aws / aws/aws-cdk

eks: Creating a Pod Identity service account should check if the Pod Identity Agent is already installed

Open
#32,580 4 comments 8 reactions 0 assignees View on GitHub
@aws-cdk/aws-eks @aws-cdk/aws-eks-v2-alpha bug effort/small p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

If the Pod Identity Agent add-on is already created

```
new Addon(this, 'podIdentityAgent', {
addonName: 'eks-pod-identity-agent',
cluster: cluster,
addonVersion: 'v1.3.4-eksbuild.1'
});
```

Then adding a new Pod Identity service account will fail because the add-on is already installed

```
const serviceAccount = new ServiceAccount(this, 'testServiceAccount', {
cluster: cluster,
name: 'test-sa',
namespace: 'default',
identityType: IdentityType.POD_IDENTITY
});
```

Error message: "eks-pod-identity-agent already exists in stack"

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

The creation of the Pod Identity service account would detect that the Pod Identity Agent is already installed and skip that step

### Current Behavior

The creation of the Pod Identity service does not detect that the Pod Identity Agent is already installed and the deployment fails

### Reproduction Steps

Create the Pod Identity Agent add-on

```
new Addon(this, 'podIdentityAgent', {
addonName: 'eks-pod-identity-agent',
cluster: cluster,
addonVersion: 'v1.3.4-eksbuild.1'
});
```

Then add a new Pod Identity service account

```
const serviceAccount = new ServiceAccount(this, 'testServiceAccount', {
cluster: cluster,
name: 'test-sa',
namespace: 'default',
identityType: IdentityType.POD_IDENTITY
});
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.167.1

### Framework Version

_No response_

### Node.js Version

18.20.4

### OS

MacOS

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start at the ServiceAccount construct's IdentityType.POD_IDENTITY path and inspect how it creates or references the eks-pod-identity-agent Addon. Reproduce the issue with the Addon and ServiceAccount snippets, then verify that an already-installed agent is detected without a duplicate-resource error and that deployment succeeds.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.