Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add OIDC, pod IAM and AWS IAM support for snow #1916

Merged
merged 1 commit into from
Apr 22, 2022
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions pkg/aws/creds_test.go
Original file line number Diff line number Diff line change
@@ -35,6 +35,8 @@ func TestAwsCredentialsFile(t *testing.T) {

func TestAwsCredentialsFileEnvNotSet(t *testing.T) {
tt := newAwsTest(t)
setupContext(t, aws.EksaAwsCredentialsFileKey, credentialsFile)
os.Unsetenv(aws.EksaAwsCredentialsFileKey)
_, err := aws.AwsCredentialsFile()
tt.Expect(err).To((MatchError(ContainSubstring("env 'EKSA_AWS_CREDENTIALS_FILE' is not set or is empty"))))
}
@@ -55,6 +57,8 @@ func TestAwsCABundlesFile(t *testing.T) {

func TestAwsCABundlesFileEnvNotSet(t *testing.T) {
tt := newAwsTest(t)
setupContext(t, aws.EksaAwsCABundlesFileKey, "testdata/valid_certificates")
os.Unsetenv(aws.EksaAwsCABundlesFileKey)
_, err := aws.AwsCABundlesFile()
tt.Expect(err).To((MatchError(ContainSubstring("env 'EKSA_AWS_CA_BUNDLES_FILE' is not set or is empty"))))
}
26 changes: 11 additions & 15 deletions pkg/clusterapi/apibuilder.go
Original file line number Diff line number Diff line change
@@ -135,7 +135,8 @@ func KubeadmControlPlane(clusterSpec *cluster.Spec, infrastructureObject APIObje
Etcd: etcd,
APIServer: bootstrapv1.APIServer{
ControlPlaneComponent: bootstrapv1.ControlPlaneComponent{
ExtraArgs: map[string]string{},
ExtraArgs: map[string]string{},
ExtraVolumes: []bootstrapv1.HostPathMount{},
},
},
ControllerManager: bootstrapv1.ControlPlaneComponent{
@@ -161,14 +162,12 @@ func KubeadmControlPlane(clusterSpec *cluster.Spec, infrastructureObject APIObje
},
}

if clusterSpec.Cluster.Spec.RegistryMirrorConfiguration != nil {
containerdFiles, containerdCommands, err := registryMirrorConfig(clusterSpec.Cluster.Spec.RegistryMirrorConfiguration)
if err != nil {
return nil, fmt.Errorf("failed setting registry mirror configuration: %v", err)
}
kcp.Spec.KubeadmConfigSpec.Files = append(kcp.Spec.KubeadmConfigSpec.Files, containerdFiles...)
kcp.Spec.KubeadmConfigSpec.PreKubeadmCommands = append(kcp.Spec.KubeadmConfigSpec.PreKubeadmCommands, containerdCommands...)
if err := SetRegistryMirrorInKubeadmControlPlane(kcp, clusterSpec.Cluster.Spec.RegistryMirrorConfiguration); err != nil {
return nil, err
}

SetIdentityAuthInKubeadmControlPlane(kcp, clusterSpec)

return kcp, nil
}

@@ -207,14 +206,11 @@ func KubeadmConfigTemplate(clusterSpec *cluster.Spec, workerNodeGroupConfig v1al
},
},
}
if clusterSpec.Cluster.Spec.RegistryMirrorConfiguration != nil {
containerdFiles, containerdCommands, err := registryMirrorConfig(clusterSpec.Cluster.Spec.RegistryMirrorConfiguration)
if err != nil {
return nil, fmt.Errorf("failed setting registry mirror configuration: %v", err)
}
kct.Spec.Template.Spec.Files = append(kct.Spec.Template.Spec.Files, containerdFiles...)
kct.Spec.Template.Spec.PreKubeadmCommands = append(kct.Spec.Template.Spec.PreKubeadmCommands, containerdCommands...)

if err := SetRegistryMirrorInKubeadmConfigTemplate(kct, clusterSpec.Cluster.Spec.RegistryMirrorConfiguration); err != nil {
return nil, err
}

return kct, nil
}

87 changes: 2 additions & 85 deletions pkg/clusterapi/apibuilder_test.go
Original file line number Diff line number Diff line change
@@ -217,7 +217,8 @@ func wantKubeadmControlPlane() *controlplanev1.KubeadmControlPlane {
},
APIServer: bootstrapv1.APIServer{
ControlPlaneComponent: bootstrapv1.ControlPlaneComponent{
ExtraArgs: map[string]string{},
ExtraArgs: map[string]string{},
ExtraVolumes: []bootstrapv1.HostPathMount{},
},
},
ControllerManager: bootstrapv1.ControlPlaneComponent{
@@ -244,14 +245,6 @@ func wantKubeadmControlPlane() *controlplanev1.KubeadmControlPlane {
}
}

func wantRegistryMirrorCommands() []string {
return []string{
"cat /etc/containerd/config_append.toml >> /etc/containerd/config.toml",
"sudo systemctl daemon-reload",
"sudo systemctl restart containerd",
}
}

// TODO: add unstacked etcd test
func TestKubeadmControlPlane(t *testing.T) {
tt := newApiBuilerTest(t)
@@ -261,82 +254,6 @@ func TestKubeadmControlPlane(t *testing.T) {
tt.Expect(got).To(Equal(want))
}

var registryMirrorTests = []struct {
name string
registryMirrorConfig *v1alpha1.RegistryMirrorConfiguration
wantFiles []bootstrapv1.File
}{
{
name: "with ca cert",
registryMirrorConfig: &v1alpha1.RegistryMirrorConfiguration{
Endpoint: "1.2.3.4",
Port: "443",
CACertContent: "xyz",
},
wantFiles: []bootstrapv1.File{
{
Path: "/etc/containerd/config_append.toml",
Owner: "root:root",
Content: `[plugins."io.containerd.grpc.v1.cri".registry.mirrors]
[plugins."io.containerd.grpc.v1.cri".registry.mirrors."public.ecr.aws"]
endpoint = ["https://1.2.3.4:443"]
[plugins."io.containerd.grpc.v1.cri".registry.configs."1.2.3.4:443".tls]
ca_file = "/etc/containerd/certs.d/1.2.3.4:443/ca.crt"`,
},
{
Path: "/etc/containerd/certs.d/1.2.3.4:443/ca.crt",
Owner: "root:root",
Content: "xyz",
},
},
},
{
name: "with insecure skip",
registryMirrorConfig: &v1alpha1.RegistryMirrorConfiguration{
Endpoint: "1.2.3.4",
Port: "443",
InsecureSkipVerify: true,
},
wantFiles: []bootstrapv1.File{
{
Path: "/etc/containerd/config_append.toml",
Owner: "root:root",
Content: `[plugins."io.containerd.grpc.v1.cri".registry.mirrors]
[plugins."io.containerd.grpc.v1.cri".registry.mirrors."public.ecr.aws"]
endpoint = ["https://1.2.3.4:443"]
[plugins."io.containerd.grpc.v1.cri".registry.configs."1.2.3.4:443".tls]
insecure_skip_verify = true`,
},
},
},
{
name: "with ca cert and insecure skip",
registryMirrorConfig: &v1alpha1.RegistryMirrorConfiguration{
Endpoint: "1.2.3.4",
Port: "443",
CACertContent: "xyz",
InsecureSkipVerify: true,
},
wantFiles: []bootstrapv1.File{
{
Path: "/etc/containerd/config_append.toml",
Owner: "root:root",
Content: `[plugins."io.containerd.grpc.v1.cri".registry.mirrors]
[plugins."io.containerd.grpc.v1.cri".registry.mirrors."public.ecr.aws"]
endpoint = ["https://1.2.3.4:443"]
[plugins."io.containerd.grpc.v1.cri".registry.configs."1.2.3.4:443".tls]
ca_file = "/etc/containerd/certs.d/1.2.3.4:443/ca.crt"
insecure_skip_verify = true`,
},
{
Path: "/etc/containerd/certs.d/1.2.3.4:443/ca.crt",
Owner: "root:root",
Content: "xyz",
},
},
},
}

func TestKubeadmControlPlaneWithRegistryMirror(t *testing.T) {
for _, tt := range registryMirrorTests {
t.Run(tt.name, func(t *testing.T) {
121 changes: 121 additions & 0 deletions pkg/clusterapi/identity.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,121 @@
package clusterapi

import (
bootstrapv1 "sigs.k8s.io/cluster-api/bootstrap/kubeadm/api/v1beta1"
controlplanev1 "sigs.k8s.io/cluster-api/controlplane/kubeadm/api/v1beta1"

"github.com/aws/eks-anywhere/pkg/api/v1alpha1"
"github.com/aws/eks-anywhere/pkg/cluster"
)

const awsIamKubeconfig = `
# clusters refers to the remote service.
clusters:
- name: aws-iam-authenticator
cluster:
certificate-authority: /var/aws-iam-authenticator/cert.pem
server: https://localhost:21362/authenticate
# users refers to the API Server's webhook configuration
# (we don't need to authenticate the API server).
users:
- name: apiserver
# kubeconfig files require a context. Provide one for the API Server.
current-context: webhook
contexts:
- name: webhook
context:
cluster: aws-iam-authenticator
user: apiserver
`

var awsIamMounts = []bootstrapv1.HostPathMount{
{
Name: "authconfig",
HostPath: "/var/lib/kubeadm/aws-iam-authenticator/",
MountPath: "/etc/kubernetes/aws-iam-authenticator/",
ReadOnly: false,
},
{
Name: "awsiamcert",
HostPath: "/var/lib/kubeadm/aws-iam-authenticator/pki/",
MountPath: "/var/aws-iam-authenticator/",
ReadOnly: false,
},
}

var awsIamFiles = []bootstrapv1.File{
{
Path: "/var/lib/kubeadm/aws-iam-authenticator/kubeconfig.yaml",
Owner: "root:root",
Permissions: "0640",
Content: awsIamKubeconfig,
},
{
Path: "/var/lib/kubeadm/aws-iam-authenticator/pki/cert.pem",
Owner: "root:root",
Permissions: "0640",
ContentFrom: &bootstrapv1.FileSource{
Secret: bootstrapv1.SecretFileSource{
Name: "aws-iam-authenticator-ca",
Key: "cert.pem",
},
},
},
{
Path: "/var/lib/kubeadm/aws-iam-authenticator/pki/key.pem",
Owner: "root:root",
Permissions: "0640",
ContentFrom: &bootstrapv1.FileSource{
Secret: bootstrapv1.SecretFileSource{
Name: "aws-iam-authenticator-ca",
Key: "key.pem",
},
},
},
}

func configureAWSIAMAuthInKubeadmControlPlane(kcp *controlplanev1.KubeadmControlPlane, awsIamConfig *v1alpha1.AWSIamConfig) {
if awsIamConfig == nil {
return
}

apiServerExtraArgs := kcp.Spec.KubeadmConfigSpec.ClusterConfiguration.APIServer.ExtraArgs
for k, v := range AwsIamAuthExtraArgs(awsIamConfig) {
apiServerExtraArgs[k] = v
}

kcp.Spec.KubeadmConfigSpec.ClusterConfiguration.APIServer.ExtraVolumes = append(
kcp.Spec.KubeadmConfigSpec.ClusterConfiguration.APIServer.ExtraVolumes,
awsIamMounts...,
)

kcp.Spec.KubeadmConfigSpec.Files = append(kcp.Spec.KubeadmConfigSpec.Files, awsIamFiles...)
}

func configureOIDCInKubeadmControlPlane(kcp *controlplanev1.KubeadmControlPlane, oidcConfig *v1alpha1.OIDCConfig) {
if oidcConfig == nil {
return
}

apiServerExtraArgs := kcp.Spec.KubeadmConfigSpec.ClusterConfiguration.APIServer.ExtraArgs
for k, v := range OIDCToExtraArgs(oidcConfig) {
apiServerExtraArgs[k] = v
}
}

func configurePodIamAuthInKubeadmControlPlane(kcp *controlplanev1.KubeadmControlPlane, podIamConfig *v1alpha1.PodIAMConfig) {
if podIamConfig == nil {
return
}

apiServerExtraArgs := kcp.Spec.KubeadmConfigSpec.ClusterConfiguration.APIServer.ExtraArgs
for k, v := range PodIAMAuthExtraArgs(podIamConfig) {
apiServerExtraArgs[k] = v
}
}

func SetIdentityAuthInKubeadmControlPlane(kcp *controlplanev1.KubeadmControlPlane, clusterSpec *cluster.Spec) {
configureOIDCInKubeadmControlPlane(kcp, clusterSpec.OIDCConfig)
configureAWSIAMAuthInKubeadmControlPlane(kcp, clusterSpec.AWSIamConfig)
configurePodIamAuthInKubeadmControlPlane(kcp, clusterSpec.Cluster.Spec.PodIAMConfig)
}
Loading