cluster-api-provider-aws
cluster-api-provider-aws copied to clipboard
kubernetes-sigs
Allow Storing Join Token in SSM Parameter Store Instead of User Data
/kind feature
Describe the solution you'd like As a CAPA user, I'd like to be able to only have new revisions of launch templates when configuration materially changes, making it very clear what's going on if I need to compare configuration. Additionally, I would like to be able to use fully custom launch templates managed outside the CAPI/CAPA ecosystem, as a means to more easily enable Karpenter on workload clusters. To that end, I propose moving the join token for worker nodes to SSM Parameter Store (or some suitable alternative which workers can access at startup) as an opt-in feature.
Anything else you would like to add: Fully open to admitting that this is partially a selfish request because it fixes a tooling problem that I have. We've written in-house tooling which gracefully drains nodes so they can be replaced based on a number of conditions, including not running a launch template which matches the current one for their ASG. Because the launch template changes every few minutes in the default configuration, we were seeing replacement of nodes near-constantly. Working around this involved increasing the max age of the token to a considerably longer timeframe to provide stability, at the cost of the security of frequently rotating the token.
Secondarily, with the way that Karpenter works, we have no mechanism to cleanly get the join token into its configuration except to have an external controller read the token and push it down to somewhere that Karpenter can read, whether that's directly modifying the user data on the NodeClass with the updated token or pushing the token to an external location on an interval and just changing the user data to read that. While we could technically put a custom controller in place on our management cluster and have it pushing to SSM on our behalf, it'd be very nice to just have the plumbing directly integrated in CAPA, and would provide an easier adoption path for other users.
Environment:
- Cluster-api-provider-aws version: 2.3.0
- Kubernetes version: (use
kubectl version): 1.27.10 - OS (e.g. from
/etc/os-release): Ubuntu 22.04.4
This issue is currently awaiting triage.
If CAPA/CAPI contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.
The triage/accepted label can be added by org members by writing /triage accepted in a comment.
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.
The Kubernetes project currently lacks enough contributors to adequately respond to all issues.
This bot triages un-triaged issues according to the following rules:
- After 90d of inactivity,
lifecycle/staleis applied - After 30d of inactivity since
lifecycle/stalewas applied,lifecycle/rottenis applied - After 30d of inactivity since
lifecycle/rottenwas applied, the issue is closed
You can:
- Mark this issue as fresh with
/remove-lifecycle stale - Close this issue with
/close - Offer to help out with Issue Triage
Please send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale
The Kubernetes project currently lacks enough contributors to adequately respond to all issues.
This bot triages un-triaged issues according to the following rules:
- After 90d of inactivity,
lifecycle/staleis applied - After 30d of inactivity since
lifecycle/stalewas applied,lifecycle/rottenis applied - After 30d of inactivity since
lifecycle/rottenwas applied, the issue is closed
You can:
- Mark this issue as fresh with
/remove-lifecycle stale - Close this issue with
/close - Offer to help out with Issue Triage
Please send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle stale
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.
This bot triages un-triaged issues according to the following rules:
- After 90d of inactivity,
lifecycle/staleis applied - After 30d of inactivity since
lifecycle/stalewas applied,lifecycle/rottenis applied - After 30d of inactivity since
lifecycle/rottenwas applied, the issue is closed
You can:
- Mark this issue as fresh with
/remove-lifecycle rotten - Close this issue with
/close - Offer to help out with Issue Triage
Please send feedback to sig-contributor-experience at kubernetes/community.
/lifecycle rotten
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.
This bot triages issues according to the following rules:
- After 90d of inactivity,
lifecycle/staleis applied - After 30d of inactivity since
lifecycle/stalewas applied,lifecycle/rottenis applied - After 30d of inactivity since
lifecycle/rottenwas applied, the issue is closed
You can:
- Reopen this issue with
/reopen - Mark this issue as fresh with
/remove-lifecycle rotten - Offer to help out with Issue Triage
Please send feedback to sig-contributor-experience at kubernetes/community.
/close not-planned
@k8s-triage-robot: Closing this issue, marking it as "Not Planned".
In response to this:
The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.
This bot triages issues according to the following rules:
- After 90d of inactivity,
lifecycle/staleis applied- After 30d of inactivity since
lifecycle/stalewas applied,lifecycle/rottenis applied- After 30d of inactivity since
lifecycle/rottenwas applied, the issue is closedYou can:
- Reopen this issue with
/reopen- Mark this issue as fresh with
/remove-lifecycle rotten- Offer to help out with Issue Triage
Please send feedback to sig-contributor-experience at kubernetes/community.
/close not-planned
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.