Skip to content

Commit 82aec9d

Browse files
markussiebertmarkussiebert
authored
feat(aws-eks): add annotations and labels to service accounts (#19609)
I have added two optional props for the serviceaccount: * annotations * labels at the moment, both aren't accessible. It's possible to create kubernetes patches for this, but the same time it's only a small change to enable both options in a backward compatible way. fixes #19607 ### All Submissions: * [x] Have you followed the guidelines in our [Contributing guide?](https://github.com/aws/aws-cdk/blob/master/CONTRIBUTING.md) ### Adding new Unconventional Dependencies: no ### New Features * I have added an unit test for the extended properties *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent 6787376 commit 82aec9d

9 files changed

+513
-137
lines changed

‎packages/@aws-cdk/aws-eks/README.md

+15
Original file line numberDiff line numberDiff line change
@@ -903,6 +903,21 @@ new CfnOutput(this, 'ServiceAccountIamRole', { value: serviceAccount.role.roleAr
903903
Note that using `serviceAccount.serviceAccountName` above **does not** translate into a resource dependency.
904904
This is why an explicit dependency is needed. See <https://github.com/aws/aws-cdk/issues/9910> for more details.
905905

906+
It is possible to pass annotations and labels to the service account.
907+
908+
```ts
909+
declare const cluster: eks.Cluster;
910+
// add service account with annotations and labels
911+
const serviceAccount = cluster.addServiceAccount('MyServiceAccount', {
912+
annotations: {
913+
'eks.amazonaws.com/sts-regional-endpoints': 'false',
914+
},
915+
labels: {
916+
'some-label': 'with-some-value',
917+
},
918+
});
919+
```
920+
906921
You can also add service accounts to existing clusters.
907922
To do so, pass the `openIdConnectProvider` property when you import the cluster into the application.
908923

‎packages/@aws-cdk/aws-eks/lib/service-account.ts

+16
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,20 @@ export interface ServiceAccountOptions {
2929
* @default "default"
3030
*/
3131
readonly namespace?: string;
32+
33+
/**
34+
* Additional annotations of the service account.
35+
*
36+
* @default - no additional annotations
37+
*/
38+
readonly annotations?: {[key:string]: string};
39+
40+
/**
41+
* Additional labels of the service account.
42+
*
43+
* @default - no additional labels
44+
*/
45+
readonly labels?: {[key:string]: string};
3246
}
3347

3448
/**
@@ -113,9 +127,11 @@ export class ServiceAccount extends CoreConstruct implements IPrincipal {
113127
namespace: this.serviceAccountNamespace,
114128
labels: {
115129
'app.kubernetes.io/name': this.serviceAccountName,
130+
...props.labels,
116131
},
117132
annotations: {
118133
'eks.amazonaws.com/role-arn': this.role.roleArn,
134+
...props.annotations,
119135
},
120136
},
121137
}],

‎packages/@aws-cdk/aws-eks/test/eks-cluster.integ.snapshot/aws-cdk-eks-cluster-test.template.json

+145-28
Original file line numberDiff line numberDiff line change
@@ -3169,6 +3169,123 @@
31693169
"UpdateReplacePolicy": "Delete",
31703170
"DeletionPolicy": "Delete"
31713171
},
3172+
"ClusterMyExtendedServiceAccountConditionJsonF780F28A": {
3173+
"Type": "Custom::AWSCDKCfnJson",
3174+
"Properties": {
3175+
"ServiceToken": {
3176+
"Fn::GetAtt": [
3177+
"AWSCDKCfnUtilsProviderCustomResourceProviderHandlerCF82AA57",
3178+
"Arn"
3179+
]
3180+
},
3181+
"Value": {
3182+
"Fn::Join": [
3183+
"",
3184+
[
3185+
"{\"",
3186+
{
3187+
"Fn::Select": [
3188+
1,
3189+
{
3190+
"Fn::Split": [
3191+
":oidc-provider/",
3192+
{
3193+
"Ref": "ClusterOpenIdConnectProviderE7EB0530"
3194+
}
3195+
]
3196+
}
3197+
]
3198+
},
3199+
":aud\":\"sts.amazonaws.com\",\"",
3200+
{
3201+
"Fn::Select": [
3202+
1,
3203+
{
3204+
"Fn::Split": [
3205+
":oidc-provider/",
3206+
{
3207+
"Ref": "ClusterOpenIdConnectProviderE7EB0530"
3208+
}
3209+
]
3210+
}
3211+
]
3212+
},
3213+
":sub\":\"system:serviceaccount:default:awscdkeksclustertestclustermyextendedserviceaccounte1ac12ae\"}"
3214+
]
3215+
]
3216+
}
3217+
},
3218+
"UpdateReplacePolicy": "Delete",
3219+
"DeletionPolicy": "Delete"
3220+
},
3221+
"ClusterMyExtendedServiceAccountRole064047AA": {
3222+
"Type": "AWS::IAM::Role",
3223+
"Properties": {
3224+
"AssumeRolePolicyDocument": {
3225+
"Statement": [
3226+
{
3227+
"Action": "sts:AssumeRoleWithWebIdentity",
3228+
"Condition": {
3229+
"StringEquals": {
3230+
"Fn::GetAtt": [
3231+
"ClusterMyExtendedServiceAccountConditionJsonF780F28A",
3232+
"Value"
3233+
]
3234+
}
3235+
},
3236+
"Effect": "Allow",
3237+
"Principal": {
3238+
"Federated": {
3239+
"Ref": "ClusterOpenIdConnectProviderE7EB0530"
3240+
}
3241+
}
3242+
}
3243+
],
3244+
"Version": "2012-10-17"
3245+
}
3246+
}
3247+
},
3248+
"ClusterMyExtendedServiceAccountmanifestMyExtendedServiceAccountServiceAccountResource90162712": {
3249+
"Type": "Custom::AWSCDK-EKS-KubernetesResource",
3250+
"Properties": {
3251+
"ServiceToken": {
3252+
"Fn::GetAtt": [
3253+
"awscdkawseksKubectlProviderNestedStackawscdkawseksKubectlProviderNestedStackResourceA7AEBA6B",
3254+
"Outputs.awscdkeksclustertestawscdkawseksKubectlProviderframeworkonEventC681B49AArn"
3255+
]
3256+
},
3257+
"Manifest": {
3258+
"Fn::Join": [
3259+
"",
3260+
[
3261+
"[{\"apiVersion\":\"v1\",\"kind\":\"ServiceAccount\",\"metadata\":{\"name\":\"awscdkeksclustertestclustermyextendedserviceaccounte1ac12ae\",\"namespace\":\"default\",\"labels\":{\"aws.cdk.eks/prune-c8794052a8684d4683f84b33861d88bc4524fe40a4\":\"\",\"app.kubernetes.io/name\":\"awscdkeksclustertestclustermyextendedserviceaccounte1ac12ae\",\"some-label\":\"with-some-value\"},\"annotations\":{\"eks.amazonaws.com/role-arn\":\"",
3262+
{
3263+
"Fn::GetAtt": [
3264+
"ClusterMyExtendedServiceAccountRole064047AA",
3265+
"Arn"
3266+
]
3267+
},
3268+
"\",\"eks.amazonaws.com/sts-regional-endpoints\":\"false\"}}}]"
3269+
]
3270+
]
3271+
},
3272+
"ClusterName": {
3273+
"Ref": "Cluster9EE0221C"
3274+
},
3275+
"RoleArn": {
3276+
"Fn::GetAtt": [
3277+
"ClusterCreationRole360249B6",
3278+
"Arn"
3279+
]
3280+
},
3281+
"PruneLabel": "aws.cdk.eks/prune-c8794052a8684d4683f84b33861d88bc4524fe40a4"
3282+
},
3283+
"DependsOn": [
3284+
"ClusterKubectlReadyBarrier200052AF"
3285+
],
3286+
"UpdateReplacePolicy": "Delete",
3287+
"DeletionPolicy": "Delete"
3288+
},
31723289
"awscdkawseksClusterResourceProviderNestedStackawscdkawseksClusterResourceProviderNestedStackResource9827C454": {
31733290
"Type": "AWS::CloudFormation::Stack",
31743291
"Properties": {
@@ -3182,7 +3299,7 @@
31823299
},
31833300
"/",
31843301
{
3185-
"Ref": "AssetParametersea4150cc2723f9fec69c9ba0c3ec4c8c5fe6f46ca1b9b7e60840fc65db4fea8dS3Bucket8C46C646"
3302+
"Ref": "AssetParameters91f8755870f504ae642e221f6da2fbeb064aa2e77da4db41c8204d4a477820a2S3BucketD8DE40A2"
31863303
},
31873304
"/",
31883305
{
@@ -3192,7 +3309,7 @@
31923309
"Fn::Split": [
31933310
"||",
31943311
{
3195-
"Ref": "AssetParametersea4150cc2723f9fec69c9ba0c3ec4c8c5fe6f46ca1b9b7e60840fc65db4fea8dS3VersionKey056EDDA8"
3312+
"Ref": "AssetParameters91f8755870f504ae642e221f6da2fbeb064aa2e77da4db41c8204d4a477820a2S3VersionKey56F85494"
31963313
}
31973314
]
31983315
}
@@ -3205,7 +3322,7 @@
32053322
"Fn::Split": [
32063323
"||",
32073324
{
3208-
"Ref": "AssetParametersea4150cc2723f9fec69c9ba0c3ec4c8c5fe6f46ca1b9b7e60840fc65db4fea8dS3VersionKey056EDDA8"
3325+
"Ref": "AssetParameters91f8755870f504ae642e221f6da2fbeb064aa2e77da4db41c8204d4a477820a2S3VersionKey56F85494"
32093326
}
32103327
]
32113328
}
@@ -3257,7 +3374,7 @@
32573374
},
32583375
"/",
32593376
{
3260-
"Ref": "AssetParametersbff088c569c330c279e54fe0e98fc4226648b5b86454bb2ad9491b2ca6befdd2S3Bucket02334476"
3377+
"Ref": "AssetParametersbd8c31619d7a041234290aeca57f70c3e60bf4783dbf50624b41353a0e7672feS3Bucket6E7361AC"
32613378
},
32623379
"/",
32633380
{
@@ -3267,7 +3384,7 @@
32673384
"Fn::Split": [
32683385
"||",
32693386
{
3270-
"Ref": "AssetParametersbff088c569c330c279e54fe0e98fc4226648b5b86454bb2ad9491b2ca6befdd2S3VersionKey4DD620E2"
3387+
"Ref": "AssetParametersbd8c31619d7a041234290aeca57f70c3e60bf4783dbf50624b41353a0e7672feS3VersionKey6448B02B"
32713388
}
32723389
]
32733390
}
@@ -3280,7 +3397,7 @@
32803397
"Fn::Split": [
32813398
"||",
32823399
{
3283-
"Ref": "AssetParametersbff088c569c330c279e54fe0e98fc4226648b5b86454bb2ad9491b2ca6befdd2S3VersionKey4DD620E2"
3400+
"Ref": "AssetParametersbd8c31619d7a041234290aeca57f70c3e60bf4783dbf50624b41353a0e7672feS3VersionKey6448B02B"
32843401
}
32853402
]
32863403
}
@@ -3323,11 +3440,11 @@
33233440
"ClusterSecurityGroupId"
33243441
]
33253442
},
3326-
"referencetoawscdkeksclustertestAssetParameters01e9cf93416a1f67b17dad851459445bdaaafcc2f3ab4390c03984fd57b2f476S3Bucket81FF031ERef": {
3327-
"Ref": "AssetParameters01e9cf93416a1f67b17dad851459445bdaaafcc2f3ab4390c03984fd57b2f476S3BucketC0D91AC4"
3443+
"referencetoawscdkeksclustertestAssetParametersdb6b1b1d10ac786ce3eb5f326510da62c14c0e4477065964c4cdf7a54439f131S3BucketF401902DRef": {
3444+
"Ref": "AssetParametersdb6b1b1d10ac786ce3eb5f326510da62c14c0e4477065964c4cdf7a54439f131S3BucketB5BDD0CD"
33283445
},
3329-
"referencetoawscdkeksclustertestAssetParameters01e9cf93416a1f67b17dad851459445bdaaafcc2f3ab4390c03984fd57b2f476S3VersionKeyA669A4EBRef": {
3330-
"Ref": "AssetParameters01e9cf93416a1f67b17dad851459445bdaaafcc2f3ab4390c03984fd57b2f476S3VersionKey26CFD1B0"
3446+
"referencetoawscdkeksclustertestAssetParametersdb6b1b1d10ac786ce3eb5f326510da62c14c0e4477065964c4cdf7a54439f131S3VersionKey4C2DA8A7Ref": {
3447+
"Ref": "AssetParametersdb6b1b1d10ac786ce3eb5f326510da62c14c0e4477065964c4cdf7a54439f131S3VersionKey31B1BA95"
33313448
},
33323449
"referencetoawscdkeksclustertestAssetParametersc6964dbf0c556ec82ce09622e99ad6f6d4e488cdaac0ef9e8492e078ec61ffedS3Bucket1C5C92D4Ref": {
33333450
"Ref": "AssetParametersc6964dbf0c556ec82ce09622e99ad6f6d4e488cdaac0ef9e8492e078ec61ffedS3Bucket83B8778F"
@@ -3712,17 +3829,17 @@
37123829
"Type": "String",
37133830
"Description": "Artifact hash for asset \"07a1c6a504be72dba3e9bc5b12cc2b5b0e83ea5c6ba10a4128da5c2180f3f963\""
37143831
},
3715-
"AssetParameters01e9cf93416a1f67b17dad851459445bdaaafcc2f3ab4390c03984fd57b2f476S3BucketC0D91AC4": {
3832+
"AssetParametersdb6b1b1d10ac786ce3eb5f326510da62c14c0e4477065964c4cdf7a54439f131S3BucketB5BDD0CD": {
37163833
"Type": "String",
3717-
"Description": "S3 bucket for asset \"01e9cf93416a1f67b17dad851459445bdaaafcc2f3ab4390c03984fd57b2f476\""
3834+
"Description": "S3 bucket for asset \"db6b1b1d10ac786ce3eb5f326510da62c14c0e4477065964c4cdf7a54439f131\""
37183835
},
3719-
"AssetParameters01e9cf93416a1f67b17dad851459445bdaaafcc2f3ab4390c03984fd57b2f476S3VersionKey26CFD1B0": {
3836+
"AssetParametersdb6b1b1d10ac786ce3eb5f326510da62c14c0e4477065964c4cdf7a54439f131S3VersionKey31B1BA95": {
37203837
"Type": "String",
3721-
"Description": "S3 key for asset version \"01e9cf93416a1f67b17dad851459445bdaaafcc2f3ab4390c03984fd57b2f476\""
3838+
"Description": "S3 key for asset version \"db6b1b1d10ac786ce3eb5f326510da62c14c0e4477065964c4cdf7a54439f131\""
37223839
},
3723-
"AssetParameters01e9cf93416a1f67b17dad851459445bdaaafcc2f3ab4390c03984fd57b2f476ArtifactHash0FB7E57C": {
3840+
"AssetParametersdb6b1b1d10ac786ce3eb5f326510da62c14c0e4477065964c4cdf7a54439f131ArtifactHash51AE2352": {
37243841
"Type": "String",
3725-
"Description": "Artifact hash for asset \"01e9cf93416a1f67b17dad851459445bdaaafcc2f3ab4390c03984fd57b2f476\""
3842+
"Description": "Artifact hash for asset \"db6b1b1d10ac786ce3eb5f326510da62c14c0e4477065964c4cdf7a54439f131\""
37263843
},
37273844
"AssetParametersc6964dbf0c556ec82ce09622e99ad6f6d4e488cdaac0ef9e8492e078ec61ffedS3Bucket83B8778F": {
37283845
"Type": "String",
@@ -3772,29 +3889,29 @@
37723889
"Type": "String",
37733890
"Description": "Artifact hash for asset \"f850d967c52a5f64e6436dc84abdde4d86197f2a0871f5ab27c79647a91d0bf4\""
37743891
},
3775-
"AssetParametersea4150cc2723f9fec69c9ba0c3ec4c8c5fe6f46ca1b9b7e60840fc65db4fea8dS3Bucket8C46C646": {
3892+
"AssetParameters91f8755870f504ae642e221f6da2fbeb064aa2e77da4db41c8204d4a477820a2S3BucketD8DE40A2": {
37763893
"Type": "String",
3777-
"Description": "S3 bucket for asset \"ea4150cc2723f9fec69c9ba0c3ec4c8c5fe6f46ca1b9b7e60840fc65db4fea8d\""
3894+
"Description": "S3 bucket for asset \"91f8755870f504ae642e221f6da2fbeb064aa2e77da4db41c8204d4a477820a2\""
37783895
},
3779-
"AssetParametersea4150cc2723f9fec69c9ba0c3ec4c8c5fe6f46ca1b9b7e60840fc65db4fea8dS3VersionKey056EDDA8": {
3896+
"AssetParameters91f8755870f504ae642e221f6da2fbeb064aa2e77da4db41c8204d4a477820a2S3VersionKey56F85494": {
37803897
"Type": "String",
3781-
"Description": "S3 key for asset version \"ea4150cc2723f9fec69c9ba0c3ec4c8c5fe6f46ca1b9b7e60840fc65db4fea8d\""
3898+
"Description": "S3 key for asset version \"91f8755870f504ae642e221f6da2fbeb064aa2e77da4db41c8204d4a477820a2\""
37823899
},
3783-
"AssetParametersea4150cc2723f9fec69c9ba0c3ec4c8c5fe6f46ca1b9b7e60840fc65db4fea8dArtifactHashCC9BD51B": {
3900+
"AssetParameters91f8755870f504ae642e221f6da2fbeb064aa2e77da4db41c8204d4a477820a2ArtifactHash1C092305": {
37843901
"Type": "String",
3785-
"Description": "Artifact hash for asset \"ea4150cc2723f9fec69c9ba0c3ec4c8c5fe6f46ca1b9b7e60840fc65db4fea8d\""
3902+
"Description": "Artifact hash for asset \"91f8755870f504ae642e221f6da2fbeb064aa2e77da4db41c8204d4a477820a2\""
37863903
},
3787-
"AssetParametersbff088c569c330c279e54fe0e98fc4226648b5b86454bb2ad9491b2ca6befdd2S3Bucket02334476": {
3904+
"AssetParametersbd8c31619d7a041234290aeca57f70c3e60bf4783dbf50624b41353a0e7672feS3Bucket6E7361AC": {
37883905
"Type": "String",
3789-
"Description": "S3 bucket for asset \"bff088c569c330c279e54fe0e98fc4226648b5b86454bb2ad9491b2ca6befdd2\""
3906+
"Description": "S3 bucket for asset \"bd8c31619d7a041234290aeca57f70c3e60bf4783dbf50624b41353a0e7672fe\""
37903907
},
3791-
"AssetParametersbff088c569c330c279e54fe0e98fc4226648b5b86454bb2ad9491b2ca6befdd2S3VersionKey4DD620E2": {
3908+
"AssetParametersbd8c31619d7a041234290aeca57f70c3e60bf4783dbf50624b41353a0e7672feS3VersionKey6448B02B": {
37923909
"Type": "String",
3793-
"Description": "S3 key for asset version \"bff088c569c330c279e54fe0e98fc4226648b5b86454bb2ad9491b2ca6befdd2\""
3910+
"Description": "S3 key for asset version \"bd8c31619d7a041234290aeca57f70c3e60bf4783dbf50624b41353a0e7672fe\""
37943911
},
3795-
"AssetParametersbff088c569c330c279e54fe0e98fc4226648b5b86454bb2ad9491b2ca6befdd2ArtifactHashCAA18A23": {
3912+
"AssetParametersbd8c31619d7a041234290aeca57f70c3e60bf4783dbf50624b41353a0e7672feArtifactHash9F07E531": {
37963913
"Type": "String",
3797-
"Description": "Artifact hash for asset \"bff088c569c330c279e54fe0e98fc4226648b5b86454bb2ad9491b2ca6befdd2\""
3914+
"Description": "Artifact hash for asset \"bd8c31619d7a041234290aeca57f70c3e60bf4783dbf50624b41353a0e7672fe\""
37983915
},
37993916
"SsmParameterValueawsserviceeksoptimizedami121amazonlinux2recommendedimageidC96584B6F00A464EAD1953AFF4B05118Parameter": {
38003917
"Type": "AWS::SSM::Parameter::Value<String>",

‎packages/@aws-cdk/aws-eks/test/eks-cluster.integ.snapshot/awscdkeksclustertestawscdkawseksClusterResourceProvider5F388D1A.nested.template.json

+10
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,11 @@
146146
]
147147
},
148148
"Description": "onEvent handler for EKS cluster resource provider",
149+
"Environment": {
150+
"Variables": {
151+
"AWS_STS_REGIONAL_ENDPOINTS": "regional"
152+
}
153+
},
149154
"Handler": "index.onEvent",
150155
"Layers": [
151156
{
@@ -262,6 +267,11 @@
262267
]
263268
},
264269
"Description": "isComplete handler for EKS cluster resource provider",
270+
"Environment": {
271+
"Variables": {
272+
"AWS_STS_REGIONAL_ENDPOINTS": "regional"
273+
}
274+
},
265275
"Handler": "index.isComplete",
266276
"Layers": [
267277
{

‎packages/@aws-cdk/aws-eks/test/eks-cluster.integ.snapshot/awscdkeksclustertestawscdkawseksKubectlProviderE05943BF.nested.template.json

+5-5
Original file line numberDiff line numberDiff line change
@@ -212,7 +212,7 @@
212212
"Properties": {
213213
"Content": {
214214
"S3Bucket": {
215-
"Ref": "referencetoawscdkeksclustertestAssetParameters01e9cf93416a1f67b17dad851459445bdaaafcc2f3ab4390c03984fd57b2f476S3Bucket81FF031ERef"
215+
"Ref": "referencetoawscdkeksclustertestAssetParametersdb6b1b1d10ac786ce3eb5f326510da62c14c0e4477065964c4cdf7a54439f131S3BucketF401902DRef"
216216
},
217217
"S3Key": {
218218
"Fn::Join": [
@@ -225,7 +225,7 @@
225225
"Fn::Split": [
226226
"||",
227227
{
228-
"Ref": "referencetoawscdkeksclustertestAssetParameters01e9cf93416a1f67b17dad851459445bdaaafcc2f3ab4390c03984fd57b2f476S3VersionKeyA669A4EBRef"
228+
"Ref": "referencetoawscdkeksclustertestAssetParametersdb6b1b1d10ac786ce3eb5f326510da62c14c0e4477065964c4cdf7a54439f131S3VersionKey4C2DA8A7Ref"
229229
}
230230
]
231231
}
@@ -238,7 +238,7 @@
238238
"Fn::Split": [
239239
"||",
240240
{
241-
"Ref": "referencetoawscdkeksclustertestAssetParameters01e9cf93416a1f67b17dad851459445bdaaafcc2f3ab4390c03984fd57b2f476S3VersionKeyA669A4EBRef"
241+
"Ref": "referencetoawscdkeksclustertestAssetParametersdb6b1b1d10ac786ce3eb5f326510da62c14c0e4477065964c4cdf7a54439f131S3VersionKey4C2DA8A7Ref"
242242
}
243243
]
244244
}
@@ -498,10 +498,10 @@
498498
"referencetoawscdkeksclustertestClusterD76DFF87ClusterSecurityGroupId": {
499499
"Type": "String"
500500
},
501-
"referencetoawscdkeksclustertestAssetParameters01e9cf93416a1f67b17dad851459445bdaaafcc2f3ab4390c03984fd57b2f476S3Bucket81FF031ERef": {
501+
"referencetoawscdkeksclustertestAssetParametersdb6b1b1d10ac786ce3eb5f326510da62c14c0e4477065964c4cdf7a54439f131S3BucketF401902DRef": {
502502
"Type": "String"
503503
},
504-
"referencetoawscdkeksclustertestAssetParameters01e9cf93416a1f67b17dad851459445bdaaafcc2f3ab4390c03984fd57b2f476S3VersionKeyA669A4EBRef": {
504+
"referencetoawscdkeksclustertestAssetParametersdb6b1b1d10ac786ce3eb5f326510da62c14c0e4477065964c4cdf7a54439f131S3VersionKey4C2DA8A7Ref": {
505505
"Type": "String"
506506
},
507507
"referencetoawscdkeksclustertestAssetParametersc6964dbf0c556ec82ce09622e99ad6f6d4e488cdaac0ef9e8492e078ec61ffedS3Bucket1C5C92D4Ref": {

0 commit comments

Comments
 (0)