Allow access to Worker Node Role in EKS Auto mode clusters
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the feature
The new `Cluster` class creates an EKS cluster in auto mode, and it creates the worker node for the general-purpose pool too: https://github.com/aws/aws-cdk/blob/0a55ed1a01009d28739e8f081b1ce0ad78eac73d/packages/%40aws-cdk/aws-eks-v2-alpha/lib/cluster.ts#L1193
However, that role is not easy to get hold of to modify.
We would like to add a permission to that node role. At the moment we do a Child dig like this:
```typescript
const all = Node.of(context).findAll();
// @ts-ignore
const roles = all.filter(c => c.assumeRoleAction) as Role[];
const workerRoles = roles.filter((c) => {
// @ts-ignore
return c["managedPolicies"]?.find(mp => mp["managedPolicyArn"].indexOf(":iam::aws:policy/AmazonEKSWorkerNodePolicy") > -1)
}) as Role[];
// Probably the first one
```
### Use Case
We have pods running with ServiceAccounts to and bound to roles, all that is fine. But sometimes there is some "default" access coming out of a pod (eg DIND). We want to modify the permissions for that access.
### Proposed Solution
Expose the WorkerNode Role after a cluster has been created. eg:
```typescript
const cluster = new Cluster(....)
const role = cluster.workerNodeRole;
```
### Other Information
_No response_
### Acknowledgements
- [x] I may be able to implement this feature request
- [ ] This feature might incur a breaking change
### AWS CDK Library version (aws-cdk-lib)
2.190.0
### AWS CDK CLI version
2.1007.0
### Environment details (OS name and version, etc.)
Linux
Contributor guide
Research direction
Start in packages/@aws-cdk/aws-eks-v2-alpha/lib/cluster.ts around the general-purpose worker node creation at line 1193, using the Cluster class as the entry point. Trace how the worker role is created and determine how it can be exposed publicly. Done means callers can access that role after creating a Cluster and modify its permissions without searching the construct tree.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 58/100