aws / aws/containers-roadmap

EKS [request]: Allow Access to AdmissionConfiguration using --admission-control-config-file in CreateCluster API

Open
#1,822 1 comment 77 reactions 0 assignees View on GitHub
EKS
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
What do you want us to build?

Allow AdmissionConfigurations to be set by allowing files to be passed to --admission-control-config-file to configure AdmissionConfigurations.

**Which service(s) is this request for?**
EKS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
What outcome are you trying to achieve, ultimately, and why is it hard/impossible to do right now? What is the impact of not having this problem solved? The more details you can provide, the better we'll be able to understand and solve the problem.

The main AdmissionConfiguration this is for is the [PodSecurityConfiguration](https://v1-23.docs.kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-admission-controller/) however there are a lot of [others](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#configuration-file-format-1) that this could impact.

By not having this feature the only way to configure pod security is [by Namespace](https://v1-23.docs.kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-namespace-labels/)

**Are you currently working around this issue?**
How are you currently solving this problem?

By making changes [by Namespace](https://v1-23.docs.kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-namespace-labels/)

**Additional context**
Anything else we should know?

This is likley to be more relevent as PodSecurity was changed in 1.23 by activating the PodSecurity feature gate and removing [podsecuritypolicy](https://kubernetes.io/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/).

**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the EKS CreateCluster API and the Kubernetes AdmissionConfiguration and PodSecurityConfiguration documentation linked in the issue. The issue names no repository files, tests, or implementation entry points. Done means EKS can accept admission-control configuration files through --admission-control-config-file and apply the resulting AdmissionConfigurations.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes
Domain
api, cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.