[EKS] [request]: Allow managed EC2 nodes to optionally disable creating EKS access entries
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
We'd like to be able to tell EKS to not create an EKS access entry when creating EKS managed EC2 node groups. Right now EKS will always create an access entry upon creation of a node group and it makes it impossible to properly capture and reconcile this entry in our IaC tools (i.e Terraform) without manually intervening to import the automatically generated entry.
Disabling the access entry creation would allow us to create and manage the access entry with our tooling separately, and would give us a streamlined troubleshooting/recovery step in a disaster event if the access entry is modified or removed accidentally as it would remove the steps needed to recreate the entry manually, even if there is a risk that nodes created by the new group can fail to join the cluster if the access entry isn't immediately created.
**Which service(s) is this request for?**
EKS
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
We are migrating to EKS access entries in place of aws-auth ConfigMap for authenticating requests to our clusters and an issue we've noticed early on during testing is that when you remove an access entry that was created by a managed EC2 node group, EKS doesn't provide any way to quickly/automatically rebuild the lost access policy which can cause a cluster outage if the nodes lose their permission to talk to the control plane.
While we ensure only the minimal amount of users and services have access to modify EKS access entries in our accounts already, no one is perfect and accidents can happen. We would like to ensure that in the event of an accident we can easily recover the broken access entries at 3:12AM with minimal complications.
Contributor guide
Assessment
This issue has not been assessed yet.