EKS.AwsAuth is only accessible within its parent stack
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 74
Description
### Describe the feature
I cant access [AwsAuth](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_eks.AwsAuth.html) from anywhere but within its parent stack. I'm creating a State Machine in one stack and EKS Cluster in another.
If I try to import it into another stack using a public property in TS, I get a circular reference error:
```typescript
const app = new cdk.App();
const eks = new EksClusterCore(app, 'Cluster', {});
const stRoleMapping = new StRoleMapping(app, 'RoleMapping', {
awsAuth: eks.awsAuth
});
```
Gives: `Error: StRole should be defined in the scope of the Cluster stack to prevent circular dependencies`
If I import the EKS cluster, the AwsAuth class doesn't exist:
```typescript
export class StRoleMapping extends cdk.Stack {
constructor(scope: Construct, id: string, props?: StackProps) {
super(scope, id, props);
const cluster = aws_eks.Cluster.fromClusterAttributes(scope, 'Cluster', {
clusterName: aws_ssm.StringParameter.fromStringParameterName(
scope, 'ClusterName', 'ClusterName'
).stringValue,
clusterEndpoint: aws_ssm.StringParameter.fromStringParameterName(
scope, 'ClusterEndpoint', 'ClusterEndpoint'
).stringValue,
clusterCertificateAuthorityData: aws_ssm.StringParameter.fromStringParameterName(
scope, 'ClusterCertificateAuthorityData', 'ClusterCertificateAuthorityData'
).stringValue,
kubectlRoleArn: aws_ssm.StringParameter.fromStringParameterName(
scope, 'KubectlRoleArn', 'KubectlRoleArn'
).stringValue,
});
const stRoleArn = aws_ssm.StringParameter.fromStringParameterName(
this, 'StateMachineRoleArn', 'StateMachineRoleArn'
).stringValue;
cluster.awsAuth.addRoleMapping(stRoleArn, { // <== problem
username: 'foobar',
groups: []
})
}
}
```
Gives me `Property 'awsAuth' does not exist on type 'ICluster'`
I can import the cluster - I can write manifests to it - but it doesn't have the AwsAuth construct.
If I instantiate AwsAuth again, I lose connection to EKS because presumably the config-map/aws-auth gets overwritten, since AwsAuth is a construct.
### Use Case
I want to have 1 EKS cluster and a lot of apps that use it. I want each app to be able to set its role mappings against EKS. Each app is a different stack.
### Proposed Solution
Make sure `AwsAuth` is available for imported clusters.
### Other Information
Since I can't do it in aforementioned ways, I'd probably do a strategic merge update on configmap/aws-auth:
- https://stackoverflow.com/questions/54571185/how-to-patch-a-configmap-in-kubernetes
- https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch/#use-a-strategic-merge-patch-to-update-a-deployment
### Acknowledgements
- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change
### CDK version used
2.50.0 (build 4c11af6)
### Environment details (OS name and version, etc.)
MacOS Ventura
Contributor guide
Research direction
Start with aws_eks.AwsAuth and the imported-cluster path through Cluster.fromClusterAttributes; compare how awsAuth is created for a normal Cluster and how cross-stack references are handled. Define behavior for role mappings on imported clusters, then verify that a two-stack scenario supports mappings without circular references or overwriting the existing aws-auth configuration.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, kubernetes, typescript
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100