chore(eks): Integ Test for OIDCP Certificate Retrieval

.github/workflows/yarn-upgrade.yml

@@ -38,8 +38,6 @@ jobs:
       - name: Install Tools
         run: |-
           npm -g install lerna npm-check-updates@^9.0.0
-      - name: Build CLI
-        run: cd packages/aws-cdk && ../../scripts/buildup
       - name: Build Integ Runner
         run: cd packages/@aws-cdk/integ-runner && ../../../scripts/buildup
       - name: List Mono-Repo Packages
@@ -69,6 +67,8 @@ jobs:
           for pj in $(find packages/aws-cdk/lib/init-templates -name package.json); do
             (cd $(dirname $pj) && ncu --upgrade --reject='@types/jest,@types/node,@types/prettier,@types/fs-extra,constructs,typescript,aws-sdk,aws-sdk-mock,ts-jest,jest,${{ steps.list-packages.outputs.list }}')
           done
+          # Upgrade dependencies at an aws-eks integ test docker image
+          cd packages/@aws-cdk/aws-eks/test/sdk-call-integ-test-docker-app/app/ && ncu --upgrade --reject='@types/jest,@types/node,@types/prettier,@types/fs-extra,constructs,typescript,aws-sdk,aws-sdk-mock,ts-jest,jest,${{ steps.list-packages.outputs.list }}'
 
       # This will ensure the current lockfile is up-to-date with the dependency specifications (necessary for "yarn update" to run)
       - name: Run "yarn install"

packages/@aws-cdk/aws-eks/package.json

@@ -102,6 +102,7 @@
   "dependencies": {
     "@aws-cdk/aws-autoscaling": "0.0.0",
     "@aws-cdk/aws-ec2": "0.0.0",
+    "@aws-cdk/aws-ecr-assets": "0.0.0",
     "@aws-cdk/aws-s3-assets": "0.0.0",
     "@aws-cdk/aws-iam": "0.0.0",
     "@aws-cdk/aws-kms": "0.0.0",
@@ -134,7 +135,8 @@
     "@aws-cdk/lambda-layer-awscli": "0.0.0",
     "@aws-cdk/lambda-layer-kubectl": "0.0.0",
     "@aws-cdk/lambda-layer-node-proxy-agent": "0.0.0",
-    "constructs": "^10.0.0"
+    "constructs": "^10.0.0",
+    "@aws-cdk/aws-ecr-assets": "0.0.0"
   },
   "engines": {
     "node": ">= 14.15.0"

packages/@aws-cdk/aws-eks/test/bucket-pinger/bucket-pinger.ts

@@ -0,0 +1,51 @@
+import * as ec2 from '@aws-cdk/aws-ec2';
+import * as iam from '@aws-cdk/aws-iam';
+import * as lambda from '@aws-cdk/aws-lambda';
+import { CustomResource, Token, Duration } from '@aws-cdk/core';
+import * as cr from '@aws-cdk/custom-resources';
+import { Construct } from 'constructs';
+
+export interface PingerProps {
+  readonly securityGroup?: ec2.SecurityGroup;
+  readonly vpc?: ec2.IVpc;
+  readonly subnets?: ec2.ISubnet[];
+}
+export class BucketPinger extends Construct {
+
+  private _resource: CustomResource;
+
+  constructor(scope: Construct, id: string, props: PingerProps) {
+    super(scope, id);
+
+    const func = new lambda.Function(this, 'Function', {
+      code: lambda.Code.fromAsset(`${__dirname}/function`),
+      handler: 'index.handler',
+      runtime: lambda.Runtime.PYTHON_3_9,
+      vpc: props.vpc,
+      vpcSubnets: props.subnets ? { subnets: props.subnets } : undefined,
+      securityGroups: props.securityGroup ? [props.securityGroup] : undefined,
+      timeout: Duration.minutes(1),
+    });
+
+    if (!func.role) {
+      throw new Error('pinger lambda has no execution role!');
+    }
+
+    func.role.addToPrincipalPolicy(new iam.PolicyStatement({
+      actions: ['s3:DeleteBucket', 's3:ListBucket'],
+      resources: ['arn:aws:s3:::*'],
+    }));
+
+    const provider = new cr.Provider(this, 'Provider', {
+      onEventHandler: func,
+    });
+
+    this._resource = new CustomResource(this, 'Resource', {
+      serviceToken: provider.serviceToken,
+    });
+  }
+
+  public get response() {
+    return Token.asString(this._resource.getAtt('Value'));
+  }
+}

packages/@aws-cdk/aws-eks/test/bucket-pinger/function/index.py

@@ -0,0 +1,34 @@
+import json
+import logging
+import boto3
+
+logger = logging.getLogger()
+logger.setLevel(logging.INFO)
+
+def handler(event, context):
+  print(json.dumps(event))
+
+  request_type = event['RequestType']
+  props = event['ResourceProperties']
+
+  s3_bucket_name = 'amazingly-made-sdk-call-created-eks-bucket'
+  s3 = boto3.client('s3')
+
+  if request_type in ['Create', 'Update']:
+    logger.info(f'making sdk call to check if bucket with name {s3_bucket_name} exists')
+
+    try:
+      s3.head_bucket(Bucket=s3_bucket_name)
+    except Exception as error:
+      raise RuntimeError(f'failed to head bucket with error: {str(error)}')
+    return {'Data': {'Value': f'confirmed that bucket with name {s3_bucket_name} exists' }}
+
+  elif request_type == 'Delete':
+    logger.info(f'making sdk call to delete bucket with name {s3_bucket_name}')
+
+    try:
+      s3.delete_bucket(Bucket=s3_bucket_name)
+    except Exception as error:
+      # If the bucket does not exist, then this error will be thrown
+      raise RuntimeError(f'failed to delete bucket: {str(error)}')
+    return {'Data': {'Value': f'bucket with name {s3_bucket_name} has been deleted' }}

packages/@aws-cdk/aws-eks/test/eks-service-account-sdk-call.integ.snapshot/asset.42973d1d89f4a393a64981f78d088964ba13e63a3aab4478cd74109c77cf9174/diff.d.ts

@@ -0,0 +1,4 @@
+export declare function arrayDiff(oldValues: string[], newValues: string[]): {
+    adds: string[];
+    deletes: string[];
+};

packages/@aws-cdk/aws-eks/test/eks-service-account-sdk-call.integ.snapshot/asset.42973d1d89f4a393a64981f78d088964ba13e63a3aab4478cd74109c77cf9174/diff.ts

@@ -0,0 +1,17 @@
+export function arrayDiff(oldValues: string[], newValues: string[]) {
+  const deletes = new Set(oldValues);
+  const adds = new Set<string>();
+
+  for (const v of new Set(newValues)) {
+    if (deletes.has(v)) {
+      deletes.delete(v);
+    } else {
+      adds.add(v);
+    }
+  }
+
+  return {
+    adds: Array.from(adds),
+    deletes: Array.from(deletes),
+  };
+}

packages/@aws-cdk/aws-eks/test/eks-service-account-sdk-call.integ.snapshot/asset.42973d1d89f4a393a64981f78d088964ba13e63a3aab4478cd74109c77cf9174/external.d.ts

@@ -0,0 +1,24 @@
+import * as aws from 'aws-sdk';
+declare function defaultLogger(fmt: string, ...args: any[]): void;
+/**
+ * Downloads the CA thumbprint from the issuer URL
+ */
+declare function downloadThumbprint(issuerUrl: string): Promise<string>;
+export declare const external: {
+    downloadThumbprint: typeof downloadThumbprint;
+    log: typeof defaultLogger;
+    createOpenIDConnectProvider: (req: aws.IAM.CreateOpenIDConnectProviderRequest) => Promise<import("aws-sdk/lib/request").PromiseResult<aws.IAM.CreateOpenIDConnectProviderResponse, aws.AWSError>>;
+    deleteOpenIDConnectProvider: (req: aws.IAM.DeleteOpenIDConnectProviderRequest) => Promise<{
+        $response: aws.Response<{}, aws.AWSError>;
+    }>;
+    updateOpenIDConnectProviderThumbprint: (req: aws.IAM.UpdateOpenIDConnectProviderThumbprintRequest) => Promise<{
+        $response: aws.Response<{}, aws.AWSError>;
+    }>;
+    addClientIDToOpenIDConnectProvider: (req: aws.IAM.AddClientIDToOpenIDConnectProviderRequest) => Promise<{
+        $response: aws.Response<{}, aws.AWSError>;
+    }>;
+    removeClientIDFromOpenIDConnectProvider: (req: aws.IAM.RemoveClientIDFromOpenIDConnectProviderRequest) => Promise<{
+        $response: aws.Response<{}, aws.AWSError>;
+    }>;
+};
+export {};

packages/@aws-cdk/aws-eks/test/eks-service-account-sdk-call.integ.snapshot/asset.42973d1d89f4a393a64981f78d088964ba13e63a3aab4478cd74109c77cf9174/external.ts

@@ -0,0 +1,53 @@
+/* istanbul ignore file */
+
+import * as tls from 'tls';
+import * as url from 'url';
+// eslint-disable-next-line import/no-extraneous-dependencies
+import * as aws from 'aws-sdk';
+
+let client: aws.IAM;
+
+function iam() {
+  if (!client) { client = new aws.IAM(); }
+  return client;
+}
+
+function defaultLogger(fmt: string, ...args: any[]) {
+  // eslint-disable-next-line no-console
+  console.log(fmt, ...args);
+}
+
+/**
+ * Downloads the CA thumbprint from the issuer URL
+ */
+async function downloadThumbprint(issuerUrl: string) {
+  external.log(`downloading certificate authority thumbprint for ${issuerUrl}`);
+  return new Promise<string>((ok, ko) => {
+    const purl = url.parse(issuerUrl);
+    const port = purl.port ? parseInt(purl.port, 10) : 443;
+    if (!purl.host) {
+      return ko(new Error(`unable to determine host from issuer url ${issuerUrl}`));
+    }
+    const socket = tls.connect(port, purl.host, { rejectUnauthorized: false, servername: purl.host });
+    socket.once('error', ko);
+    socket.once('secureConnect', () => {
+      const cert = socket.getPeerCertificate();
+      socket.end();
+      const thumbprint = cert.fingerprint.split(':').join('');
+      external.log(`certificate authority thumbprint for ${issuerUrl} is ${thumbprint}`);
+      ok(thumbprint);
+    });
+  });
+}
+
+// allows unit test to replace with mocks
+/* eslint-disable max-len */
+export const external = {
+  downloadThumbprint,
+  log: defaultLogger,
+  createOpenIDConnectProvider: (req: aws.IAM.CreateOpenIDConnectProviderRequest) => iam().createOpenIDConnectProvider(req).promise(),
+  deleteOpenIDConnectProvider: (req: aws.IAM.DeleteOpenIDConnectProviderRequest) => iam().deleteOpenIDConnectProvider(req).promise(),
+  updateOpenIDConnectProviderThumbprint: (req: aws.IAM.UpdateOpenIDConnectProviderThumbprintRequest) => iam().updateOpenIDConnectProviderThumbprint(req).promise(),
+  addClientIDToOpenIDConnectProvider: (req: aws.IAM.AddClientIDToOpenIDConnectProviderRequest) => iam().addClientIDToOpenIDConnectProvider(req).promise(),
+  removeClientIDFromOpenIDConnectProvider: (req: aws.IAM.RemoveClientIDFromOpenIDConnectProviderRequest) => iam().removeClientIDFromOpenIDConnectProvider(req).promise(),
+};

packages/@aws-cdk/aws-eks/test/eks-service-account-sdk-call.integ.snapshot/asset.42973d1d89f4a393a64981f78d088964ba13e63a3aab4478cd74109c77cf9174/index.d.ts

@@ -0,0 +1,3 @@
+export declare function handler(event: AWSLambda.CloudFormationCustomResourceEvent): Promise<void | {
+    PhysicalResourceId: string | undefined;
+}>;