Skip to content

Commit 3fe1135

Browse files
author
awstools
committed
feat(client-batch): This feature allows AWS Batch to support configuration of imagePullSecrets and allowPrivilegeEscalation for jobs running on EKS
1 parent f6cf100 commit 3fe1135

File tree

6 files changed

+102
-0
lines changed

6 files changed

+102
-0
lines changed

‎clients/client-batch/src/commands/DescribeJobDefinitionsCommand.ts

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -394,6 +394,11 @@ export interface DescribeJobDefinitionsCommandOutput extends DescribeJobDefiniti
394394
* // serviceAccountName: "STRING_VALUE",
395395
* // hostNetwork: true || false,
396396
* // dnsPolicy: "STRING_VALUE",
397+
* // imagePullSecrets: [ // ImagePullSecrets
398+
* // { // ImagePullSecret
399+
* // name: "STRING_VALUE", // required
400+
* // },
401+
* // ],
397402
* // containers: [ // EksContainers
398403
* // { // EksContainer
399404
* // name: "STRING_VALUE",
@@ -426,6 +431,7 @@ export interface DescribeJobDefinitionsCommandOutput extends DescribeJobDefiniti
426431
* // runAsUser: Number("long"),
427432
* // runAsGroup: Number("long"),
428433
* // privileged: true || false,
434+
* // allowPrivilegeEscalation: true || false,
429435
* // readOnlyRootFilesystem: true || false,
430436
* // runAsNonRoot: true || false,
431437
* // },
@@ -463,6 +469,7 @@ export interface DescribeJobDefinitionsCommandOutput extends DescribeJobDefiniti
463469
* // runAsUser: Number("long"),
464470
* // runAsGroup: Number("long"),
465471
* // privileged: true || false,
472+
* // allowPrivilegeEscalation: true || false,
466473
* // readOnlyRootFilesystem: true || false,
467474
* // runAsNonRoot: true || false,
468475
* // },

‎clients/client-batch/src/commands/DescribeJobsCommand.ts

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -405,6 +405,11 @@ export interface DescribeJobsCommandOutput extends DescribeJobsResponse, __Metad
405405
* // serviceAccountName: "STRING_VALUE",
406406
* // hostNetwork: true || false,
407407
* // dnsPolicy: "STRING_VALUE",
408+
* // imagePullSecrets: [ // ImagePullSecrets
409+
* // { // ImagePullSecret
410+
* // name: "STRING_VALUE", // required
411+
* // },
412+
* // ],
408413
* // containers: [ // EksContainerDetails
409414
* // { // EksContainerDetail
410415
* // name: "STRING_VALUE",
@@ -439,6 +444,7 @@ export interface DescribeJobsCommandOutput extends DescribeJobsResponse, __Metad
439444
* // runAsUser: Number("long"),
440445
* // runAsGroup: Number("long"),
441446
* // privileged: true || false,
447+
* // allowPrivilegeEscalation: true || false,
442448
* // readOnlyRootFilesystem: true || false,
443449
* // runAsNonRoot: true || false,
444450
* // },
@@ -478,6 +484,7 @@ export interface DescribeJobsCommandOutput extends DescribeJobsResponse, __Metad
478484
* // runAsUser: Number("long"),
479485
* // runAsGroup: Number("long"),
480486
* // privileged: true || false,
487+
* // allowPrivilegeEscalation: true || false,
481488
* // readOnlyRootFilesystem: true || false,
482489
* // runAsNonRoot: true || false,
483490
* // },

‎clients/client-batch/src/commands/RegisterJobDefinitionCommand.ts

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -337,6 +337,11 @@ export interface RegisterJobDefinitionCommandOutput extends RegisterJobDefinitio
337337
* serviceAccountName: "STRING_VALUE",
338338
* hostNetwork: true || false,
339339
* dnsPolicy: "STRING_VALUE",
340+
* imagePullSecrets: [ // ImagePullSecrets
341+
* { // ImagePullSecret
342+
* name: "STRING_VALUE", // required
343+
* },
344+
* ],
340345
* containers: [ // EksContainers
341346
* { // EksContainer
342347
* name: "STRING_VALUE",
@@ -369,6 +374,7 @@ export interface RegisterJobDefinitionCommandOutput extends RegisterJobDefinitio
369374
* runAsUser: Number("long"),
370375
* runAsGroup: Number("long"),
371376
* privileged: true || false,
377+
* allowPrivilegeEscalation: true || false,
372378
* readOnlyRootFilesystem: true || false,
373379
* runAsNonRoot: true || false,
374380
* },
@@ -406,6 +412,7 @@ export interface RegisterJobDefinitionCommandOutput extends RegisterJobDefinitio
406412
* runAsUser: Number("long"),
407413
* runAsGroup: Number("long"),
408414
* privileged: true || false,
415+
* allowPrivilegeEscalation: true || false,
409416
* readOnlyRootFilesystem: true || false,
410417
* runAsNonRoot: true || false,
411418
* },

‎clients/client-batch/src/models/models_0.ts

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3353,6 +3353,12 @@ export interface EksContainerSecurityContext {
33533353
*/
33543354
privileged?: boolean;
33553355

3356+
/**
3357+
* <p>Whether or not a container or a Kubernetes pod is allowed to gain more privileges than its parent process. The default value is <code>false</code>.</p>
3358+
* @public
3359+
*/
3360+
allowPrivilegeEscalation?: boolean;
3361+
33563362
/**
33573363
* <p>When this parameter is <code>true</code>, the container is given read-only access to its
33583364
* root file system. The default value is <code>false</code>. This parameter maps to
@@ -3497,6 +3503,18 @@ export interface EksContainer {
34973503
securityContext?: EksContainerSecurityContext;
34983504
}
34993505

3506+
/**
3507+
* <p>References a Kubernetes configuration resource that holds a list of secrets. These secrets help to gain access to pull an image from a private registry.</p>
3508+
* @public
3509+
*/
3510+
export interface ImagePullSecret {
3511+
/**
3512+
* <p>Provides a unique identifier for the <code>ImagePullSecret</code>. This object is required when <code>EksPodProperties$imagePullSecrets</code> is used.</p>
3513+
* @public
3514+
*/
3515+
name: string | undefined;
3516+
}
3517+
35003518
/**
35013519
* <p>Describes and uniquely identifies Kubernetes resources. For example, the compute environment that
35023520
* a pod runs in or the <code>jobID</code> for a job running in the pod. For more information, see
@@ -3664,6 +3682,14 @@ export interface EksPodProperties {
36643682
*/
36653683
dnsPolicy?: string;
36663684

3685+
/**
3686+
* <p>References a Kubernetes secret resource. This object must start and end with an alphanumeric character, is required to be lowercase, can include periods (.) and hyphens (-), and can't contain more than 253 characters.</p>
3687+
* <p>
3688+
* <code>ImagePullSecret$name</code> is required when this object is used.</p>
3689+
* @public
3690+
*/
3691+
imagePullSecrets?: ImagePullSecret[];
3692+
36673693
/**
36683694
* <p>The properties of the container that's used on the Amazon EKS pod.</p>
36693695
* @public
@@ -5103,6 +5129,12 @@ export interface EksPodPropertiesDetail {
51035129
*/
51045130
dnsPolicy?: string;
51055131

5132+
/**
5133+
* <p>Displays the reference pointer to the Kubernetes secret resource.</p>
5134+
* @public
5135+
*/
5136+
imagePullSecrets?: ImagePullSecret[];
5137+
51065138
/**
51075139
* <p>The properties of the container that's used on the Amazon EKS pod.</p>
51085140
* @public

‎clients/client-batch/src/protocols/Aws_restJson1.ts

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -127,6 +127,7 @@ import {
127127
FairsharePolicy,
128128
FargatePlatformConfiguration,
129129
Host,
130+
ImagePullSecret,
130131
JobDefinition,
131132
JobDependency,
132133
JobDetail,
@@ -1403,6 +1404,10 @@ const se_FairsharePolicy = (input: FairsharePolicy, context: __SerdeContext): an
14031404

14041405
// se_Host omitted.
14051406

1407+
// se_ImagePullSecret omitted.
1408+
1409+
// se_ImagePullSecrets omitted.
1410+
14061411
// se_JobDependency omitted.
14071412

14081413
// se_JobDependencyList omitted.
@@ -1669,6 +1674,10 @@ const de_FairsharePolicy = (output: any, context: __SerdeContext): FairsharePoli
16691674

16701675
// de_Host omitted.
16711676

1677+
// de_ImagePullSecret omitted.
1678+
1679+
// de_ImagePullSecrets omitted.
1680+
16721681
/**
16731682
* deserializeAws_restJson1JobDefinition
16741683
*/

‎codegen/sdk-codegen/aws-models/batch.json

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4220,6 +4220,12 @@
42204220
"smithy.api#documentation": "<p>When this parameter is <code>true</code>, the container is given elevated permissions on the\n host container instance. The level of permissions are similar to the <code>root</code> user\n permissions. The default value is <code>false</code>. This parameter maps to\n <code>privileged</code> policy in the <a href=\"https://kubernetes.io/docs/concepts/security/pod-security-policy/#privileged\">Privileged\n pod security policies</a> in the <i>Kubernetes documentation</i>.</p>"
42214221
}
42224222
},
4223+
"allowPrivilegeEscalation": {
4224+
"target": "com.amazonaws.batch#Boolean",
4225+
"traits": {
4226+
"smithy.api#documentation": "<p>Whether or not a container or a Kubernetes pod is allowed to gain more privileges than its parent process. The default value is <code>false</code>.</p>"
4227+
}
4228+
},
42234229
"readOnlyRootFilesystem": {
42244230
"target": "com.amazonaws.batch#Boolean",
42254231
"traits": {
@@ -4362,6 +4368,12 @@
43624368
"smithy.api#documentation": "<p>The DNS policy for the pod. The default value is <code>ClusterFirst</code>. If the\n <code>hostNetwork</code> parameter is not specified, the default is\n <code>ClusterFirstWithHostNet</code>. <code>ClusterFirst</code> indicates that any DNS query\n that does not match the configured cluster domain suffix is forwarded to the upstream nameserver\n inherited from the node. For more information, see <a href=\"https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy\">Pod's DNS policy</a> in the <i>Kubernetes documentation</i>.</p>\n <p>Valid values: <code>Default</code> | <code>ClusterFirst</code> |\n <code>ClusterFirstWithHostNet</code>\n </p>"
43634369
}
43644370
},
4371+
"imagePullSecrets": {
4372+
"target": "com.amazonaws.batch#ImagePullSecrets",
4373+
"traits": {
4374+
"smithy.api#documentation": "<p>References a Kubernetes secret resource. This object must start and end with an alphanumeric character, is required to be lowercase, can include periods (.) and hyphens (-), and can't contain more than 253 characters.</p>\n <p>\n <code>ImagePullSecret$name</code> is required when this object is used.</p>"
4375+
}
4376+
},
43654377
"containers": {
43664378
"target": "com.amazonaws.batch#EksContainers",
43674379
"traits": {
@@ -4418,6 +4430,12 @@
44184430
"smithy.api#documentation": "<p>The DNS policy for the pod. The default value is <code>ClusterFirst</code>. If the\n <code>hostNetwork</code> parameter is not specified, the default is\n <code>ClusterFirstWithHostNet</code>. <code>ClusterFirst</code> indicates that any DNS query\n that does not match the configured cluster domain suffix is forwarded to the upstream nameserver\n inherited from the node. If no value was specified for <code>dnsPolicy</code> in the <a href=\"https://docs.aws.amazon.com/batch/latest/APIReference/API_RegisterJobDefinition.html\">RegisterJobDefinition</a> API operation, then no value will be returned for\n <code>dnsPolicy</code> by either of <a href=\"https://docs.aws.amazon.com/batch/latest/APIReference/API_DescribeJobDefinitions.html\">DescribeJobDefinitions</a>\n or <a href=\"https://docs.aws.amazon.com/batch/latest/APIReference/API_DescribeJobs.html\">DescribeJobs</a> API operations. The pod spec setting will contain either\n <code>ClusterFirst</code> or <code>ClusterFirstWithHostNet</code>, depending on the value of the\n <code>hostNetwork</code> parameter. For more information, see <a href=\"https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy\">Pod's DNS policy</a> in the <i>Kubernetes documentation</i>.</p>\n <p>Valid values: <code>Default</code> | <code>ClusterFirst</code> |\n <code>ClusterFirstWithHostNet</code>\n </p>"
44194431
}
44204432
},
4433+
"imagePullSecrets": {
4434+
"target": "com.amazonaws.batch#ImagePullSecrets",
4435+
"traits": {
4436+
"smithy.api#documentation": "<p>Displays the reference pointer to the Kubernetes secret resource.</p>"
4437+
}
4438+
},
44214439
"containers": {
44224440
"target": "com.amazonaws.batch#EksContainerDetails",
44234441
"traits": {
@@ -4732,6 +4750,28 @@
47324750
}
47334751
}
47344752
},
4753+
"com.amazonaws.batch#ImagePullSecret": {
4754+
"type": "structure",
4755+
"members": {
4756+
"name": {
4757+
"target": "com.amazonaws.batch#String",
4758+
"traits": {
4759+
"smithy.api#clientOptional": {},
4760+
"smithy.api#documentation": "<p>Provides a unique identifier for the <code>ImagePullSecret</code>. This object is required when <code>EksPodProperties$imagePullSecrets</code> is used.</p>",
4761+
"smithy.api#required": {}
4762+
}
4763+
}
4764+
},
4765+
"traits": {
4766+
"smithy.api#documentation": "<p>References a Kubernetes configuration resource that holds a list of secrets. These secrets help to gain access to pull an image from a private registry.</p>"
4767+
}
4768+
},
4769+
"com.amazonaws.batch#ImagePullSecrets": {
4770+
"type": "list",
4771+
"member": {
4772+
"target": "com.amazonaws.batch#ImagePullSecret"
4773+
}
4774+
},
47354775
"com.amazonaws.batch#ImageType": {
47364776
"type": "string",
47374777
"traits": {

0 commit comments

Comments
 (0)