Skip to content

fix(eks): cluster deployment issue when the authentication mode is not changing #33680

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mergify merged 5 commits into from
Mar 5, 2025
Merged

fix(eks): cluster deployment issue when the authentication mode is not changing #33680

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
57c98a9
fix edge case
xazhao Mar 4, 2025
a617378
fix
xazhao Mar 4, 2025
dca1ab4
fix fix
xazhao Mar 4, 2025
5e2f884
Merge branch 'main' into eks-same-mode-deployment
paulhcsun Mar 5, 2025
f538c20
Merge branch 'main' into eks-same-mode-deployment
mergify[bot] Mar 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 12 additions & 11 deletions packages/@aws-cdk/custom-resource-handlers/lib/aws-eks/cluster-resource-handler/cluster.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -218,6 +218,18 @@ export class ClusterResourceHandler extends ResourceHandler {
}

if (updates.updateAuthMode) {
// update-authmode will fail if we try to update to the same mode,
// so skip in this case.
try {
const cluster = (await this.eks.describeCluster({ name: this.clusterName })).cluster;
if (cluster?.accessConfig?.authenticationMode === this.newProps.accessConfig?.authenticationMode) {
console.log(`cluster already at ${cluster?.accessConfig?.authenticationMode}, skipping authMode update`);
return;
}
} catch (e: any) {
throw e;
}

// the update path must be
// `undefined or CONFIG_MAP` -> `API_AND_CONFIG_MAP` -> `API`
// and it's one way path.
Expand Down Expand Up @@ -247,17 +259,6 @@ export class ClusterResourceHandler extends ResourceHandler {
this.newProps.accessConfig?.authenticationMode === 'API') {
throw new Error('Cannot update from CONFIG_MAP to API');
}
// update-authmode will fail if we try to update to the same mode,
// so skip in this case.
try {
const cluster = (await this.eks.describeCluster({ name: this.clusterName })).cluster;
if (cluster?.accessConfig?.authenticationMode === this.newProps.accessConfig?.authenticationMode) {
console.log(`cluster already at ${cluster?.accessConfig?.authenticationMode}, skipping authMode update`);
return;
}
} catch (e: any) {
throw e;
}
config.accessConfig = this.newProps.accessConfig;
}

Expand Down
1 change: 1 addition & 0 deletions packages/@aws-cdk/custom-resource-handlers/test/aws-eks/cluster-resource-handler-mocks.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,7 @@ export const client: EksClient = {
arn: 'arn:cluster-arn',
certificateAuthority: { data: 'certificateAuthority-data' },
endpoint: 'http://endpoint',
accessConfig: { authenticationMode: 'CONFIG_MAP' },
status: simulateResponse.describeClusterResponseMockStatus || 'ACTIVE',
},
};
Expand Down
30 changes: 0 additions & 30 deletions packages/@aws-cdk/custom-resource-handlers/test/aws-eks/cluster-resource-provider.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -590,21 +590,6 @@ describe('cluster resource provider', () => {

expect(error.message).toEqual('Cannot fallback authenticationMode from defined to undefined');
});
test('fails from API_AND_CONFIG_MAP to CONFIG_MAP', async () => {
const handler = new ClusterResourceHandler(mocks.client, mocks.newRequest('Update', {
accessConfig: { authenticationMode: 'CONFIG_MAP' },
}, {
accessConfig: { authenticationMode: 'API_AND_CONFIG_MAP' },
}));
let error: any;
try {
await handler.onEvent();
} catch (e) {
error = e;
}

expect(error.message).toEqual('Cannot fallback authenticationMode from API_AND_CONFIG_MAP to CONFIG_MAP');
});
test('fails from API to undefined', async () => {
const handler = new ClusterResourceHandler(mocks.client, mocks.newRequest('Update', {
accessConfig: { authenticationMode: undefined },
Expand Down Expand Up @@ -635,21 +620,6 @@ describe('cluster resource provider', () => {

expect(error.message).toEqual('Cannot fallback authenticationMode from API to API_AND_CONFIG_MAP');
});
test('fails from API to CONFIG_MAP', async () => {
const handler = new ClusterResourceHandler(mocks.client, mocks.newRequest('Update', {
accessConfig: { authenticationMode: 'CONFIG_MAP' },
}, {
accessConfig: { authenticationMode: 'API' },
}));
let error: any;
try {
await handler.onEvent();
} catch (e) {
error = e;
}

expect(error.message).toEqual('Cannot fallback authenticationMode from API to CONFIG_MAP');
});
test('fails from undefined to API', async () => {
const handler = new ClusterResourceHandler(mocks.client, mocks.newRequest('Update', {
accessConfig: { authenticationMode: 'API' },
Expand Down