Skip to content

Commit 8fe1396

Browse files
dkoshkindkoshkin
committed
feat: add identityRef to AWS and EKS clusters
1 parent e24db2b commit 8fe1396

File tree

24 files changed

+650
-59
lines changed

24 files changed

+650
-59
lines changed

‎api/v1alpha1/aws_clusterconfig_types.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,11 @@ import (
88
)
99

1010
type AWSSpec struct {
11+
// IdentityRef is a reference to an identity to be used when reconciling the managed control plane.
12+
// If no identity is specified, the default identity for this controller will be used.
13+
// +kubebuilder:validation:Optional
14+
IdentityRef *capav1.AWSIdentityReference `json:"identityRef,omitempty"`
15+
1116
// AWS region to create cluster in.
1217
// +kubebuilder:validation:Optional
1318
Region *Region `json:"region,omitempty"`

‎api/v1alpha1/crds/caren.nutanix.com_awsclusterconfigs.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -301,6 +301,26 @@ spec:
301301
- internal
302302
type: string
303303
type: object
304+
identityRef:
305+
description: |-
306+
IdentityRef is a reference to an identity to be used when reconciling the managed control plane.
307+
If no identity is specified, the default identity for this controller will be used.
308+
properties:
309+
kind:
310+
description: Kind of the identity.
311+
enum:
312+
- AWSClusterControllerIdentity
313+
- AWSClusterRoleIdentity
314+
- AWSClusterStaticIdentity
315+
type: string
316+
name:
317+
description: Name of the identity.
318+
minLength: 1
319+
type: string
320+
required:
321+
- kind
322+
- name
323+
type: object
304324
network:
305325
description: AWS network configuration.
306326
properties:

‎api/v1alpha1/crds/caren.nutanix.com_eksclusterconfigs.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -316,6 +316,26 @@ spec:
316316
eks:
317317
description: EKS cluster configuration.
318318
properties:
319+
identityRef:
320+
description: |-
321+
IdentityRef is a reference to an identity to be used when reconciling the managed control plane.
322+
If no identity is specified, the default identity for this controller will be used.
323+
properties:
324+
kind:
325+
description: Kind of the identity.
326+
enum:
327+
- AWSClusterControllerIdentity
328+
- AWSClusterRoleIdentity
329+
- AWSClusterStaticIdentity
330+
type: string
331+
name:
332+
description: Name of the identity.
333+
minLength: 1
334+
type: string
335+
required:
336+
- kind
337+
- name
338+
type: object
319339
network:
320340
description: AWS network configuration.
321341
properties:

‎api/v1alpha1/eks_clusterconfig_types.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,16 @@
33

44
package v1alpha1
55

6+
import (
7+
capav1 "github.com/nutanix-cloud-native/cluster-api-runtime-extensions-nutanix/api/external/sigs.k8s.io/cluster-api-provider-aws/v2/api/v1beta2"
8+
)
9+
610
type EKSSpec struct {
11+
// IdentityRef is a reference to an identity to be used when reconciling the managed control plane.
12+
// If no identity is specified, the default identity for this controller will be used.
13+
// +kubebuilder:validation:Optional
14+
IdentityRef *capav1.AWSIdentityReference `json:"identityRef,omitempty"`
15+
716
// AWS region to create cluster in.
817
// +kubebuilder:validation:Optional
918
Region *Region `json:"region,omitempty"`

‎api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 10 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎charts/cluster-api-runtime-extensions-nutanix/defaultclusterclasses/aws-cluster-class.yaml‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -29,20 +29,6 @@ spec:
2929
discoverVariablesExtension: awsworkerconfigvars-dv.cluster-api-runtime-extensions-nutanix
3030
generateExtension: awsworkerv4configpatch-gp.cluster-api-runtime-extensions-nutanix
3131
name: worker-config
32-
- definitions:
33-
- jsonPatches:
34-
- op: add
35-
path: /spec/template/spec/identityRef
36-
value:
37-
kind: AWSClusterControllerIdentity
38-
name: default
39-
selector:
40-
apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
41-
kind: AWSClusterTemplate
42-
matchResources:
43-
infrastructureCluster: true
44-
description: AWSClusterStaticIdentity identityRef to use when creating the cluster
45-
name: identityRef
4632
workers:
4733
machineDeployments:
4834
- class: default-worker

‎charts/cluster-api-runtime-extensions-nutanix/defaultclusterclasses/eks-cluster-class.yaml‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -24,20 +24,6 @@ spec:
2424
discoverVariablesExtension: eksworkerconfigvars-dv.cluster-api-runtime-extensions-nutanix
2525
generateExtension: eksworkerv4configpatch-gp.cluster-api-runtime-extensions-nutanix
2626
name: worker-config
27-
- definitions:
28-
- jsonPatches:
29-
- op: add
30-
path: /spec/template/spec/identityRef
31-
value:
32-
kind: AWSClusterControllerIdentity
33-
name: default
34-
selector:
35-
apiVersion: controlplane.cluster.x-k8s.io/v1beta2
36-
kind: AWSManagedControlPlaneTemplate
37-
matchResources:
38-
controlPlane: true
39-
description: AWSClusterStaticIdentity identityRef to use when creating the cluster
40-
name: identityRef
4127
workers:
4228
machineDeployments:
4329
- class: default-worker

‎docs/content/customization/aws/controlplaneloadbalancer.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ spec:
2929
3030
Applying this configuration will result in the following value being set:
3131
32-
- `AWSClusterTemplate`:
32+
- `AWSCluster`:
3333

3434
- ```yaml
3535
spec:

‎docs/content/customization/aws/identity-ref.md‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
+++
2+
title = "Identity Reference"
3+
+++
4+
5+
The identity reference customization allows the user to specify the AWS identity to use when reconciling the cluster.
6+
This identity reference can be used to authenticate with AWS services using different identity types such as
7+
AWSClusterControllerIdentity, AWSClusterRoleIdentity, or AWSClusterStaticIdentity.
8+
9+
This customization is available for AWS clusters when the
10+
[provider-specific cluster configuration patch]({{< ref "..">}}) is included in the `ClusterClass`.
11+
12+
For detailed information about AWS multi-tenancy and identity management, see the
13+
[Cluster API AWS Multi-tenancy documentation](https://cluster-api-aws.sigs.k8s.io/topics/multitenancy).
14+
15+
## Example
16+
17+
To specify the AWS identity reference for an AWS cluster, use the following configuration:
18+
19+
```yaml
20+
apiVersion: cluster.x-k8s.io/v1beta1
21+
kind: Cluster
22+
metadata:
23+
name: <NAME>
24+
spec:
25+
topology:
26+
variables:
27+
- name: clusterConfig
28+
value:
29+
aws:
30+
identityRef:
31+
kind: AWSClusterStaticIdentity
32+
name: my-aws-identity
33+
```
34+
35+
## Identity Types
36+
37+
The following identity types are supported:
38+
39+
- **AWSClusterControllerIdentity**: Uses the default identity for the controller
40+
- **AWSClusterRoleIdentity**: Assumes a role using the provided source reference
41+
- **AWSClusterStaticIdentity**: Uses static credentials stored in a secret
42+
43+
## Example with Different Identity Types
44+
45+
### Using AWSClusterRoleIdentity
46+
47+
```yaml
48+
apiVersion: cluster.x-k8s.io/v1beta1
49+
kind: Cluster
50+
metadata:
51+
name: <NAME>
52+
spec:
53+
topology:
54+
variables:
55+
- name: clusterConfig
56+
value:
57+
aws:
58+
identityRef:
59+
kind: AWSClusterRoleIdentity
60+
name: my-role-identity
61+
```
62+
63+
### Using AWSClusterStaticIdentity
64+
65+
```yaml
66+
apiVersion: cluster.x-k8s.io/v1beta1
67+
kind: Cluster
68+
metadata:
69+
name: <NAME>
70+
spec:
71+
topology:
72+
variables:
73+
- name: clusterConfig
74+
value:
75+
aws:
76+
identityRef:
77+
kind: AWSClusterStaticIdentity
78+
name: my-static-identity
79+
```
80+
81+
Applying this configuration will result in the following value being set:
82+
83+
- `AWSCluster`:
84+
85+
- ```yaml
86+
spec:
87+
template:
88+
spec:
89+
identityRef:
90+
kind: AWSClusterStaticIdentity
91+
name: my-aws-identity
92+
```
93+
94+
## Notes
95+
96+
- If no identity is specified, the default identity for the controller will be used
97+
- The identity reference must exist in the cluster before creating the cluster
98+
- For AWSClusterStaticIdentity, the referenced secret must contain the required AWS credentials
99+
- For AWSClusterRoleIdentity, the role must be properly configured with the necessary permissions

‎docs/content/customization/aws/network.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ spec:
5151
5252
Applying this configuration will result in the following value being set:
5353
54-
- `AWSClusterTemplate`:
54+
- `AWSCluster`:
5555

5656
- ```yaml
5757
spec:

0 commit comments

Comments
 (0)