Enable management of access to public/private API endpoints #1149

D3nn · 2019-08-15T15:24:22Z

Description

Enable the ability to allow/deny access to the API server endpoint publicly (from the Internet) or privately (from Worker nodes, Direct Connect networks, VPN networks, etc).

Resolve #649

Checklist

Code compiles correctly (i.e make build)
Added tests that cover your change (if possible)
All unit tests passing (i.e. make test)
Added/modified documentation as required (such as the README.md, and examples directory)
Manually tested

martina-if

Only a change to the site?

D3nn · 2019-08-16T16:46:04Z

It's a WIP, so I just wanted to get the PR started and add commits as I go. I'll let you know when it's ready to review.

…

On Fri, Aug 16, 2019 at 8:11 AM Martina Iglesias ***@***.***> wrote: ***@***.**** commented on this pull request. Only a change to the site? — You are receiving this because you were assigned. Reply to this email directly, view it on GitHub <#1149>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AFRGU36WWYPPKBQXQS6PHY3QE2YRXANCNFSM4IL7IEBQ> .

rndstr

documentation is easy to understand 👍 i would want to know what the default is, though.

Edit: or is the default going to stay as is (Public=true, Private=false)?

site/content/usage/06-vpc-networking.md

errordeveloper · 2019-08-30T07:15:21Z

I think we will need document considerations around using private-only. E.g. it should be doable if you are managing the VPC externally.

The main challenge is that aside from AWS API calls we do need to make calls to Kubernetes API, e.g. to update kube-system:ConfigMap/aws-auth. It's possible to design it in a way that lets you create a cluster from any machine and disable public right at the very end. The reason we'd have to do it that way is that we create the VPC, we could explore shared VPC more (#892), but in any case there are a few things to think about.

errordeveloper · 2019-08-30T07:39:38Z

I opened #1230.

D3nn · 2019-08-30T15:17:22Z

I think we will need document considerations around using private-only. E.g. it should be doable if you are managing the VPC externally.

The main challenge is that aside from AWS API calls we do need to make calls to Kubernetes API, e.g. to update kube-system:ConfigMap/aws-auth. It's possible to design it in a way that lets you create a cluster from any machine and disable public right at the very end. The reason we'd have to do it that way is that we create the VPC, we could explore shared VPC more (#892), but in any case there are a few things to think about.

I'll remove that as an option until we can address the kubernetes API calls.

D3nn · 2019-09-03T14:20:59Z

I think we will need document considerations around using private-only. E.g. it should be doable if you are managing the VPC externally.

The main challenge is that aside from AWS API calls we do need to make calls to Kubernetes API, e.g. to update kube-system:ConfigMap/aws-auth. It's possible to design it in a way that lets you create a cluster from any machine and disable public right at the very end. The reason we'd have to do it that way is that we create the VPC, we could explore shared VPC more (#892), but in any case there are a few things to think about.

I'll remove that as an option until we can address the kubernetes API calls.

I think we will need document considerations around using private-only. E.g. it should be doable if you are managing the VPC externally.

The main challenge is that aside from AWS API calls we do need to make calls to Kubernetes API, e.g. to update kube-system:ConfigMap/aws-auth. It's possible to design it in a way that lets you create a cluster from any machine and disable public right at the very end. The reason we'd have to do it that way is that we create the VPC, we could explore shared VPC more (#892), but in any case there are a few things to think about.

As it stands currently, the vpc endpoint updates happen as a separate task after the other tasks have completed since it is an AWS API call and not a CloudFormation configuration item. That means that a cluster creation wouldn't be affected by this issue but it would then subsequently block access to the "writekubeconfig" functionality (as well as any other calls that rely on K8s API access to function properly).

InAnimaTe · 2019-09-06T22:06:11Z

Just wanted to stop by and say awesome work @D3nn and others involved in making this happen! Been wanting this feature for a while and glad to see some awesome people are pushing it forward.

1. Removed True/False in favor of Enabled()/Disabled 1. Updated api.IsSet to take interfaces and expanded it's use

1. Added 'WithoutArg' to runner to allow removing region, which interfered with use of the configfile for creating clusters 1. Reset values of create/delete/updateCluster to make output more readable 1. Changed integration test EndpointAccessCases to EndpointAccessCase to reflect how it was being used. 1. Refactored tests to make deleteCluster a separate test case

1. No need to export EndpointAccessCase structs in tests (fixed) 1. Revert IsSet changes in favor of foo != nil 1. Rewording messages to not use Cluster API since it is possibly confusing 1. Renamed utils subcommand to update-cluster-endpoints 1. Refactoring in vpc_test.go 1. Renamed some functions to match how others are named 1. Changed the way `eksctl utils update-cluster-endpoints` shows what will be upated 1. Fixed issue that would cause tasks to not run in certain cases 1. Fixed example command in 06-vpc-networking.md

1. Using -test.v -ginkgo.v rather than printing test headers manually 1. Updated testcase descriptions to better reflect the test.

… SetRunFunc

1. Change public/private message output to be consitent throughout all messages 1. Compare cluster endpoints using json.Marshal instead of json.MarshalIndent

- values not explicitly passed will get current values - moved validation checks further down to not cut off display of new values

- remove `--approve` from sample (to prevent accidental execution) - remove non-value example to prevent confusion

`update-cluster-endpoints` command changes API endpoint settings (eksctl-io#1149) But this command doesn't read config file. So when we use `-f` option, `eksctl` doesn't change settings.

D3nn self-assigned this Aug 15, 2019

D3nn requested review from martina-if, errordeveloper and rndstr August 15, 2019 15:26

D3nn added this to the 0.5.0 milestone Aug 15, 2019

D3nn added area/config-file area/general-cli kind/feature New feature or request labels Aug 15, 2019

martina-if reviewed Aug 16, 2019

View reviewed changes

rndstr reviewed Aug 21, 2019

View reviewed changes

site/content/usage/06-vpc-networking.md Outdated Show resolved Hide resolved

rndstr reviewed Aug 21, 2019

View reviewed changes

site/content/usage/06-vpc-networking.md Outdated Show resolved Hide resolved

D3nn force-pushed the toggle-public-private-endpoint-access branch 2 times, most recently from b4d0eea to bb1aca5 Compare August 21, 2019 17:57

martina-if reviewed Aug 22, 2019

View reviewed changes

site/content/usage/06-vpc-networking.md Outdated Show resolved Hide resolved

errordeveloper reviewed Aug 30, 2019

View reviewed changes

site/content/usage/06-vpc-networking.md Outdated Show resolved Hide resolved

errordeveloper modified the milestones: 0.5.0, 0.6.0 Aug 30, 2019

D3nn force-pushed the toggle-public-private-endpoint-access branch 2 times, most recently from 3ae9ad2 to d508d86 Compare September 17, 2019 19:20

D3nn changed the title ~~(WIP) Enable management of access to publc/private API endpoints~~ Enable management of access to publc/private API endpoints Sep 17, 2019

D3nn requested review from rndstr, martina-if and errordeveloper September 17, 2019 20:00

D3nn and others added 17 commits October 8, 2019 17:47

Minor refactoring

01482c5

1. Removed True/False in favor of Enabled()/Disabled 1. Updated api.IsSet to take interfaces and expanded it's use

integration test update

aa6c906

1. Using -test.v -ginkgo.v rather than printing test headers manually 1. Updated testcase descriptions to better reflect the test.

remove unneeded parens in log output, switch SetRunFuncWithNameArg to…

48a798c

… SetRunFunc

change url link to refer to 'EKS user guide' by name

d91b969

add endpoint feature to pkg/cfn/outputs

65a47cc

Respond to review comments

94e5618

1. Change public/private message output to be consitent throughout all messages 1. Compare cluster endpoints using json.Marshal instead of json.MarshalIndent

Rework CLI to use current cluster values for endpoints

7eec6d8

- values not explicitly passed will get current values - moved validation checks further down to not cut off display of new values

update readme with examples of different ways of using flags

634d1e5

More tests, fixes and refactoring

4a20215

respond to review comment

d8a531b

refactor: Return early and capitalization consistency

c4b9260

refactor: Use error vars for validation

5aac9b4

refactor: Comments and simplification

f147f3e

Update readme

a084e7c

- remove `--approve` from sample (to prevent accidental execution) - remove non-value example to prevent confusion

Cleanup tests

dc11d25

D3nn force-pushed the toggle-public-private-endpoint-access branch 2 times, most recently from 253e213 to dc11d25 Compare October 9, 2019 00:27

rndstr approved these changes Oct 9, 2019

View reviewed changes

D3nn merged commit 37106d3 into master Oct 9, 2019

D3nn deleted the toggle-public-private-endpoint-access branch October 9, 2019 00:47

morinap mentioned this pull request Oct 10, 2019

Support Private/Public Endpoints #649

Closed

whereisaaron mentioned this pull request Oct 21, 2019

Website documentation missing the public/private endpoint section #1469

Closed

ota42y mentioned this pull request Dec 23, 2019

Support public/private API endpoints settings from file #1693

Merged

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Enable management of access to public/private API endpoints #1149

Enable management of access to public/private API endpoints #1149

D3nn commented Aug 15, 2019 •

edited

Loading

martina-if left a comment

D3nn commented Aug 16, 2019 via email

rndstr left a comment •

edited

Loading

errordeveloper commented Aug 30, 2019 •

edited

Loading

errordeveloper commented Aug 30, 2019

D3nn commented Aug 30, 2019

D3nn commented Sep 3, 2019

InAnimaTe commented Sep 6, 2019

Enable management of access to public/private API endpoints #1149

Enable management of access to public/private API endpoints #1149

Conversation

D3nn commented Aug 15, 2019 • edited Loading

Description

Checklist

martina-if left a comment

Choose a reason for hiding this comment

D3nn commented Aug 16, 2019 via email

rndstr left a comment • edited Loading

Choose a reason for hiding this comment

errordeveloper commented Aug 30, 2019 • edited Loading

errordeveloper commented Aug 30, 2019

D3nn commented Aug 30, 2019

D3nn commented Sep 3, 2019

InAnimaTe commented Sep 6, 2019

D3nn commented Aug 15, 2019 •

edited

Loading

rndstr left a comment •

edited

Loading

errordeveloper commented Aug 30, 2019 •

edited

Loading