aws / aws/aws-cdk

Allow access to Worker Node Role in EKS Auto mode clusters

Open
#35,475 4 comments 4 reactions 0 assignees View on GitHub
@aws-cdk/aws-eks-v2-alpha feature-request p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the feature

The new `Cluster` class creates an EKS cluster in auto mode, and it creates the worker node for the general-purpose pool too: https://github.com/aws/aws-cdk/blob/0a55ed1a01009d28739e8f081b1ce0ad78eac73d/packages/%40aws-cdk/aws-eks-v2-alpha/lib/cluster.ts#L1193

However, that role is not easy to get hold of to modify.

We would like to add a permission to that node role. At the moment we do a Child dig like this:

```typescript
const all = Node.of(context).findAll();
// @ts-ignore
const roles = all.filter(c => c.assumeRoleAction) as Role[];
const workerRoles = roles.filter((c) => {
// @ts-ignore
return c["managedPolicies"]?.find(mp => mp["managedPolicyArn"].indexOf(":iam::aws:policy/AmazonEKSWorkerNodePolicy") > -1)
}) as Role[];
// Probably the first one
```

### Use Case

We have pods running with ServiceAccounts to and bound to roles, all that is fine. But sometimes there is some "default" access coming out of a pod (eg DIND). We want to modify the permissions for that access.

### Proposed Solution

Expose the WorkerNode Role after a cluster has been created. eg:

```typescript
const cluster = new Cluster(....)
const role = cluster.workerNodeRole;
```

### Other Information

_No response_

### Acknowledgements

- [x] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### AWS CDK Library version (aws-cdk-lib)

2.190.0

### AWS CDK CLI version

2.1007.0

### Environment details (OS name and version, etc.)

Linux

Contributor guide

Open the contributing guide

Research direction

Start in packages/@aws-cdk/aws-eks-v2-alpha/lib/cluster.ts around the general-purpose worker node creation at line 1193, using the Cluster class as the entry point. Trace how the worker role is created and determine how it can be exposed publicly. Done means callers can access that role after creating a Cluster and modify its permissions without searching the construct tree.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.