Add kubernetes_config_map_v1_data resource #1671

jrhouston · 2022-03-30T20:34:52Z

Description

This PR adds a resource which allows Terraform to use field manager to manage the data within a ConfigMap that already exists. The implementation of this resource is similar to kubernetes_annotations (#1660) and kubernetes_labels (#1616) but does not require the dynamic client, so does not need the user to specify the apiVersion and kind.

Acceptance tests

Have you added an acceptance test for the functionality being added?
Have you run the acceptance tests on this branch?

Output from acceptance testing:

=== RUN   TestAccKubernetesConfigMapV1Data_basic
--- PASS: TestAccKubernetesConfigMapV1Data_basic (34.48s)
PASS
ok  	github.com/hashicorp/terraform-provider-kubernetes/kubernetes	35.445s

Release Note

Release note for CHANGELOG:

Add kubernetes_config_map_v1_data resource

References

#723 – one of the frequent use cases in this issue is patching configmaps

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

arybolovlev

Two minor comments.

kubernetes/resource_kubernetes_config_map_v1_data.go

arybolovlev · 2022-03-31T14:21:30Z

kubernetes/provider.go

-			"kubernetes_annotations": resourceKubernetesAnnotations(),
+			"kubernetes_labels":             resourceKubernetesLabels(),
+			"kubernetes_annotations":        resourceKubernetesAnnotations(),
+			"kubernetes_config_map_v1_data": resourceKubernetesConfigMapV1Data(),


Most of our resources have a version at the end of their names, shall we continue this practice and call it kubernetes_config_map_data_v1? I am not sure though if that one won't overlap with any native Kubernetes resources in the future. I am totally fine with the current name and can see the logic here too, so I am just curious.

Yeah I wasn't sure how to place the version – I formatted it like this to reflect that we're managing the data field of the kubernetes_config_map_v1 resource since the data field isn't versioned.

aidanmelen · 2022-04-01T04:00:07Z

🥇

aidanmelen · 2022-04-01T06:11:35Z

Since this PR is aimed at solving #723, I ran a few test runs patching the aws-auth configmap that was automatically generated by an AWS EKS cluster. That test run was successful 🥳

resource "kubernetes_config_map_v1_data" "aws_auth" {
  metadata {
    name      = "aws-auth"
    namespace = "kube-system"
  }

  data = {
    "mapRoles"    = <<-EOT
    - rolearn: arn:aws:iam::111111111111:role/DemoEKS-NodeInstanceRole
      username: system:node:{{EC2PrivateDNSName}}
      groups:
        - system:bootstrappers
        - system:nodes
    - rolearn: arn:aws:iam::111111111111:role/TeamRole
      username: TeamRole
      groups:
      - system:masters
    EOT
    "mapUsers"    = <<-EOT
    - userarn: arn:aws:iam::111111111111:user/sukumar-test-test
      username: sukumar
      groups:
        - system:masters
    EOT
  }

  force = true
}

and the apply...

Terraform will perform the following actions:

  # module.eks_auth.kubernetes_config_map_v1_data.aws_auth will be created
  + resource "kubernetes_config_map_v1_data" "aws_auth" {
      + data  = {
          + "mapAccounts" = <<-EOT
                - "777777777777"
                - "888888888888"
            EOT
          + "mapRoles"    = <<-EOT
                - "groups":
                  - "system:bootstrappers"
                  - "system:nodes"
                  "rolearn": "arn:aws:iam::326504147071:role/foo-eks-node-group-20220401053147969300000001"
                  "username": "system:node:{{EC2PrivateDNSName}}"
                - "groups":
                  - "system:bootstrappers"
                  - "system:nodes"
                  "rolearn": "arn:aws:iam::326504147071:role/boo-node-group-20220401053147969900000003"
                  "username": "system:node:{{EC2PrivateDNSName}}"
                - "groups":
                  - "system:bootstrappers"
                  - "system:nodes"
                  - "system:node-proxier"
                  "rolearn": "arn:aws:iam::326504147071:role/bar-20220401053147969700000002"
                  "username": "system:node:{{SessionName}}"
                - "groups":
                  - "system:masters"
                  "rolearn": "arn:aws:iam::66666666666:role/role1"
                  "username": "role1"
            EOT
          + "mapUsers"    = <<-EOT
                - "groups":
                  - "system:masters"
                  "userarn": "arn:aws:iam::66666666666:user/user1"
                  "username": "user1"
                - "groups":
                  - "system:masters"
                  "userarn": "arn:aws:iam::66666666666:user/user2"
                  "username": "user2"
            EOT
        }
      + force = true
      + id    = (known after apply)

      + metadata {
          + name      = "aws-auth"
          + namespace = "kube-system"
        }
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

module.eks_auth.kubernetes_config_map_v1_data.aws_auth: Creating...
module.eks_auth.kubernetes_config_map_v1_data.aws_auth: Creation complete after 1s [id=kube-system/aws-auth]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

This resource is consistent with the kubectl patch configmap/aws-auth --patch-file aws-auth-configmap.yaml -n kube-system cmd as it will also fail if the resource does not exist.

aidanmelen · 2022-04-01T15:22:13Z

This resource will fail if the configmap does not exist. I realize that is by design... But please consider that the aws-auth configmap is only created when managed eks node groups or fargate profiles are added to the cluster. As a result, there are at least two scenarios where the aws-auth configmap will not exist on cluster creation. For example:

A cluster with self managed node groups will not automatically create an aws-auth configmap.
An AWS EKS cluster that is deployed without a data plane will not automatically create an aws-auth configmap.

I will admit that these are edge case scenarios, but think it would be nice to have a general workaround for this type of scenario.

I tried getting around this by using the kubernetes_resource data resource to check if the aws-auth configmap exists on creation. For example:

data "kubernetes_resource" "aws_auth" {
  api_version = "v1"
  kind        = "ConfigMap"

  metadata {
    name      = "aws-auth"
    namespace = "kube-system"
  }
}

output "aws_auth_cm" {
  value = try(data.kubernetes_resource.aws_auth, null)
}

but then i encounter this issue with the provider

╷
│ Error: Provider produced null object
│ 
│ Provider "provider[\"registry.terraform.io/hashicorp/kubernetes\"]" produced a null value for
│ data.kubernetes_resource.aws_auth.
│ 
│ This is a bug in the provider, which should be reported in the provider's own issue tracker.
╵

again, I understand that is by design as it is consistent with other data resources like data.aws_ami that also throw an error when no resource is found. But I think it would be nice if the data resource would return a null value when a resource does not exist so that the user can handle the missing resource rather than having the provider throw an error. I think this would create a sane work around for the issue described above.

aidanmelen · 2022-04-01T15:30:27Z

I suppose another workaround could be to indirectly check for the existence of aws-auth by checking the managed node groups or fargate profile roles outputs from the eks module. If any exist, then use the kubernetes_config_map_v1_data resource. Otherwise, use the kubernetes_manifest data resource to create the configmap with field_manager.force_conflicts = true.

jrhouston · 2022-04-01T17:56:24Z

Thanks for testing this out @aidanmelen and for the great discussion.

Throwing an error when the data source doesn't exist is pretty standard across terraform providers and so I would prefer to stay consistent with that pattern.

However, I do have plans (soon) to add a kubernetes_resources resource that would be a generic way to query for a list of resources like kubectl's --field-selector and --label-selector, which would return an empty list if nothing is found. I think that's something you could use to work around the use-case you've described above.

aidanmelen · 2022-04-01T18:15:28Z

Throwing an error when the data source doesn't exist is pretty standard across terraform providers and so I would prefer to stay consistent with that pattern.

It is unfortunate that Terraform took that approach for data resources. But I agree, it is best to stay consistent.

aidanmelen · 2022-04-01T18:19:03Z

However, I do have plans (soon) to add a kubernetes_resources resource that would be a generic way to query for a list of resources like kubectl's --field-selector and --label-selector, which would return an empty list if nothing is found. I think that's something you could use to work around the use-case you've described above.

I like that a lot. I vote yes. It would be really similiar to the pattern used by the kubectl_server_version resource in the kubectl provider.

arybolovlev

One minor comment. The rest looks great and works as expected! 🚀 👍🏻

kubernetes/resource_kubernetes_config_map_v1_data.go

arybolovlev

Awesome! 🚀

github-actions · 2022-05-07T02:21:04Z

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

github-actions bot added documentation size/M labels Mar 30, 2022

Add kubernetes_config_map_v1_data resource

6e78753

jrhouston force-pushed the configmap-data-resource branch from 0495501 to 6e78753 Compare March 31, 2022 14:07

github-actions bot added size/XL and removed size/M labels Mar 31, 2022

arybolovlev reviewed Mar 31, 2022

View reviewed changes

aidanmelen mentioned this pull request Apr 1, 2022

Added patch support to kubernetes_manifest resource #1667

Closed

2 tasks

aidanmelen mentioned this pull request Apr 1, 2022

configmap-data-resource aidanmelen/terraform-aws-eks-auth#15

Closed

aidanmelen mentioned this pull request Apr 1, 2022

Does not update the aws-auth for newly created cluster. aidanmelen/terraform-aws-eks-auth#16

Closed

arybolovlev reviewed Apr 4, 2022

View reviewed changes

kubernetes/resource_kubernetes_config_map_v1_data.go Show resolved Hide resolved

jrhouston added 4 commits April 5, 2022 00:42

Add subcategory to documentation page

e7e8eaa

set default value for namespace

fa43ccd

remove superfluous import

e578708

tidy up provider.go

b2bfbc8

arybolovlev approved these changes Apr 5, 2022

View reviewed changes

jrhouston merged commit 9544e7c into main Apr 6, 2022

jrhouston deleted the configmap-data-resource branch April 6, 2022 03:29

bryantbiggs mentioned this pull request Apr 8, 2022

feat: Add support for managing aws-auth configmap using new kubernetes_config_map_v1_data resource terraform-aws-modules/terraform-aws-eks#1999

Merged

3 tasks

github-actions bot locked as resolved and limited conversation to collaborators May 7, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add kubernetes_config_map_v1_data resource #1671

Add kubernetes_config_map_v1_data resource #1671

jrhouston commented Mar 30, 2022

arybolovlev left a comment

arybolovlev Mar 31, 2022

jrhouston Mar 31, 2022

aidanmelen commented Apr 1, 2022

aidanmelen commented Apr 1, 2022 •

edited

Loading

aidanmelen commented Apr 1, 2022 •

edited

Loading

aidanmelen commented Apr 1, 2022

jrhouston commented Apr 1, 2022

aidanmelen commented Apr 1, 2022 •

edited

Loading

aidanmelen commented Apr 1, 2022 •

edited

Loading

arybolovlev left a comment

arybolovlev left a comment

github-actions bot commented May 7, 2022

Add kubernetes_config_map_v1_data resource #1671

Add kubernetes_config_map_v1_data resource #1671

Conversation

jrhouston commented Mar 30, 2022

Description

Acceptance tests

Release Note

References

Community Note

arybolovlev left a comment

Choose a reason for hiding this comment

arybolovlev Mar 31, 2022

Choose a reason for hiding this comment

jrhouston Mar 31, 2022

Choose a reason for hiding this comment

aidanmelen commented Apr 1, 2022

aidanmelen commented Apr 1, 2022 • edited Loading

aidanmelen commented Apr 1, 2022 • edited Loading

aidanmelen commented Apr 1, 2022

jrhouston commented Apr 1, 2022

aidanmelen commented Apr 1, 2022 • edited Loading

aidanmelen commented Apr 1, 2022 • edited Loading

arybolovlev left a comment

Choose a reason for hiding this comment

arybolovlev left a comment

Choose a reason for hiding this comment

github-actions bot commented May 7, 2022

aidanmelen commented Apr 1, 2022 •

edited

Loading

aidanmelen commented Apr 1, 2022 •

edited

Loading

aidanmelen commented Apr 1, 2022 •

edited

Loading

aidanmelen commented Apr 1, 2022 •

edited

Loading