aws / aws/containers-roadmap

[EKS] [Aggregation Layer]: Configure Aggregation Layer ('client-ca-file' ConfigMap missing)

Open
#152 7 comments 6 reactions 0 assignees View on GitHub
EKS
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

**Tell us about your request**
Support webhooks for the API Aggregation Layer by issue a creating the `client-ca-file` ConfigMap.

How to configure the Aggregation Layer:
https://kubernetes.io/docs/tasks/access-kubernetes-api/configure-aggregation-layer/

See `--requestheader-client-ca-file` in https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/ (this is current version reference but this functionality has been available since at least v1.8.x)

**Which service(s) is this request for?**
EKS (k8s v1.11.5)

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**

Trying to install [`cert-manager`](https://github.com/jetstack/cert-manager) with webhook CRD validation. Installation fails because [EKS appears not to be k8s conformant in this regard](https://github.com/jetstack/cert-manager/issues/1220).

Trying to install Prometheus on EKS but again Aggregation Layer has not been properly configured in the EKS control plane.
- https://github.com/DirectXMan12/k8s-prometheus-adapter/issues/119
- https://github.com/DirectXMan12/k8s-prometheus-adapter/issues/108

**Are you currently working around this issue?**
Disabling Aggregation Layer functionality where possible.

**Additional context**
The Aggregation Layer with webhooks has been available since k8s v1.8.x or earlier.
This works out of the box on `kube-aws` and GKE clusters.

Contributor guide

Open the contributing guide

Research direction

Start with the Kubernetes Aggregation Layer configuration guide and the kube-apiserver reference for --requestheader-client-ca-file, then review the linked cert-manager and Prometheus adapter issues. No repository file or test is identified; done means EKS creates the client-ca-file ConfigMap and supports webhook-based aggregation without disabling the functionality.

Written by the indexing model from the issue text.

Assessment

Tech stack
kubernetes
Domain
api, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.