[aws-eks] Default masters role #9463
Assignees
Labels
@aws-cdk/aws-eks
Related to Amazon Elastic Kubernetes Service
feature-request
A feature should be added or improved.
Milestone
Comments
2 tasks
eladb
pushed a commit
that referenced
this issue
Aug 5, 2020
If `mastersRole` is not specified, we now define a default IAM role that can be assumed by anyone (with permissions) in the account. This will allow users to interact with the cluster through `kubectl` by issuing the `aws eks update-kubeconfig` command with the appropriate `--role-arn` option, as specified in the CFN output. Fixes #9463
eladb
pushed a commit
that referenced
this issue
Aug 5, 2020
If `mastersRole` is not specified, we now define a default IAM role that can be assumed by anyone (with permissions) in the account.
If `mastersRole` is not specified, we now define a default IAM role that can be assumed by anyone (with permissions) in the account.
This will allow users to interact with the cluster through `kubectl` by issuing the `aws eks update-kubeconfig` command with the appropriate `--role-arn` option, as specified in the CFN output.
Fixes #9463
mergify bot
pushed a commit
that referenced
this issue
Aug 5, 2020
If `mastersRole` is not specified, we now define a default IAM role that can be assumed by anyone (with permissions) in the account.
This will allow users to interact with the cluster through `kubectl` by issuing the `aws eks update-kubeconfig` command with the appropriate `--role-arn` option, as specified in the CFN output.
Fixes #9463
----
*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
eladb
pushed a commit
that referenced
this issue
Aug 10, 2020
If `mastersRole` is not specified, we now define a default IAM role that can be assumed by anyone (with permissions) in the account.
This will allow users to interact with the cluster through `kubectl` by issuing the `aws eks update-kubeconfig` command with the appropriate `--role-arn` option, as specified in the CFN output.
Fixes #9463
----
*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Today, in order to issue
kubectlcommands against an EKS cluster, themastersRolemust be explicitly defined. This creates quite a lot of friction for users.Moreoever, the
kubectlEnabledoption was confused to "solve" this problem because it falls back to use the stock CFN resource, which grants masters permissions to the user that creates the cluster (so kubectl commands can be issued).To solve this, we should simply auto-generate a masters role if a role is not defined.
The text was updated successfully, but these errors were encountered: