aws / aws/aws-cdk

aws-eks: Helm Chart support for TAR archives

Open
#33,781 1 comment 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-eks-v2-alpha effort/medium feature-request p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the feature

When using the L2 construct within the `aws_eks_v2_alpha` library defining a `HelmChart` construct, a `chartAsset` can optionally be specified instead of specifying a repository, but currently, only assets packaged as ZIP archives are supported:

https://github.com/aws/aws-cdk/blob/3d948c4eeb6ffc8e5d3203220fe7799dffbd59ef/packages/%40aws-cdk/aws-eks-v2-alpha/lib/kubectl-handler/helm/__init__.py#L20-L29

This creates an issue (e.g. non AWS-managed EKS drivers) when pulling a chart (on Linux/MacOS) which is then provided as a TGZ, for example:

```
helm pull aws-secrets-manager/secrets-store-csi-driver-provider-aws -d temp/charts
```

I suggest the `kubectl-handler` should support the typical formats returned `helm pull ...` across the main OS types.

### Use Case

When deploying helm charts to an air-gapped EKS cluster, they must be hosted in a way that is accessible to the `kubectl-handler` to pull it.

One way of achieving this is to upload helm charts using the CDK S3 Assets feature, Python example:

```
TEMP_CHARTS = 'temp/charts' # Generated outside of CDK

cluster = ... # An EKS Cluster created using the L2 construct from `aws_eks_v2_alpha`

driver_version = '1.4.8'

stack = Stack.of(construct)
prefix = f'{stack.account}.dkr.ecr.{stack.region}.amazonaws.com'

eks.HelmChart(
self, 'SecretsStoreCsiDriverChart', cluster=cluster, namespace='kube-system',
chart_asset=s3_assets.Asset(
self, 'ChartAsset', path=f'{TEMP_CHARTS}/secrets-store-csi-driver-${driver_version}.zip'
),
values={
'linux': {
'image': {
'repository': f'{prefix}/kubernetes/csi-secrets-store/driver'
},
'crds': {
'image': {
'repository': f'{prefix}/kubernetes/csi-secrets-store/driver-crds'
}
}
}
}
)
```

In the above, the default references to public repositories have been replaced with references to private ECR repos into which the required driver container image has been pushed.

The problem arises because the path to the asset (`f'{TEMP_CHARTS}/secrets-store-csi-driver-${driver_version}.zip'`) currently references a `.zip` file, when in practice the output for this chart from a `helm pull ...` command is a `.tgz`.

### Proposed Solution

Support multiple archive formats (at least ZIP and TAR GZ) within the `kubectl-handler/helm` module. Python has the builtin package `tarfile` which should suffice.

### Workaround
Extract the non-ZIP'd helm chart package and repackage it as a ZIP, achieved using the following example shell snippet:

```
repo_name='aws-secrets-manager'
chart_name='secrets-store-csi-driver-provider-aws'

temp_dir='temp/charts'
mkdir -p "$temp_dir"
helm pull "${repo_name}/${chart_name}" -d "$temp_dir" --untar
version=$(helm show chart "temp/charts/${chart_name}" | awk '/version/ {print $2}')

(export temp_dir chart_name version && cur=$(pwd) && cd "${temp_dir}/${chart_name}" && zip -r "${cur}/${temp_dir}/${chart_name}-${version}.zip" .)
```

### Other Information

On the face of it, pushing a copy of the chart into ECR should also work, but I struggled to get the `kubectl-handler` to successfully pull from it, hence resorted to referencing the chart as an S3 assets.

### Acknowledgements

- [x] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.1002.0 (build 09ef5a0)

### Environment details (OS name and version, etc.)

MacOS

Contributor guide

Open the contributing guide

Research direction

Start in packages/@aws-cdk/aws-eks-v2-alpha/lib/kubectl-handler/helm/__init__.py, particularly the asset archive handling linked in the issue. Trace how HelmChart chartAsset files are recognized and extracted, then verify that ZIP and TAR GZ assets are both handled for the described air-gapped EKS use case.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, helm, kubernetes, python
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.