Skip to content

Commit ae815c8

Browse files
flostadlerflostadler
authored
Allow creating default instance role even when no default node group is created (#1511)
As part of #1176 we took the decision to not create the default instance role if users disable the default node groups. Our assumption back then was that there's not a substantial need for this role when users opt out of the default node groups. #1510 has shown that there is indeed users that were relying on this default instance role that was created "by accident". This original change made the upgrade to v3 more painful than necessary for this set of users! This change introduces a new plain flag `createInstanceRole` that can be used to opt-into creating the default instance role even when no default node group is needed. Resolves #1510
1 parent 230eba5 commit ae815c8

File tree

13 files changed

+210
-1
lines changed

13 files changed

+210
-1
lines changed

‎nodejs/eks/cluster.ts

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -824,7 +824,10 @@ export function createCore(
824824
}
825825
instanceRoles = pulumi.output([args.instanceRole]);
826826
defaultInstanceRole = pulumi.output(args.instanceRole);
827-
} else if (!args.skipDefaultNodeGroup) {
827+
} else if (
828+
args.createInstanceRole ||
829+
(!args.skipDefaultNodeGroup && args.createInstanceRole === undefined)
830+
) {
828831
const instanceRole = new ServiceRole(
829832
`${name}-instanceRole`,
830833
{
@@ -1772,6 +1775,13 @@ export interface ClusterOptions {
17721775
* See for more details:\nhttps://docs.aws.amazon.com/eks/latest/userguide/access-entries.html
17731776
*/
17741777
accessEntries?: { [key: string]: AccessEntry };
1778+
1779+
/**
1780+
* Whether to create the instance role for the EKS cluster.
1781+
* Defaults to true when using the default node group, false otherwise.
1782+
* If set to false when using the default node group, an instance role or instance profile must be provided.
1783+
*/
1784+
createInstanceRole?: boolean;
17751785
}
17761786

17771787
/**

‎provider/cmd/pulumi-gen-eks/main.go

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -762,6 +762,16 @@ func generateSchema(version semver.Version, outdir string) schema.PackageSpec {
762762
},
763763
Description: "Options for managing the `kube-proxy` addon.",
764764
},
765+
"createInstanceRole": {
766+
TypeSpec: schema.TypeSpec{
767+
Type: "boolean",
768+
Plain: true,
769+
},
770+
Description: "Whether to create the instance role for the EKS cluster. " +
771+
"Defaults to true when using the default node group, false otherwise.\n" +
772+
"If set to false when using the default node group, an instance role or instance profile must be provided.n\n" +
773+
"Note: this option has no effect if a custom instance role is provided with `instanceRole` or `instanceRoles`.",
774+
},
765775
},
766776
Methods: map[string]string{
767777
"getKubeconfig": "eks:index:Cluster/getKubeconfig",

‎provider/cmd/pulumi-resource-eks/schema.json

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1220,6 +1220,11 @@
12201220
"plain": true,
12211221
"description": "Options for managing the `coredns` addon."
12221222
},
1223+
"createInstanceRole": {
1224+
"type": "boolean",
1225+
"plain": true,
1226+
"description": "Whether to create the instance role for the EKS cluster. Defaults to true when using the default node group, false otherwise.\nIf set to false when using the default node group, an instance role or instance profile must be provided.n\nNote: this option has no effect if a custom instance role is provided with `instanceRole` or `instanceRoles`."
1227+
},
12231228
"createOidcProvider": {
12241229
"type": "boolean",
12251230
"description": "Indicates whether an IAM OIDC Provider is created for the EKS cluster.\n\nThe OIDC provider is used in the cluster in combination with k8s Service Account annotations to provide IAM roles at the k8s Pod level.\n\nSee for more details:\n - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html\n - https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html\n - https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/\n - https://www.pulumi.com/registry/packages/aws/api-docs/eks/cluster/#enabling-iam-roles-for-service-accounts"

‎sdk/dotnet/Cluster.cs

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -260,6 +260,14 @@ public InputMap<string> ClusterTags
260260
[Input("corednsAddonOptions")]
261261
public Inputs.CoreDnsAddonOptionsArgs? CorednsAddonOptions { get; set; }
262262

263+
/// <summary>
264+
/// Whether to create the instance role for the EKS cluster. Defaults to true when using the default node group, false otherwise.
265+
/// If set to false when using the default node group, an instance role or instance profile must be provided.n
266+
/// Note: this option has no effect if a custom instance role is provided with `instanceRole` or `instanceRoles`.
267+
/// </summary>
268+
[Input("createInstanceRole")]
269+
public bool? CreateInstanceRole { get; set; }
270+
263271
/// <summary>
264272
/// Indicates whether an IAM OIDC Provider is created for the EKS cluster.
265273
///

‎sdk/go/eks/cluster.go

Lines changed: 8 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎sdk/java/src/main/java/com/pulumi/eks/ClusterArgs.java

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -140,6 +140,25 @@ public Optional<CoreDnsAddonOptionsArgs> corednsAddonOptions() {
140140
return Optional.ofNullable(this.corednsAddonOptions);
141141
}
142142

143+
/**
144+
* Whether to create the instance role for the EKS cluster. Defaults to true when using the default node group, false otherwise.
145+
* If set to false when using the default node group, an instance role or instance profile must be provided.n
146+
* Note: this option has no effect if a custom instance role is provided with `instanceRole` or `instanceRoles`.
147+
*
148+
*/
149+
@Import(name="createInstanceRole")
150+
private @Nullable Boolean createInstanceRole;
151+
152+
/**
153+
* @return Whether to create the instance role for the EKS cluster. Defaults to true when using the default node group, false otherwise.
154+
* If set to false when using the default node group, an instance role or instance profile must be provided.n
155+
* Note: this option has no effect if a custom instance role is provided with `instanceRole` or `instanceRoles`.
156+
*
157+
*/
158+
public Optional<Boolean> createInstanceRole() {
159+
return Optional.ofNullable(this.createInstanceRole);
160+
}
161+
143162
/**
144163
* Indicates whether an IAM OIDC Provider is created for the EKS cluster.
145164
*
@@ -1090,6 +1109,7 @@ private ClusterArgs(ClusterArgs $) {
10901109
this.clusterSecurityGroupTags = $.clusterSecurityGroupTags;
10911110
this.clusterTags = $.clusterTags;
10921111
this.corednsAddonOptions = $.corednsAddonOptions;
1112+
this.createInstanceRole = $.createInstanceRole;
10931113
this.createOidcProvider = $.createOidcProvider;
10941114
this.creationRoleProvider = $.creationRoleProvider;
10951115
this.defaultAddonsToRemove = $.defaultAddonsToRemove;
@@ -1263,6 +1283,19 @@ public Builder corednsAddonOptions(@Nullable CoreDnsAddonOptionsArgs corednsAddo
12631283
return this;
12641284
}
12651285

1286+
/**
1287+
* @param createInstanceRole Whether to create the instance role for the EKS cluster. Defaults to true when using the default node group, false otherwise.
1288+
* If set to false when using the default node group, an instance role or instance profile must be provided.n
1289+
* Note: this option has no effect if a custom instance role is provided with `instanceRole` or `instanceRoles`.
1290+
*
1291+
* @return builder
1292+
*
1293+
*/
1294+
public Builder createInstanceRole(@Nullable Boolean createInstanceRole) {
1295+
$.createInstanceRole = createInstanceRole;
1296+
return this;
1297+
}
1298+
12661299
/**
12671300
* @param createOidcProvider Indicates whether an IAM OIDC Provider is created for the EKS cluster.
12681301
*

‎sdk/nodejs/cluster.ts

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -143,6 +143,7 @@ export class Cluster extends pulumi.ComponentResource {
143143
resourceInputs["clusterSecurityGroupTags"] = args ? args.clusterSecurityGroupTags : undefined;
144144
resourceInputs["clusterTags"] = args ? args.clusterTags : undefined;
145145
resourceInputs["corednsAddonOptions"] = args ? (args.corednsAddonOptions ? inputs.coreDnsAddonOptionsArgsProvideDefaults(args.corednsAddonOptions) : undefined) : undefined;
146+
resourceInputs["createInstanceRole"] = args ? args.createInstanceRole : undefined;
146147
resourceInputs["createOidcProvider"] = args ? args.createOidcProvider : undefined;
147148
resourceInputs["creationRoleProvider"] = args ? args.creationRoleProvider : undefined;
148149
resourceInputs["defaultAddonsToRemove"] = args ? args.defaultAddonsToRemove : undefined;
@@ -288,6 +289,12 @@ export interface ClusterArgs {
288289
* Options for managing the `coredns` addon.
289290
*/
290291
corednsAddonOptions?: inputs.CoreDnsAddonOptionsArgs;
292+
/**
293+
* Whether to create the instance role for the EKS cluster. Defaults to true when using the default node group, false otherwise.
294+
* If set to false when using the default node group, an instance role or instance profile must be provided.n
295+
* Note: this option has no effect if a custom instance role is provided with `instanceRole` or `instanceRoles`.
296+
*/
297+
createInstanceRole?: boolean;
291298
/**
292299
* Indicates whether an IAM OIDC Provider is created for the EKS cluster.
293300
*

‎sdk/python/pulumi_eks/cluster.py

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ def __init__(__self__, *,
3131
cluster_security_group_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
3232
cluster_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
3333
coredns_addon_options: Optional['CoreDnsAddonOptionsArgs'] = None,
34+
create_instance_role: Optional[bool] = None,
3435
create_oidc_provider: Optional[pulumi.Input[bool]] = None,
3536
creation_role_provider: Optional['CreationRoleProviderArgs'] = None,
3637
default_addons_to_remove: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
@@ -94,6 +95,9 @@ def __init__(__self__, *,
9495
:param pulumi.Input[Mapping[str, pulumi.Input[str]]] cluster_security_group_tags: The tags to apply to the cluster security group.
9596
:param pulumi.Input[Mapping[str, pulumi.Input[str]]] cluster_tags: The tags to apply to the EKS cluster.
9697
:param 'CoreDnsAddonOptionsArgs' coredns_addon_options: Options for managing the `coredns` addon.
98+
:param bool create_instance_role: Whether to create the instance role for the EKS cluster. Defaults to true when using the default node group, false otherwise.
99+
If set to false when using the default node group, an instance role or instance profile must be provided.n
100+
Note: this option has no effect if a custom instance role is provided with `instanceRole` or `instanceRoles`.
97101
:param pulumi.Input[bool] create_oidc_provider: Indicates whether an IAM OIDC Provider is created for the EKS cluster.
98102
99103
The OIDC provider is used in the cluster in combination with k8s Service Account annotations to provide IAM roles at the k8s Pod level.
@@ -272,6 +276,8 @@ def __init__(__self__, *,
272276
pulumi.set(__self__, "cluster_tags", cluster_tags)
273277
if coredns_addon_options is not None:
274278
pulumi.set(__self__, "coredns_addon_options", coredns_addon_options)
279+
if create_instance_role is not None:
280+
pulumi.set(__self__, "create_instance_role", create_instance_role)
275281
if create_oidc_provider is not None:
276282
pulumi.set(__self__, "create_oidc_provider", create_oidc_provider)
277283
if creation_role_provider is not None:
@@ -447,6 +453,20 @@ def coredns_addon_options(self) -> Optional['CoreDnsAddonOptionsArgs']:
447453
def coredns_addon_options(self, value: Optional['CoreDnsAddonOptionsArgs']):
448454
pulumi.set(self, "coredns_addon_options", value)
449455

456+
@property
457+
@pulumi.getter(name="createInstanceRole")
458+
def create_instance_role(self) -> Optional[bool]:
459+
"""
460+
Whether to create the instance role for the EKS cluster. Defaults to true when using the default node group, false otherwise.
461+
If set to false when using the default node group, an instance role or instance profile must be provided.n
462+
Note: this option has no effect if a custom instance role is provided with `instanceRole` or `instanceRoles`.
463+
"""
464+
return pulumi.get(self, "create_instance_role")
465+
466+
@create_instance_role.setter
467+
def create_instance_role(self, value: Optional[bool]):
468+
pulumi.set(self, "create_instance_role", value)
469+
450470
@property
451471
@pulumi.getter(name="createOidcProvider")
452472
def create_oidc_provider(self) -> Optional[pulumi.Input[bool]]:
@@ -1141,6 +1161,7 @@ def __init__(__self__,
11411161
cluster_security_group_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
11421162
cluster_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
11431163
coredns_addon_options: Optional[Union['CoreDnsAddonOptionsArgs', 'CoreDnsAddonOptionsArgsDict']] = None,
1164+
create_instance_role: Optional[bool] = None,
11441165
create_oidc_provider: Optional[pulumi.Input[bool]] = None,
11451166
creation_role_provider: Optional[Union['CreationRoleProviderArgs', 'CreationRoleProviderArgsDict']] = None,
11461167
default_addons_to_remove: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
@@ -1226,6 +1247,9 @@ def __init__(__self__,
12261247
:param pulumi.Input[Mapping[str, pulumi.Input[str]]] cluster_security_group_tags: The tags to apply to the cluster security group.
12271248
:param pulumi.Input[Mapping[str, pulumi.Input[str]]] cluster_tags: The tags to apply to the EKS cluster.
12281249
:param Union['CoreDnsAddonOptionsArgs', 'CoreDnsAddonOptionsArgsDict'] coredns_addon_options: Options for managing the `coredns` addon.
1250+
:param bool create_instance_role: Whether to create the instance role for the EKS cluster. Defaults to true when using the default node group, false otherwise.
1251+
If set to false when using the default node group, an instance role or instance profile must be provided.n
1252+
Note: this option has no effect if a custom instance role is provided with `instanceRole` or `instanceRoles`.
12291253
:param pulumi.Input[bool] create_oidc_provider: Indicates whether an IAM OIDC Provider is created for the EKS cluster.
12301254
12311255
The OIDC provider is used in the cluster in combination with k8s Service Account annotations to provide IAM roles at the k8s Pod level.
@@ -1440,6 +1464,7 @@ def _internal_init(__self__,
14401464
cluster_security_group_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
14411465
cluster_tags: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
14421466
coredns_addon_options: Optional[Union['CoreDnsAddonOptionsArgs', 'CoreDnsAddonOptionsArgsDict']] = None,
1467+
create_instance_role: Optional[bool] = None,
14431468
create_oidc_provider: Optional[pulumi.Input[bool]] = None,
14441469
creation_role_provider: Optional[Union['CreationRoleProviderArgs', 'CreationRoleProviderArgsDict']] = None,
14451470
default_addons_to_remove: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
@@ -1504,6 +1529,7 @@ def _internal_init(__self__,
15041529
__props__.__dict__["cluster_security_group_tags"] = cluster_security_group_tags
15051530
__props__.__dict__["cluster_tags"] = cluster_tags
15061531
__props__.__dict__["coredns_addon_options"] = coredns_addon_options
1532+
__props__.__dict__["create_instance_role"] = create_instance_role
15071533
__props__.__dict__["create_oidc_provider"] = create_oidc_provider
15081534
__props__.__dict__["creation_role_provider"] = creation_role_provider
15091535
__props__.__dict__["default_addons_to_remove"] = default_addons_to_remove

‎tests/nodejs_test.go

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1221,6 +1221,28 @@ func TestAccScalarTypes(t *testing.T) {
12211221
programTestWithExtraOptions(t, &test, nil)
12221222
}
12231223

1224+
func TestAccDefaultInstanceRole(t *testing.T) {
1225+
if testing.Short() {
1226+
t.Skip("skipping test in short mode.")
1227+
}
1228+
test := getJSBaseOptions(t).
1229+
With(integration.ProgramTestOptions{
1230+
Dir: path.Join(getTestPrograms(t), "default-instance-role"),
1231+
ExtraRuntimeValidation: func(t *testing.T, info integration.RuntimeValidationStackInfo) {
1232+
utils.RunEKSSmokeTest(t,
1233+
info.Deployment.Resources,
1234+
info.Outputs["kubeconfig"],
1235+
)
1236+
1237+
require.NotNil(t, info.Outputs["instanceRoles"])
1238+
instanceRoles := info.Outputs["instanceRoles"].([]interface{})
1239+
assert.Len(t, instanceRoles, 1, "expected the default instance role to be created")
1240+
},
1241+
})
1242+
1243+
programTestWithExtraOptions(t, &test, nil)
1244+
}
1245+
12241246
func getOidcProviderUrl(t *testing.T, eksCluster map[string]interface{}) string {
12251247
require.NotEmpty(t, eksCluster["identities"])
12261248
identities := eksCluster["identities"].([]interface{})

‎tests/testdata/programs/default-instance-role/Pulumi.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
name: default-instance-role
2+
description: EKS cluster without default node group but with instance role
3+
runtime: nodejs

‎tests/testdata/programs/default-instance-role/index.ts

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
2+
import * as pulumi from "@pulumi/pulumi";
3+
import * as aws from "@pulumi/aws";
4+
import * as awsx from "@pulumi/awsx";
5+
import * as eks from "@pulumi/eks";
6+
7+
// Create a new VPC
8+
const eksVpc = new awsx.ec2.Vpc("default-instance-role", {
9+
enableDnsHostnames: true,
10+
cidrBlock: "10.0.0.0/16",
11+
subnetSpecs: [
12+
{ type: "Public" }
13+
],
14+
natGateways: {
15+
strategy: "None",
16+
}
17+
});
18+
19+
const cluster = new eks.Cluster("default-instance-role", {
20+
vpcId: eksVpc.vpcId,
21+
authenticationMode: eks.AuthenticationMode.Api,
22+
publicSubnetIds: eksVpc.publicSubnetIds,
23+
skipDefaultNodeGroup: true,
24+
createInstanceRole: true,
25+
});
26+
27+
export const instanceRoles = cluster.instanceRoles.apply(roles => roles.map(role => role.name));
28+
export const kubeconfig = cluster.kubeconfig;
29+
30+
const mng = eks.createManagedNodeGroup("default-instance-role-mng", {
31+
scalingConfig: {
32+
minSize: 1,
33+
maxSize: 1,
34+
desiredSize: 1,
35+
},
36+
cluster: cluster,
37+
operatingSystem: eks.OperatingSystem.AL2023,
38+
instanceTypes: ["t3.medium"],
39+
nodeRole: cluster.instanceRoles.apply(roles => roles[0]),
40+
});

‎tests/testdata/programs/default-instance-role/package.json

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
{
2+
"name": "default-instance-role",
3+
"devDependencies": {
4+
"@types/node": "latest",
5+
"typescript": "^4.0.0"
6+
},
7+
"dependencies": {
8+
"@pulumi/awsx": "^2.0.0",
9+
"@pulumi/aws": "^6.50.1",
10+
"@pulumi/eks": "latest",
11+
"@pulumi/pulumi": "^3.0.0"
12+
}
13+
}

‎tests/testdata/programs/default-instance-role/tsconfig.json

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
{
2+
"compilerOptions": {
3+
"outDir": "bin",
4+
"target": "es6",
5+
"lib": [
6+
"es6"
7+
],
8+
"module": "commonjs",
9+
"moduleResolution": "node",
10+
"declaration": true,
11+
"sourceMap": true,
12+
"stripInternal": true,
13+
"experimentalDecorators": true,
14+
"pretty": true,
15+
"noFallthroughCasesInSwitch": true,
16+
"noImplicitAny": true,
17+
"noImplicitReturns": true,
18+
"forceConsistentCasingInFileNames": true,
19+
"strictNullChecks": true
20+
},
21+
"files": [
22+
"index.ts"
23+
]
24+
}

0 commit comments

Comments
 (0)