aws / aws/aws-cdk

EKS.AwsAuth is only accessible within its parent stack

Open
#22,915 6 comments 1 reaction 0 assignees View on GitHub
@aws-cdk/aws-eks feature-request p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
1d 19h
Merged PRs (30d)
74

Description

### Describe the feature

I cant access [AwsAuth](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_eks.AwsAuth.html) from anywhere but within its parent stack. I'm creating a State Machine in one stack and EKS Cluster in another.

If I try to import it into another stack using a public property in TS, I get a circular reference error:
```typescript
const app = new cdk.App();
const eks = new EksClusterCore(app, 'Cluster', {});
const stRoleMapping = new StRoleMapping(app, 'RoleMapping', {
awsAuth: eks.awsAuth
});
```

Gives: `Error: StRole should be defined in the scope of the Cluster stack to prevent circular dependencies`

If I import the EKS cluster, the AwsAuth class doesn't exist:
```typescript
export class StRoleMapping extends cdk.Stack {
constructor(scope: Construct, id: string, props?: StackProps) {
super(scope, id, props);

const cluster = aws_eks.Cluster.fromClusterAttributes(scope, 'Cluster', {
clusterName: aws_ssm.StringParameter.fromStringParameterName(
scope, 'ClusterName', 'ClusterName'
).stringValue,
clusterEndpoint: aws_ssm.StringParameter.fromStringParameterName(
scope, 'ClusterEndpoint', 'ClusterEndpoint'
).stringValue,
clusterCertificateAuthorityData: aws_ssm.StringParameter.fromStringParameterName(
scope, 'ClusterCertificateAuthorityData', 'ClusterCertificateAuthorityData'
).stringValue,
kubectlRoleArn: aws_ssm.StringParameter.fromStringParameterName(
scope, 'KubectlRoleArn', 'KubectlRoleArn'
).stringValue,
});
const stRoleArn = aws_ssm.StringParameter.fromStringParameterName(
this, 'StateMachineRoleArn', 'StateMachineRoleArn'
).stringValue;

cluster.awsAuth.addRoleMapping(stRoleArn, { // <== problem
username: 'foobar',
groups: []
})
}
}
```

Gives me `Property 'awsAuth' does not exist on type 'ICluster'`

I can import the cluster - I can write manifests to it - but it doesn't have the AwsAuth construct.

If I instantiate AwsAuth again, I lose connection to EKS because presumably the config-map/aws-auth gets overwritten, since AwsAuth is a construct.

### Use Case

I want to have 1 EKS cluster and a lot of apps that use it. I want each app to be able to set its role mappings against EKS. Each app is a different stack.

### Proposed Solution

Make sure `AwsAuth` is available for imported clusters.

### Other Information

Since I can't do it in aforementioned ways, I'd probably do a strategic merge update on configmap/aws-auth:
- https://stackoverflow.com/questions/54571185/how-to-patch-a-configmap-in-kubernetes
- https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch/#use-a-strategic-merge-patch-to-update-a-deployment

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.50.0 (build 4c11af6)

### Environment details (OS name and version, etc.)

MacOS Ventura

Contributor guide

Open the contributing guide

Research direction

Start with aws_eks.AwsAuth and the imported-cluster path through Cluster.fromClusterAttributes; compare how awsAuth is created for a normal Cluster and how cross-stack references are handled. Define behavior for role mappings on imported clusters, then verify that a two-stack scenario supports mappings without circular references or overwriting the existing aws-auth configuration.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes, typescript
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.