Skip to content

Commit 6d80c68

Browse files
mumoshumumoshu
committed
Fix bug that eksctl and kubectl was not using creds from assume role
1 parent 568ffd5 commit 6d80c68

18 files changed

+241
-71
lines changed

‎pkg/awsclicompat/assume_role.go‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ type AssumeRoleConfig struct {
2121
TransitiveTagKeys []string
2222
}
2323

24-
func AssumeRole(sess *session.Session, config AssumeRoleConfig) (*session.Session, error) {
24+
func AssumeRole(sess *session.Session, config AssumeRoleConfig) (*session.Session, *sts.Credentials, error) {
2525
var awsDurationSeconds *int64
2626

2727
if config.DurationSeconds != 0 {
@@ -70,15 +70,21 @@ func AssumeRole(sess *session.Session, config AssumeRoleConfig) (*session.Sessio
7070

7171
assumedRole, err := stsSvc.AssumeRole(input)
7272
if err != nil {
73-
return nil, xerrors.Errorf("failed assuming role: %w", err)
73+
return nil, nil, xerrors.Errorf("failed assuming role: %w", err)
7474
}
7575

76-
return session.NewSession(&aws.Config{
76+
newSess, err := session.NewSession(&aws.Config{
7777
Credentials: credentials.NewStaticCredentials(
7878
*assumedRole.Credentials.AccessKeyId,
7979
*assumedRole.Credentials.SecretAccessKey,
8080
*assumedRole.Credentials.SessionToken,
8181
),
8282
Region: sess.Config.Region,
8383
})
84+
85+
if err != nil {
86+
return nil, nil, xerrors.Errorf("initializing session with assume role: %w", err)
87+
}
88+
89+
return newSess, assumedRole.Credentials, nil
8490
}

‎pkg/resource/cluster/attach.go‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,16 +6,17 @@ import (
66
"github.com/aws/aws-sdk-go/aws/awserr"
77
"github.com/aws/aws-sdk-go/service/autoscaling"
88
"github.com/aws/aws-sdk-go/service/cloudformation"
9+
"github.com/mumoshu/terraform-provider-eksctl/pkg/sdk"
910
"log"
1011
"strings"
1112
)
1213

13-
func doAttachAutoScalingGroupsToTargetGroups(set *ClusterSet) error {
14+
func doAttachAutoScalingGroupsToTargetGroups(ctx *sdk.Context, set *ClusterSet) error {
1415
if len(set.ListenerStatuses) == 0 {
1516
return nil
1617
}
1718

18-
cfn := cloudformation.New(AWSSessionFromCluster(set.Cluster))
19+
cfn := cloudformation.New(ctx.Session())
1920

2021
var stackSummaries []*cloudformation.StackSummary
2122

@@ -48,7 +49,7 @@ func doAttachAutoScalingGroupsToTargetGroups(set *ClusterSet) error {
4849

4950
log.Printf("Finding stacks whose name is prefixd with %q from %d stack summaries", stackNamePrefix, len(stackSummaries))
5051

51-
asSvc := autoscaling.New(AWSSessionFromCluster(set.Cluster))
52+
asSvc := autoscaling.New(ctx.Session())
5253

5354
for _, s := range stackSummaries {
5455

‎pkg/resource/cluster/aws_session.go‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package cluster
22

33
import (
44
"github.com/aws/aws-sdk-go/aws/session"
5+
"github.com/aws/aws-sdk-go/service/sts"
56
"github.com/mumoshu/terraform-provider-eksctl/pkg/awsclicompat"
67
)
78

@@ -12,10 +13,25 @@ func AWSSessionFromCluster(cluster *Cluster) *session.Session {
1213
return sess
1314
}
1415

15-
newSess, err := awsclicompat.AssumeRole(sess, *cluster.AssumeRoleConfig)
16+
newSess, _, err := awsclicompat.AssumeRole(sess, *cluster.AssumeRoleConfig)
1617
if err != nil {
1718
panic(err)
1819
}
1920

2021
return newSess
2122
}
23+
24+
func AWSCredsFromConfig(region, profile string, assumeRole *awsclicompat.AssumeRoleConfig) (*session.Session, *sts.Credentials) {
25+
sess := awsclicompat.NewSession(region, profile)
26+
27+
if assumeRole == nil {
28+
return sess, nil
29+
}
30+
31+
assumed, creds, err := awsclicompat.AssumeRole(sess, *assumeRole)
32+
if err != nil {
33+
panic(err)
34+
}
35+
36+
return assumed, creds
37+
}

‎pkg/resource/cluster/cluster_create.go‎

Lines changed: 21 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package cluster
33
import (
44
"bytes"
55
"fmt"
6+
"github.com/mumoshu/terraform-provider-eksctl/pkg/sdk"
67
"github.com/mumoshu/terraform-provider-eksctl/pkg/sdk/api"
78
"io/ioutil"
89
"log"
@@ -12,8 +13,7 @@ import (
1213
"time"
1314

1415
"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
15-
"github.com/mumoshu/terraform-provider-eksctl/pkg/resource"
16-
)
16+
)
1717

1818
func (m *Manager) createCluster(d *schema.ResourceData) (*ClusterSet, error) {
1919
id := newClusterID()
@@ -27,6 +27,8 @@ func (m *Manager) createCluster(d *schema.ResourceData) (*ClusterSet, error) {
2727

2828
cluster := set.Cluster
2929

30+
ctx := mustNewContext(cluster)
31+
3032
if err := createVPCResourceTags(cluster, set.ClusterName); err != nil {
3133
return nil, err
3234
}
@@ -38,27 +40,27 @@ func (m *Manager) createCluster(d *schema.ResourceData) (*ClusterSet, error) {
3840

3941
cmd.Stdin = bytes.NewReader(set.ClusterConfig)
4042

41-
if err := resource.Create(cmd, d, id); err != nil {
42-
return nil, fmt.Errorf("running `eksctl create cluster: %w: USED CLUSTER CONFIG:\n%s", err, string(set.ClusterConfig))
43+
if err := ctx.Create(cmd, d, id); err != nil {
44+
return nil, fmt.Errorf("running `eksctl create cluster`: %w: USED CLUSTER CONFIG:\n%s", err, string(set.ClusterConfig))
4345
}
4446

45-
if err := doWriteKubeconfig(d, string(set.ClusterName), cluster.Region); err != nil {
47+
if err := doWriteKubeconfig(ctx, d, string(set.ClusterName), cluster.Region); err != nil {
4648
return nil, err
4749
}
4850

49-
if err := doApplyKubernetesManifests(cluster, id); err != nil {
51+
if err := doApplyKubernetesManifests(ctx, cluster, id); err != nil {
5052
return nil, err
5153
}
5254

53-
if err := doAttachAutoScalingGroupsToTargetGroups(set); err != nil {
55+
if err := doAttachAutoScalingGroupsToTargetGroups(ctx, set); err != nil {
5456
return nil, err
5557
}
5658

57-
if err := doCheckPodsReadiness(cluster, id); err != nil {
59+
if err := doCheckPodsReadiness(ctx, cluster, id); err != nil {
5860
return nil, err
5961
}
6062

61-
if err := createIAMIdentityMapping(d, cluster); err != nil {
63+
if err := createIAMIdentityMapping(ctx, d, cluster); err != nil {
6264
return nil, err
6365
}
6466

@@ -79,7 +81,7 @@ func (m *Manager) doPlanKubeconfig(d *DiffReadWrite) error {
7981
return nil
8082
}
8183

82-
func doWriteKubeconfig(d ReadWrite, clusterName, region string) error {
84+
func doWriteKubeconfig(ctx *sdk.Context, d ReadWrite, clusterName, region string) error {
8385
var path string
8486

8587
if v := d.Get(KeyKubeconfigPath); v != nil {
@@ -106,8 +108,8 @@ func doWriteKubeconfig(d ReadWrite, clusterName, region string) error {
106108
cmd.Env = append(cmd.Env, os.Environ()...)
107109
cmd.Env = append(cmd.Env, "KUBECONFIG="+path)
108110

109-
if out, err := cmd.CombinedOutput(); err != nil {
110-
return fmt.Errorf("failed running %s %s: %vw: COMBINED OUTPUT:\n%s", cmd.Path, strings.Join(cmd.Args, " "), err, string(out))
111+
if out, err := ctx.Run(cmd); err != nil {
112+
return fmt.Errorf("failed running %s %s: %vw: COMBINED OUTPUT:\n%s", cmd.Path, strings.Join(cmd.Args, " "), err, out.Output)
111113
}
112114

113115
log.Printf("Ran `%s %s` with KUBECONFIG=%s", cmd.Path, strings.Join(cmd.Args, " "), path)
@@ -139,8 +141,8 @@ func doWriteKubeconfig(d ReadWrite, clusterName, region string) error {
139141
return nil
140142
}
141143

142-
func createIAMIdentityMapping(d ReadWrite, cluster *Cluster) error {
143-
iams, err := runGetIAMIdentityMapping(d, cluster)
144+
func createIAMIdentityMapping(ctx *sdk.Context, d ReadWrite, cluster *Cluster) error {
145+
iams, err := runGetIAMIdentityMapping(ctx, d, cluster)
144146
if err != nil {
145147
return fmt.Errorf("can not get iamidentitymapping from eks cluster: %w", err)
146148
}
@@ -155,7 +157,7 @@ func createIAMIdentityMapping(d ReadWrite, cluster *Cluster) error {
155157

156158
if d.Get(KeyIAMIdentityMapping) != nil {
157159
values := d.Get(KeyIAMIdentityMapping).(*schema.Set)
158-
if err := runCreateIAMIdentityMapping(d, values, cluster); err != nil {
160+
if err := runCreateIAMIdentityMapping(ctx, d, values, cluster); err != nil {
159161
return fmt.Errorf("creating create imaidentitymapping command: %w", err)
160162
}
161163

@@ -167,7 +169,7 @@ func createIAMIdentityMapping(d ReadWrite, cluster *Cluster) error {
167169
return nil
168170
}
169171

170-
func runCreateIAMIdentityMapping(d api.Getter, s *schema.Set, cluster *Cluster) error {
172+
func runCreateIAMIdentityMapping(ctx *sdk.Context, d api.Getter, s *schema.Set, cluster *Cluster) error {
171173
values := s.List()
172174
for _, v := range values {
173175
ele := v.(map[string]interface{})
@@ -196,7 +198,7 @@ func runCreateIAMIdentityMapping(d api.Getter, s *schema.Set, cluster *Cluster)
196198
return fmt.Errorf("creating create imaidentitymapping command: %w", err)
197199
}
198200

199-
res, err := resource.Run(cmd)
201+
res, err := ctx.Run(cmd)
200202
if err != nil {
201203
return fmt.Errorf("running create imaidentitymapping command: %w", err)
202204
}
@@ -206,7 +208,7 @@ func runCreateIAMIdentityMapping(d api.Getter, s *schema.Set, cluster *Cluster)
206208
return nil
207209
}
208210

209-
func runDeleteIAMIdentityMapping(d api.Getter, s *schema.Set, cluster *Cluster) error {
211+
func runDeleteIAMIdentityMapping(ctx *sdk.Context, d api.Getter, s *schema.Set, cluster *Cluster) error {
210212
values := s.List()
211213
for _, v := range values {
212214
ele := v.(map[string]interface{})
@@ -225,7 +227,7 @@ func runDeleteIAMIdentityMapping(d api.Getter, s *schema.Set, cluster *Cluster)
225227
return fmt.Errorf("creating create imaidentitymapping command: %w", err)
226228
}
227229

228-
res, err := resource.Run(cmd)
230+
res, err := ctx.Run(cmd)
229231
if err != nil {
230232
return fmt.Errorf("creating create-iamidentitymapping command: %w", err)
231233
}

‎pkg/resource/cluster/cluster_delete.go‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ import (
44
"bytes"
55
"fmt"
66
"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
7-
"github.com/mumoshu/terraform-provider-eksctl/pkg/resource"
87
"log"
98
)
109

@@ -25,7 +24,9 @@ func (m *Manager) deleteCluster(d *schema.ResourceData) error {
2524
"--wait",
2625
}
2726

28-
if err := doDeleteKubernetesResourcesBeforeDestroy(cluster, d.Id()); err != nil {
27+
ctx := mustNewContext(cluster)
28+
29+
if err := doDeleteKubernetesResourcesBeforeDestroy(ctx, cluster, d.Id()); err != nil {
2930
return err
3031
}
3132

@@ -36,7 +37,7 @@ func (m *Manager) deleteCluster(d *schema.ResourceData) error {
3637

3738
cmd.Stdin = bytes.NewReader(set.ClusterConfig)
3839

39-
if err := resource.Delete(cmd, d); err != nil {
40+
if err := ctx.Delete(cmd); err != nil {
4041
return err
4142
}
4243

‎pkg/resource/cluster/cluster_k8s_vesrion.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ import (
55
"encoding/json"
66
"fmt"
77
"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
8-
"github.com/mumoshu/terraform-provider-eksctl/pkg/resource"
8+
"github.com/mumoshu/terraform-provider-eksctl/pkg/sdk"
99
"log"
1010
"strconv"
1111
)
@@ -15,7 +15,7 @@ type LiveClusterInfo struct {
1515
Revision int
1616
}
1717

18-
func getLiveClusterInfo(d *schema.ResourceData) (*LiveClusterInfo, error) {
18+
func getLiveClusterInfo(ctx *sdk.Context, d *schema.ResourceData) (*LiveClusterInfo, error) {
1919
log.Printf("[DEBUG] getting eksctl cluster k8s version with id %q", d.Id())
2020

2121
m := &Manager{}
@@ -44,7 +44,7 @@ func getLiveClusterInfo(d *schema.ResourceData) (*LiveClusterInfo, error) {
4444

4545
cmd.Stdin = bytes.NewReader(set.ClusterConfig)
4646

47-
res, err := resource.Run(cmd)
47+
res, err := ctx.Run(cmd)
4848
if err != nil {
4949
return nil, err
5050
}

‎pkg/resource/cluster/cluster_read.go‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ import (
1313

1414
"github.com/google/go-cmp/cmp"
1515
"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
16-
"github.com/mumoshu/terraform-provider-eksctl/pkg/resource"
1716
)
1817

1918
type ReadWrite interface {
@@ -51,6 +50,8 @@ func (d *DiffReadWrite) Id() string {
5150
func (m *Manager) readCluster(d ReadWrite) (*Cluster, error) {
5251
cluster, err := m.readClusterInternal(d)
5352

53+
ctx := mustNewContext(cluster)
54+
5455
if err != nil {
5556
return nil, fmt.Errorf("reading cluster: %w", err)
5657
}
@@ -68,12 +69,13 @@ func (m *Manager) readCluster(d ReadWrite) (*Cluster, error) {
6869
if path != "" {
6970
if _, err := os.Stat(path); os.IsNotExist(err) {
7071
log.Printf("running customdiff: no kubeconfig file found at kubeconfig_path=%s: recreating it", path)
71-
if err := doWriteKubeconfig(d, string(m.getClusterName(cluster, d.Id())), cluster.Region); err != nil {
72+
if err := doWriteKubeconfig(nil, d, string(m.getClusterName(cluster, d.Id())), cluster.Region); err != nil {
7273
return nil, fmt.Errorf("writing missing kubeconfig on plan: %w", err)
7374
}
7475
}
7576
}
76-
if err := readIAMIdentityMapping(d, cluster); err != nil {
77+
78+
if err := readIAMIdentityMapping(ctx, d, cluster); err != nil {
7779
return nil, fmt.Errorf("reading aws-auth via eksctl get iamidentitymaping: %w", err)
7880
}
7981

@@ -121,15 +123,15 @@ func (m *Manager) planCluster(d *DiffReadWrite) error {
121123
return nil
122124
}
123125

124-
func readIAMIdentityMapping(d ReadWrite, cluster *Cluster) error {
126+
func readIAMIdentityMapping(ctx *sdk.Context, d ReadWrite, cluster *Cluster) error {
125127
iamWithOIDCEnabled, err := cluster.IAMWithOIDCEnabled()
126128
if err != nil {
127129
return fmt.Errorf("reading iam.withOIDC setting from cluster.yaml: %w", err)
128130
} else if !iamWithOIDCEnabled {
129131
return nil
130132
}
131133

132-
iams, err := runGetIAMIdentityMapping(d, cluster)
134+
iams, err := runGetIAMIdentityMapping(ctx, d, cluster)
133135
if err != nil {
134136
return fmt.Errorf("can not get iamidentitymapping from eks cluster: %w", err)
135137
}
@@ -153,8 +155,7 @@ func readIAMIdentityMapping(d ReadWrite, cluster *Cluster) error {
153155
return nil
154156
}
155157

156-
func runGetIAMIdentityMapping(d api.Getter, cluster *Cluster) ([]map[string]interface{}, error) {
157-
158+
func runGetIAMIdentityMapping(ctx *sdk.Context, d api.Getter, cluster *Cluster) ([]map[string]interface{}, error) {
158159
//get iamidentitymapping
159160
args := []string{
160161
"get",
@@ -170,7 +171,7 @@ func runGetIAMIdentityMapping(d api.Getter, cluster *Cluster) ([]map[string]inte
170171
return nil, fmt.Errorf("creating get imaidentitymapping command: %w", err)
171172
}
172173

173-
iamJson, err := resource.Run(cmd)
174+
iamJson, err := ctx.Run(cmd)
174175

175176
if err != nil {
176177
return nil, fmt.Errorf("running get iamidentitymapping : %w", err)
@@ -268,7 +269,9 @@ func runGetCluster(d api.Getter, cluster *Cluster) (*ClusterState, error) {
268269
return nil, fmt.Errorf("creating get imaidentitymapping command: %w", err)
269270
}
270271

271-
run, err := resource.Run(cmd)
272+
ctx := mustNewContext(cluster)
273+
274+
run, err := ctx.Run(cmd)
272275
if err != nil {
273276
return nil, xerrors.Errorf("running get-cluster: %w", err)
274277
}

0 commit comments

Comments
 (0)