pulumi-eks
pulumi-eks copied to clipboard
pulumi
Defaulted aws-auth ConfigMap creation to upsert, added optional ConfigMap update in place property to cluster
Proposed changes
This PR does two things:
Defaults aws-auth ConfigMap management to an upsert operation. This ensures pulumi takes full control of the ConfigMap regardless of whether it exists already or not eliminating any possible race conditions that could occur and error popping up stating the aws-auth ConfigMap already exists.
Adds an optional enableConfigMapMutable property to pass to the cluster's pulumi k8s provider that will allow for updating the aws-auth ConfigMap in place over the default replace operation. A replace operation for this particular ConfigMap can be especially dangerous if some failure blocks recreation after a delete as default M2M auth entries would get wiped as we have seen already intermittently in cluster provisioning workflows: error: resource kube-system/aws-auth was not successfully created by the Kubernetes API server : configmaps "aws-auth" already exists
The enableConfigMapMutable property is optional because docs denote it is still in preview and if consumers of this library re-use the exposed cluster k8s provider downstream it could have unintended effects on their k8s deployment workflows. AWS documentation like https://docs.aws.amazon.com/eks/latest/userguide/add-user-role.html always advises updating/applying/patching this ConfigMap in place.
Related issues (optional)
https://github.com/pulumi/pulumi-eks/issues/918 https://github.com/pulumi/pulumi-eks/issues/883
PR is now waiting for a maintainer to run the acceptance tests. This PR will only perform build and linting. Note for the maintainer: To run the acceptance tests, please comment /run-acceptance-tests on the PR
![github-actions[bot] avatar](https://avatars.githubusercontent.com/in/15368?v=4 "Published by a pub.dev verified publisher"){kind=small}
PR is now waiting for a maintainer to run the acceptance tests. This PR will only perform build and linting. Note for the maintainer: To run the acceptance tests, please comment /run-acceptance-tests on the PR
Thanks for the PR @JaseKirby. It looks like this is the correct direction to solve the linked issues. It looks like only the nodejs SDK was updated though, so we'll need to replicate this in the other supported languages as well.
PR is now waiting for a maintainer to run the acceptance tests. This PR will only perform build and linting. Note for the maintainer: To run the acceptance tests, please comment /run-acceptance-tests on the PR
Please view the PR build - https://github.com/pulumi/pulumi-eks/actions/runs/8445018952
Thanks for the initial submission. I've updated the PR to also expose the new argument to the other supported SDK languages.