",
+			},
+		},
+	},
+	{
+		Path:        "/var/lib/kubeadm/aws-iam-authenticator/pki/key.pem",
+		Owner:       "root:root",
+		Permissions: "0640",
+		ContentFrom: &bootstrapv1.FileSource{
+			Secret: bootstrapv1.SecretFileSource{
+				Name: "aws-iam-authenticator-ca",
+				Key:  "key.pem",
+			},
+		},
+	},
+}
+
+func configureAWSIAMAuthInKubeadmControlPlane(kcp *controlplanev1.KubeadmControlPlane, awsIamConfig *v1alpha1.AWSIamConfig) {
+	if awsIamConfig == nil {
+		return
+	}
+
+	apiServerExtraArgs := kcp.Spec.KubeadmConfigSpec.ClusterConfiguration.APIServer.ExtraArgs
+	for k, v := range AwsIamAuthExtraArgs(awsIamConfig) {
+		apiServerExtraArgs[k] = v
+	}
+
+	kcp.Spec.KubeadmConfigSpec.ClusterConfiguration.APIServer.ExtraVolumes = append(
+		kcp.Spec.KubeadmConfigSpec.ClusterConfiguration.APIServer.ExtraVolumes,
+		awsIamMounts...,
+	)
+
+	kcp.Spec.KubeadmConfigSpec.Files = append(kcp.Spec.KubeadmConfigSpec.Files, awsIamFiles...)
+}
+
+func configureOIDCInKubeadmControlPlane(kcp *controlplanev1.KubeadmControlPlane, oidcConfig *v1alpha1.OIDCConfig) {
+	if oidcConfig == nil {
+		return
+	}
+
+	apiServerExtraArgs := kcp.Spec.KubeadmConfigSpec.ClusterConfiguration.APIServer.ExtraArgs
+	for k, v := range OIDCToExtraArgs(oidcConfig) {
+		apiServerExtraArgs[k] = v
+	}
+}
+
+func configurePodIamAuthInKubeadmControlPlane(kcp *controlplanev1.KubeadmControlPlane, podIamConfig *v1alpha1.PodIAMConfig) {
+	if podIamConfig == nil {
+		return
+	}
+
+	apiServerExtraArgs := kcp.Spec.KubeadmConfigSpec.ClusterConfiguration.APIServer.ExtraArgs
+	for k, v := range PodIAMAuthExtraArgs(podIamConfig) {
+		apiServerExtraArgs[k] = v
+	}
+}
+
+func SetIdentityAuthInKubeadmControlPlane(kcp *controlplanev1.KubeadmControlPlane, clusterSpec *cluster.Spec) {
+	configureOIDCInKubeadmControlPlane(kcp, clusterSpec.OIDCConfig)
+	configureAWSIAMAuthInKubeadmControlPlane(kcp, clusterSpec.AWSIamConfig)
+	configurePodIamAuthInKubeadmControlPlane(kcp, clusterSpec.Cluster.Spec.PodIAMConfig)
+}