fix(aws-eks): fail to update both logging and access at the same time #22957

pahud · 2022-11-17T16:05:51Z

This PR addresses the following known issues:

When updating the cluster endpoint access type only with logging predefined yet unchanged, the cluster-resource-handler updates both the logging and access, which is not allowed and throws the SDK error. This PR fixed this and will update access type only, which is allowed.
When updating the cluster endpoint public cidr with exactly the same size of cidr, the setsEqual function should return correctly.
When updating the cluster endpoint public access from one cidr to multiple cidr with logging predefined yet unchanged, the update should return correctly.
Updating both access and logging now throws an error from CDK custom resource.

This PR is just a temporary fix that does not implement multiple operations in the cluster-resource-handler custom resource provider(i.e. update both logging and access).

Fixes: #21439

All Submissions:

Have you followed the guidelines in our Contributing guide?

Adding new Unconventional Dependencies:

This PR adds new unconventional dependencies following the process described here

New Features

Have you added the new feature to an integration test?
- Did you use yarn integ to deploy the infrastructure and generate the snapshot (i.e. yarn integ without --dry-run)?

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

gitpod-io · 2022-11-17T16:12:26Z

aws-cdk-automation

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

gazal-k · 2022-11-19T23:48:00Z

packages/@aws-cdk/aws-eks/lib/cluster-resource-handler/cluster.ts

@@ -136,23 +136,32 @@ export class ClusterResourceHandler extends ResourceHandler {
      return this.updateClusterVersion(this.newProps.version);
    }

-    if (updates.updateLogging || updates.updateAccess) {
+    if (updates.updateLogging && updates.updateAccess) {


the EKS API does not allow both to be updated at the same time, but if we make 2 separate API calls, do we need to set this restriction on the custom resource?

I am not sure if this is a good idea to have a custom resource making multiple API calls. Would love to hear comments from @iliapolo or any maintainers before we move this PR further.

We have precedents for this already in other custom resources. Some examples involving multiple write calls:

In S3, for automatic deletion of objects, we call deleteObjects multiple times.

In IAM, for the OIDC provider, we call many IAM methods, such as updateOpenIDConnectProviderThumbprint, addClientIDToOpenIDConnectProvider and removeClientIDFromOpenIDConnectProvider.

In Logs, for log retention, we call createLogGroup, deleteRetentionPolicy and putRetentionPolicy.

And, if we also consider read calls, pretty much every custom resource makes a combination of read and write calls.

Given that, I agree we should make multiple API calls in this custom resource but I probably don't have capacity for that in the next few weeks. I will make this PR as is for immediate fix and leave the multiple API calls implementation for another PR if anyone is interested to move it forward.

pahud · 2022-12-14T00:24:00Z

Hi @otaviomacedo

This PR is ready for the first review. I didn't add or modify any integ test but I did add a few additional unit tests to address all known issues. Thanks.

✅ Updated pull request passes all PRLinter validations. Dissmissing previous PRLinter review.

mergify · 2022-12-19T23:34:17Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

aws-cdk-automation · 2022-12-20T00:46:13Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: 452d01b
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2022-12-20T00:46:59Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

…aws#22957) This PR addresses the following known issues: 1. When updating the cluster endpoint access type only with logging predefined yet unchanged, the cluster-resource-handler updates both the logging and access, which is not allowed and throws the SDK error. This PR fixed this and will update access type only, which is allowed. 2. When updating the cluster endpoint public cidr with exactly the same size of cidr, the `setsEqual` function should return correctly. 3. When updating the cluster endpoint public access from one cidr to multiple cidr with logging predefined yet unchanged, the update should return correctly. 4. Updating both access and logging now throws an error from CDK custom resource. This PR is just a temporary fix that does not implement multiple operations in the cluster-resource-handler custom resource provider(i.e. update both logging and access). Fixes: aws#21439 ---- ### All Submissions: * [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) ### Adding new Unconventional Dependencies: * [ ] This PR adds new unconventional dependencies following the process described [here](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md/#adding-new-unconventional-dependencies) ### New Features * [ ] Have you added the new feature to an [integration test](https://github.com/aws/aws-cdk/blob/main/INTEGRATION_TESTS.md)? * [ ] Did you use `yarn integ` to deploy the infrastructure and generate the snapshot (i.e. `yarn integ` without `--dry-run`)? *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

fix: avoid updating both logging and access

00f4f1f

pahud mentioned this pull request Nov 17, 2022

aws-eks: Cannot update cluster endpoint access #21439

Closed

remove comments

633cf29

mergify bot added the contribution/core This is a PR that came from AWS. label Nov 17, 2022

aws-cdk-automation previously requested changes Nov 17, 2022

View reviewed changes

github-actions bot added the p2 label Nov 17, 2022

gazal-k reviewed Nov 19, 2022

View reviewed changes

otaviomacedo self-assigned this Dec 7, 2022

pahud added 2 commits December 8, 2022 15:59

Merge branch 'main' into pahud/aws-eks-cannot-update-cluster-21439

6cdbf52

update test

db021a8

pahud marked this pull request as ready for review December 9, 2022 14:39

pahud added 3 commits December 13, 2022 23:02

add tests

e3adc4b

Merge branch 'main' into pahud/aws-eks-cannot-update-cluster-21439

c1b5ea9

minor update

6f18a71

pahud requested a review from otaviomacedo December 14, 2022 00:22

otaviomacedo approved these changes Dec 16, 2022

View reviewed changes

otaviomacedo added the pr-linter/exempt-integ-test The PR linter will not require integ test changes label Dec 19, 2022

Merge branch 'main' into pahud/aws-eks-cannot-update-cluster-21439

452d01b

mergify bot merged commit 606837d into aws:main Dec 20, 2022

pahud mentioned this pull request Jan 26, 2023

(aws_eks): (EKS cluster_logging property makes cluster unmanageable) #20779

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(aws-eks): fail to update both logging and access at the same time #22957

fix(aws-eks): fail to update both logging and access at the same time #22957

pahud commented Nov 17, 2022 •

edited

gitpod-io bot commented Nov 17, 2022

aws-cdk-automation left a comment

gazal-k Nov 19, 2022

pahud Nov 23, 2022

otaviomacedo Dec 8, 2022

pahud Dec 8, 2022 •

edited

pahud commented Dec 14, 2022 •

edited

mergify bot commented Dec 19, 2022

aws-cdk-automation commented Dec 20, 2022

mergify bot commented Dec 20, 2022

fix(aws-eks): fail to update both logging and access at the same time #22957

fix(aws-eks): fail to update both logging and access at the same time #22957

Conversation

pahud commented Nov 17, 2022 • edited

All Submissions:

Adding new Unconventional Dependencies:

New Features

gitpod-io bot commented Nov 17, 2022

aws-cdk-automation left a comment

Choose a reason for hiding this comment

gazal-k Nov 19, 2022

Choose a reason for hiding this comment

pahud Nov 23, 2022

Choose a reason for hiding this comment

otaviomacedo Dec 8, 2022

Choose a reason for hiding this comment

pahud Dec 8, 2022 • edited

Choose a reason for hiding this comment

pahud commented Dec 14, 2022 • edited

mergify bot commented Dec 19, 2022

aws-cdk-automation commented Dec 20, 2022

AWS CodeBuild CI Report

mergify bot commented Dec 20, 2022

pahud commented Nov 17, 2022 •

edited

pahud Dec 8, 2022 •

edited

pahud commented Dec 14, 2022 •

edited