EKS [request]: Allow Access to AdmissionConfiguration using --admission-control-config-file in CreateCluster API
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
What do you want us to build?
Allow AdmissionConfigurations to be set by allowing files to be passed to --admission-control-config-file to configure AdmissionConfigurations.
**Which service(s) is this request for?**
EKS
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
What outcome are you trying to achieve, ultimately, and why is it hard/impossible to do right now? What is the impact of not having this problem solved? The more details you can provide, the better we'll be able to understand and solve the problem.
The main AdmissionConfiguration this is for is the [PodSecurityConfiguration](https://v1-23.docs.kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-admission-controller/) however there are a lot of [others](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#configuration-file-format-1) that this could impact.
By not having this feature the only way to configure pod security is [by Namespace](https://v1-23.docs.kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-namespace-labels/)
**Are you currently working around this issue?**
How are you currently solving this problem?
By making changes [by Namespace](https://v1-23.docs.kubernetes.io/docs/tasks/configure-pod-container/enforce-standards-namespace-labels/)
**Additional context**
Anything else we should know?
This is likley to be more relevent as PodSecurity was changed in 1.23 by activating the PodSecurity feature gate and removing [podsecuritypolicy](https://kubernetes.io/blog/2021/04/06/podsecuritypolicy-deprecation-past-present-and-future/).
**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)
Contributor guide
Research direction
Start by reviewing the EKS CreateCluster API and the Kubernetes AdmissionConfiguration and PodSecurityConfiguration documentation linked in the issue. The issue names no repository files, tests, or implementation entry points. Done means EKS can accept admission-control configuration files through --admission-control-config-file and apply the resulting AdmissionConfigurations.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, kubernetes
- Domain
- api, cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100