@pulumi/eks 2.6.0-alpha.1717448271 → 2.6.0

package/authenticationMode.d.ts

@@ -0,0 +1,24 @@
+import * as aws from "@pulumi/aws";
+import * as pulumi from "@pulumi/pulumi";
+import { AccessEntry, ClusterOptions, RoleMapping, UserMapping } from "./cluster";
+export declare const CONFIG_MAP = "CONFIG_MAP";
+export declare const API_AND_CONFIG_MAP = "API_AND_CONFIG_MAP";
+export declare const API = "API";
+export declare function validateAuthenticationMode(args: ClusterOptions): void;
+export declare function supportsConfigMap(authenticationMode: string | undefined): boolean;
+export declare function supportsAccessEntries(authenticationMode: string | undefined): boolean;
+/**
+ * Creates the AWS authentication data for the aws-auth ConfigMap.
+ *
+ * @param instanceRoles - The instance roles to be mapped.
+ * @param roleMappings - The IAM role mappings to be included.
+ * @param userMappings - The IAM user mappings to be included.
+ * @returns The AWS authentication data for the aws-auth ConfigMap.
+ * @throws Error if the IAM role mappings or user mappings are invalid or cannot be serialized to YAML.
+ */
+export declare function createAwsAuthData(instanceRoles: pulumi.Output<aws.iam.Role[]>, roleMappings: pulumi.Input<pulumi.Input<RoleMapping>[]> | undefined, userMappings: pulumi.Input<pulumi.Input<UserMapping>[]> | undefined): pulumi.Input<{
+    [key: string]: pulumi.Input<string>;
+}>;
+export declare function createAccessEntries(componentName: string, clusterName: pulumi.Input<string>, accessEntries: {
+    [key: string]: AccessEntry;
+}, opts: pulumi.CustomResourceOptions): aws.eks.AccessEntry[];

package/authenticationMode.js

@@ -0,0 +1,142 @@
+"use strict";
+// Copyright 2016-2024, Pulumi Corporation.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAccessEntries = exports.createAwsAuthData = exports.supportsAccessEntries = exports.supportsConfigMap = exports.validateAuthenticationMode = exports.API = exports.API_AND_CONFIG_MAP = exports.CONFIG_MAP = void 0;
+const aws = require("@pulumi/aws");
+const pulumi = require("@pulumi/pulumi");
+const jsyaml = require("js-yaml");
+exports.CONFIG_MAP = "CONFIG_MAP";
+exports.API_AND_CONFIG_MAP = "API_AND_CONFIG_MAP";
+exports.API = "API";
+function validateAuthenticationMode(args) {
+    if (args.authenticationMode &&
+        args.authenticationMode !== exports.CONFIG_MAP &&
+        args.authenticationMode !== exports.API_AND_CONFIG_MAP &&
+        args.authenticationMode !== exports.API) {
+        throw new Error(`Invalid value for authenticationMode: ${args.authenticationMode}. Allowed values are: ${exports.CONFIG_MAP}, ${exports.API_AND_CONFIG_MAP}, ${exports.API}.`);
+    }
+    const configMapOnlyProperties = [
+        "roleMappings",
+        "userMappings",
+        "instanceRoles",
+    ];
+    const apiOnlyProperties = ["accessEntries"];
+    if (!supportsConfigMap(args.authenticationMode)) {
+        configMapOnlyProperties.forEach((prop) => {
+            if (args[prop]) {
+                throw new Error(`The '${prop}' property is not supported when 'authenticationMode' is set to '${args.authenticationMode}'.`);
+            }
+        });
+    }
+    if (!supportsAccessEntries(args.authenticationMode)) {
+        apiOnlyProperties.forEach((prop) => {
+            if (args[prop]) {
+                const errorMsg = args.authenticationMode != null
+                    ? `set to '${args.authenticationMode}'`
+                    : "not set";
+                throw new Error(`The '${prop}' property is not supported when 'authenticationMode' is ${errorMsg}.`);
+            }
+        });
+    }
+}
+exports.validateAuthenticationMode = validateAuthenticationMode;
+function supportsConfigMap(authenticationMode) {
+    // If authenticationMode is not provided, it defaults to CONFIG_MAP
+    return (!authenticationMode ||
+        authenticationMode === exports.CONFIG_MAP ||
+        authenticationMode === exports.API_AND_CONFIG_MAP);
+}
+exports.supportsConfigMap = supportsConfigMap;
+function supportsAccessEntries(authenticationMode) {
+    return authenticationMode === exports.API || authenticationMode === exports.API_AND_CONFIG_MAP;
+}
+exports.supportsAccessEntries = supportsAccessEntries;
+/**
+ * Creates the AWS authentication data for the aws-auth ConfigMap.
+ *
+ * @param instanceRoles - The instance roles to be mapped.
+ * @param roleMappings - The IAM role mappings to be included.
+ * @param userMappings - The IAM user mappings to be included.
+ * @returns The AWS authentication data for the aws-auth ConfigMap.
+ * @throws Error if the IAM role mappings or user mappings are invalid or cannot be serialized to YAML.
+ */
+function createAwsAuthData(instanceRoles, roleMappings, userMappings) {
+    const instanceRoleMappings = instanceRoles.apply((roles) => roles.map((role) => createInstanceRoleMapping(role.arn)));
+    const mapRoles = pulumi
+        .all([pulumi.output(roleMappings || []), instanceRoleMappings])
+        .apply(([mappings, instanceMappings]) => {
+        let mappingYaml = "";
+        try {
+            mappingYaml = jsyaml.dump([...mappings, ...instanceMappings].map((m) => ({
+                rolearn: m.roleArn,
+                username: m.username,
+                groups: m.groups,
+            })));
+        }
+        catch (e) {
+            throw new Error(`The IAM role mappings provided could not be properly serialized to YAML for the aws-auth ConfigMap`);
+        }
+        return mappingYaml;
+    });
+    const nodeAccessData = {
+        mapRoles: mapRoles,
+    };
+    if (userMappings) {
+        nodeAccessData.mapUsers = pulumi.output(userMappings).apply((mappings) => {
+            let mappingYaml = "";
+            try {
+                mappingYaml = jsyaml.dump(mappings.map((m) => ({
+                    userarn: m.userArn,
+                    username: m.username,
+                    groups: m.groups,
+                })));
+            }
+            catch (e) {
+                throw new Error(`The IAM user mappings provided could not be properly serialized to YAML for the aws-auth ConfigMap`);
+            }
+            return mappingYaml;
+        });
+    }
+    return nodeAccessData;
+}
+exports.createAwsAuthData = createAwsAuthData;
+function createAccessEntries(componentName, clusterName, accessEntries, opts) {
+    return Object.entries(accessEntries).map(([name, accessEntry]) => {
+        const entry = new aws.eks.AccessEntry(`${componentName}-${name}`, Object.assign(Object.assign({}, accessEntry), { clusterName, userName: accessEntry.username }), opts);
+        Object.entries(accessEntry.accessPolicies || {}).map(([associationName, association]) => {
+            const associationOutput = pulumi.output(association);
+            const policyAssociation = new aws.eks.AccessPolicyAssociation(`${componentName}-${name}-${associationName}`, {
+                accessScope: associationOutput.accessScope,
+                principalArn: accessEntry.principalArn,
+                policyArn: associationOutput.policyArn,
+                clusterName,
+            }, Object.assign(Object.assign({}, opts), { parent: entry, dependsOn: [entry] }));
+        });
+        return entry;
+    });
+}
+exports.createAccessEntries = createAccessEntries;
+/**
+ * Enable access to the EKS cluster for worker nodes, by creating an
+ * instance role mapping to the k8s username and groups of aws-auth.
+ */
+function createInstanceRoleMapping(arn) {
+    return {
+        roleArn: arn,
+        username: "system:node:{{EC2PrivateDNSName}}",
+        groups: ["system:bootstrappers", "system:nodes"],
+    };
+}
+//# sourceMappingURL=authenticationMode.js.map

package/authenticationMode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticationMode.js","sourceRoot":"","sources":["../authenticationMode.ts"],"names":[],"mappings":";AAAA,2CAA2C;AAC3C,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;;;AAEjC,mCAAmC;AACnC,yCAAyC;AAEzC,kCAAkC;AAGrB,QAAA,UAAU,GAAG,YAAY,CAAC;AAC1B,QAAA,kBAAkB,GAAG,oBAAoB,CAAC;AAC1C,QAAA,GAAG,GAAG,KAAK,CAAC;AAEzB,SAAgB,0BAA0B,CAAC,IAAoB;IAC3D,IACI,IAAI,CAAC,kBAAkB;QACvB,IAAI,CAAC,kBAAkB,KAAK,kBAAU;QACtC,IAAI,CAAC,kBAAkB,KAAK,0BAAkB;QAC9C,IAAI,CAAC,kBAAkB,KAAK,WAAG,EACjC;QACE,MAAM,IAAI,KAAK,CACX,yCAAyC,IAAI,CAAC,kBAAkB,yBAAyB,kBAAU,KAAK,0BAAkB,KAAK,WAAG,GAAG,CACxI,CAAC;KACL;IAED,MAAM,uBAAuB,GAA6B;QACtD,cAAc;QACd,cAAc;QACd,eAAe;KAClB,CAAC;IACF,MAAM,iBAAiB,GAA6B,CAAC,eAAe,CAAC,CAAC;IAEtE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE;QAC7C,uBAAuB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YACrC,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE;gBACZ,MAAM,IAAI,KAAK,CACX,QAAQ,IAAI,oEAAoE,IAAI,CAAC,kBAAkB,IAAI,CAC9G,CAAC;aACL;QACL,CAAC,CAAC,CAAC;KACN;IAED,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE;QACjD,iBAAiB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;YAC/B,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE;gBACZ,MAAM,QAAQ,GACV,IAAI,CAAC,kBAAkB,IAAI,IAAI;oBAC3B,CAAC,CAAC,WAAW,IAAI,CAAC,kBAAkB,GAAG;oBACvC,CAAC,CAAC,SAAS,CAAC;gBACpB,MAAM,IAAI,KAAK,CACX,QAAQ,IAAI,4DAA4D,QAAQ,GAAG,CACtF,CAAC;aACL;QACL,CAAC,CAAC,CAAC;KACN;AACL,CAAC;AA1CD,gEA0CC;AAED,SAAgB,iBAAiB,CAAC,kBAAsC;IACpE,mEAAmE;IACnE,OAAO,CACH,CAAC,kBAAkB;QACnB,kBAAkB,KAAK,kBAAU;QACjC,kBAAkB,KAAK,0BAAkB,CAC5C,CAAC;AACN,CAAC;AAPD,8CAOC;AAED,SAAgB,qBAAqB,CAAC,kBAAsC;IACxE,OAAO,kBAAkB,KAAK,WAAG,IAAI,kBAAkB,KAAK,0BAAkB,CAAC;AACnF,CAAC;AAFD,sDAEC;AAED;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAC7B,aAA4C,EAC5C,YAAmE,EACnE,YAAmE;IAEnE,MAAM,oBAAoB,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACvD,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAC3D,CAAC;IAEF,MAAM,QAAQ,GAAG,MAAM;SAClB,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,oBAAoB,CAAC,CAAC;SAC9D,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,EAAE;QACpC,IAAI,WAAW,GAAG,EAAE,CAAC;QACrB,IAAI;YACA,WAAW,GAAG,MAAM,CAAC,IAAI,CACrB,CAAC,GAAG,QAAQ,EAAE,GAAG,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3C,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,MAAM,EAAE,CAAC,CAAC,MAAM;aACnB,CAAC,CAAC,CACN,CAAC;SACL;QAAC,OAAO,CAAC,EAAE;YACR,MAAM,IAAI,KAAK,CACX,oGAAoG,CACvG,CAAC;SACL;QACD,OAAO,WAAW,CAAC;IACvB,CAAC,CAAC,CAAC;IAEP,MAAM,cAAc,GAAQ;QACxB,QAAQ,EAAE,QAAQ;KACrB,CAAC;IACF,IAAI,YAAY,EAAE;QACd,cAAc,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE;YACrE,IAAI,WAAW,GAAG,EAAE,CAAC;YACrB,IAAI;gBACA,WAAW,GAAG,MAAM,CAAC,IAAI,CACrB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACjB,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,MAAM,EAAE,CAAC,CAAC,MAAM;iBACnB,CAAC,CAAC,CACN,CAAC;aACL;YAAC,OAAO,CAAC,EAAE;gBACR,MAAM,IAAI,KAAK,CACX,oGAAoG,CACvG,CAAC;aACL;YACD,OAAO,WAAW,CAAC;QACvB,CAAC,CAAC,CAAC;KACN;IACD,OAAO,cAAc,CAAC;AAC1B,CAAC;AApDD,8CAoDC;AAED,SAAgB,mBAAmB,CAC/B,aAAqB,EACrB,WAAiC,EACjC,aAA6C,EAC7C,IAAkC;IAElC,OAAO,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE;QAC7D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CACjC,GAAG,aAAa,IAAI,IAAI,EAAE,kCAEnB,WAAW,KACd,WAAW,EACX,QAAQ,EAAE,WAAW,CAAC,QAAQ,KAElC,IAAI,CACP,CAAC;QAEF,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,EAAE,WAAW,CAAC,EAAE,EAAE;YACpF,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACrD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,uBAAuB,CACzD,GAAG,aAAa,IAAI,IAAI,IAAI,eAAe,EAAE,EAC7C;gBACI,WAAW,EAAE,iBAAiB,CAAC,WAAW;gBAC1C,YAAY,EAAE,WAAW,CAAC,YAAY;gBACtC,SAAS,EAAE,iBAAiB,CAAC,SAAS;gBACtC,WAAW;aACd,kCAEM,IAAI,KACP,MAAM,EAAE,KAAK,EACb,SAAS,EAAE,CAAC,KAAK,CAAC,IAEzB,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC;IACjB,CAAC,CAAC,CAAC;AACP,CAAC;AArCD,kDAqCC;AAED;;;GAGG;AACH,SAAS,yBAAyB,CAAC,GAAyB;IACxD,OAAO;QACH,OAAO,EAAE,GAAG;QACZ,QAAQ,EAAE,mCAAmC;QAC7C,MAAM,EAAE,CAAC,sBAAsB,EAAE,cAAc,CAAC;KACnD,CAAC;AACN,CAAC"}

package/cluster.d.ts

@@ -107,6 +107,7 @@ export interface CoreData {
     oidcProvider?: aws.iam.OpenIdConnectProvider;
     encryptionConfig?: pulumi.Output<aws.types.output.eks.ClusterEncryptionConfig>;
     clusterIamRole: pulumi.Output<aws.iam.Role>;
+    accessEntries?: pulumi.Output<aws.eks.AccessEntry[]>;
 }
 export interface ClusterCreationRoleProviderOptions {
     region?: pulumi.Input<aws.Region>;
@@ -231,10 +232,12 @@ export interface ClusterOptions {
     nodeAssociatePublicIpAddress?: boolean;
     /**
      * Optional mappings from AWS IAM roles to Kubernetes users and groups.
+     * Only supported with authentication mode `CONFIG_MAP` or `API_AND_CONFIG_MAP`.
      */
     roleMappings?: pulumi.Input<pulumi.Input<RoleMapping>[]>;
     /**
      * Optional mappings from AWS IAM users to Kubernetes users and groups.
+     * Only supported with authentication mode `CONFIG_MAP` or `API_AND_CONFIG_MAP`.
      */
     userMappings?: pulumi.Input<pulumi.Input<UserMapping>[]>;
     /**
@@ -274,6 +277,7 @@ export interface ClusterOptions {
     /**
      * This enables the advanced case of registering *many* IAM instance roles
      * with the cluster for per node group IAM, instead of the simpler, shared case of `instanceRole`.
+     * Only supported with authentication mode `CONFIG_MAP` or `API_AND_CONFIG_MAP`.
      *
      * Note: options `instanceRole` and `instanceRoles` are mutually exclusive.
      */
@@ -541,6 +545,20 @@ export interface ClusterOptions {
      * a new cluster to be created.
      */
     ipFamily?: pulumi.Input<string>;
+    /**
+     * The authentication mode of the cluster. Valid values are `CONFIG_MAP`, `API` or `API_AND_CONFIG_MAP`
+     * See for more details:\nhttps://docs.aws.amazon.com/eks/latest/userguide/grant-k8s-access.html#set-cam
+     */
+    authenticationMode?: AuthenticationMode;
+    /**
+     * Access entries to add to the EKS cluster. They can be used to allow IAM principals to access the cluster.
+     * Access entries are only supported with authentication mode `API` or `API_AND_CONFIG_MAP`.
+     *
+     * See for more details:\nhttps://docs.aws.amazon.com/eks/latest/userguide/access-entries.html
+     */
+    accessEntries?: {
+        [key: string]: AccessEntry;
+    };
 }
 /**
  * FargateProfile defines how Kubernetes pods are executed in Fargate. See
@@ -568,6 +586,89 @@ export interface FargateProfile {
  */
 export interface ClusterNodeGroupOptions extends NodeGroupBaseOptions {
 }
+export interface AccessEntry {
+    /**
+     * The IAM Principal ARN which requires Authentication access to the EKS cluster.
+     */
+    principalArn: pulumi.Input<string>;
+    /**
+     * Defaults to the principalArn if the principal is a user, else defaults to assume-role/session-name.
+     */
+    username?: pulumi.Input<string>;
+    /**
+     * A list of groups within Kubernetes to which the IAM principal is mapped to.
+     */
+    kubernetesGroups?: pulumi.Input<pulumi.Input<string>[]>;
+    /**
+     * The access policies to associate to the access entry.
+     */
+    accessPolicies?: {
+        [key: string]: pulumi.Input<AccessPolicyAssociation>;
+    };
+    /**
+     * The tags to apply to the AccessEntry.
+     */
+    tags?: InputTags;
+    /**
+     * The type of the new access entry. Valid values are STANDARD, FARGATE_LINUX, EC2_LINUX, and EC2_WINDOWS.
+     *
+     * Defaults to STANDARD which provides the standard workflow. EC2_LINUX and EC2_WINDOWS types disallow users
+     * to input a kubernetesGroup, and prevent associating access policies..
+     */
+    type?: pulumi.Input<AccessEntryType>;
+}
+export interface AccessPolicyAssociation {
+    /**
+     * The ARN of the access policy to associate with the principal
+     */
+    policyArn: pulumi.Input<string>;
+    /**
+     * The scope of the access policy association. This controls whether the access policy is scoped to the cluster or to a particular namespace.
+     */
+    accessScope: aws.types.input.eks.AccessPolicyAssociationAccessScope;
+}
+export declare const AuthenticationMode: {
+    /**
+     * Only Access Entries will be used for authenticating to the Kubernetes API.
+     */
+    readonly API: "API";
+    /**
+     * Only aws-auth ConfigMap will be used for authenticating to the Kubernetes API.
+     */
+    readonly CONFIG_MAP: "CONFIG_MAP";
+    /**
+     * Both aws-auth ConfigMap and Access Entries can be used for authenticating to the Kubernetes API.
+     */
+    readonly API_AND_CONFIG_MAP: "API_AND_CONFIG_MAP";
+};
+/**
+ * The authentication mode of the cluster. Valid values are `CONFIG_MAP`, `API` or `API_AND_CONFIG_MAP`
+ * See for more details:\nhttps://docs.aws.amazon.com/eks/latest/userguide/grant-k8s-access.html#set-cam
+ */
+export type AuthenticationMode = (typeof AuthenticationMode)[keyof typeof AuthenticationMode];
+export declare const AccessEntryType: {
+    /**
+     * Standard Access Entry Workflow. Allows users to input a username and kubernetesGroup, and to associate access policies.
+     */
+    readonly STANDARD: "STANDARD";
+    /**
+     * For IAM roles used with AWS Fargate profiles.
+     */
+    readonly FARGATE_LINUX: "FARGATE_LINUX";
+    /**
+     * For IAM roles associated with self-managed Linux node groups. Allows the nodes to join the cluster.
+     */
+    readonly EC2_LINUX: "EC2_LINUX";
+    /**
+     * For IAM roles associated with self-managed Windows node groups. Allows the nodes to join the cluster.
+     */
+    readonly EC2_WINDOWS: "EC2_WINDOWS";
+};
+/**
+ * The authentication mode of the cluster. Valid values are `CONFIG_MAP`, `API` or `API_AND_CONFIG_MAP`
+ * See for more details:\nhttps://docs.aws.amazon.com/eks/latest/userguide/grant-k8s-access.html#set-cam
+ */
+export type AccessEntryType = (typeof AccessEntryType)[keyof typeof AccessEntryType];
 /**
  * Cluster is a component that wraps the AWS and Kubernetes resources necessary to run an EKS cluster, its worker
  * nodes, its optional StorageClasses, and an optional deployment of the Kubernetes Dashboard.

package/cluster.js

@@ -22,7 +22,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ClusterInternal = exports.createCluster = exports.Cluster = exports.createCore = exports.getRoleProvider = exports.ClusterCreationRoleProvider = exports.generateKubeconfig = void 0;
+exports.ClusterInternal = exports.createCluster = exports.Cluster = exports.AccessEntryType = exports.AuthenticationMode = exports.createCore = exports.getRoleProvider = exports.ClusterCreationRoleProvider = exports.generateKubeconfig = void 0;
 const aws = require("@pulumi/aws");
 const k8s = require("@pulumi/kubernetes");
 const pulumi = require("@pulumi/pulumi");
@@ -30,10 +30,10 @@ const childProcess = require("child_process");
 const fs = require("fs");
 const https = require("https");
 const HttpsProxyAgent = require("https-proxy-agent");
-const jsyaml = require("js-yaml");
 const process = require("process");
 const tmp = require("tmp");
 const url = require("url");
+const authenticationMode_1 = require("./authenticationMode");
 const cert_thumprint_1 = require("./cert-thumprint");
 const cni_1 = require("./cni");
 const dashboard_1 = require("./dashboard");
@@ -206,6 +206,7 @@ function createCore(name, args, parent, provider) {
     // Check to ensure that a compatible kubectl is installed, as we'll need it in order to deploy
     // k8s resources later.
     (0, dependencies_1.assertCompatibleKubectlVersionExists)();
+    (0, authenticationMode_1.validateAuthenticationMode)(args);
     if (args.instanceRole && args.instanceRoles) {
         throw new Error("instanceRole and instanceRoles are mutually exclusive, and cannot both be set.");
     }
@@ -346,6 +347,15 @@ function createCore(name, args, parent, provider) {
         tags: pulumi.all([args.tags, args.clusterTags]).apply(([tags, clusterTags]) => (Object.assign(Object.assign({ Name: `${name}-eksCluster` }, clusterTags), tags))),
         encryptionConfig,
         kubernetesNetworkConfig,
+        accessConfig: args.authenticationMode
+            ? {
+                authenticationMode: args.authenticationMode,
+                // Explicitely grants the principal creating the cluster admin access to the cluster.
+                // This is the default behavior of EKS when no accessConfig is provided.
+                // It is required for this component because it deploys charts to the cluster.
+                bootstrapClusterCreatorAdminPermissions: true,
+            }
+            : undefined,
     }, {
         parent,
         provider: args.creationRoleProvider ? args.creationRoleProvider.provider : provider,
@@ -450,13 +460,10 @@ function createCore(name, args, parent, provider) {
     if (!args.useDefaultVpcCni) {
         vpcCni = new cni_1.VpcCni(`${name}-vpc-cni`, kubeconfig.apply(JSON.stringify), args.vpcCniOptions, { parent });
     }
-    let instanceRoleMappings;
     let instanceRoles;
+    let defaultInstanceRole;
     // Create role mappings of the instance roles specified for aws-auth.
     if (args.instanceRoles) {
-        instanceRoleMappings = pulumi
-            .output(args.instanceRoles)
-            .apply((roles) => roles.map((role) => createInstanceRoleMapping(role.arn)));
         instanceRoles = pulumi.output(args.instanceRoles);
     }
     else if (args.instanceRole) {
@@ -464,10 +471,8 @@ function createCore(name, args, parent, provider) {
         if (!skipDefaultNodeGroup) {
             nodeGroupOptions.instanceProfile = createOrGetInstanceProfile(name, parent, args.instanceRole, args.instanceProfileName);
         }
-        instanceRoleMappings = pulumi
-            .output(args.instanceRole)
-            .apply((instanceRole) => [createInstanceRoleMapping(instanceRole.arn)]);
         instanceRoles = pulumi.output([args.instanceRole]);
+        defaultInstanceRole = pulumi.output(args.instanceRole);
     }
     else {
         const instanceRole = new servicerole_1.ServiceRole(`${name}-instanceRole`, {
@@ -487,6 +492,7 @@ function createCore(name, args, parent, provider) {
                 },
             ],
         }, { parent, provider }).role;
+        defaultInstanceRole = instanceRole;
         instanceRoles = pulumi.output([instanceRole]);
         // Create a new policy for the role, if specified.
         if (args.customInstanceRolePolicy) {
@@ -500,57 +506,44 @@ function createCore(name, args, parent, provider) {
         if (!skipDefaultNodeGroup) {
             nodeGroupOptions.instanceProfile = createOrGetInstanceProfile(name, parent, instanceRole, args.instanceProfileName);
         }
-        instanceRoleMappings = pulumi
-            .output(instanceRole)
-            .apply((role) => [createInstanceRoleMapping(role.arn)]);
-    }
-    const roleMappings = pulumi
-        .all([pulumi.output(args.roleMappings || []), instanceRoleMappings])
-        .apply(([mappings, instanceMappings]) => {
-        let mappingYaml = "";
-        try {
-            mappingYaml = jsyaml.dump([...mappings, ...instanceMappings].map((m) => ({
-                rolearn: m.roleArn,
-                username: m.username,
-                groups: m.groups,
-            })));
-        }
-        catch (e) {
-            throw new Error(`The IAM role mappings provided could not be properly serialized to YAML for the aws-auth ConfigMap`);
-        }
-        return mappingYaml;
-    });
-    const nodeAccessData = {
-        mapRoles: roleMappings,
-    };
-    if (args.userMappings) {
-        nodeAccessData.mapUsers = pulumi.output(args.userMappings).apply((mappings) => {
-            let mappingYaml = "";
-            try {
-                mappingYaml = jsyaml.dump(mappings.map((m) => ({
-                    userarn: m.userArn,
-                    username: m.username,
-                    groups: m.groups,
-                })));
-            }
-            catch (e) {
-                throw new Error(`The IAM user mappings provided could not be properly serialized to YAML for the aws-auth ConfigMap`);
-            }
-            return mappingYaml;
-        });
     }
-    const eksNodeAccess = new k8s.core.v1.ConfigMap(`${name}-nodeAccess`, {
-        apiVersion: "v1",
-        immutable: false,
-        metadata: {
-            name: `aws-auth`,
-            namespace: "kube-system",
-            annotations: {
-                "pulumi.com/patchForce": "true",
+    let eksNodeAccess = undefined;
+    if ((0, authenticationMode_1.supportsConfigMap)(args.authenticationMode)) {
+        // Create the aws-auth ConfigMap if the authentication mode supports it. This maps instance roles, regular IAM roles, and IAM users to
+        // Kubernetes RBAC users and groups.
+        const nodeAccessData = (0, authenticationMode_1.createAwsAuthData)(instanceRoles, args.roleMappings, args.userMappings);
+        eksNodeAccess = new k8s.core.v1.ConfigMap(`${name}-nodeAccess`, {
+            apiVersion: "v1",
+            immutable: false,
+            metadata: {
+                name: `aws-auth`,
+                namespace: "kube-system",
+                annotations: {
+                    "pulumi.com/patchForce": "true",
+                },
             },
-        },
-        data: nodeAccessData,
-    }, { parent, provider: k8sProvider });
+            data: nodeAccessData,
+        }, { parent, provider: k8sProvider });
+    }
+    // Create the access entries if the authentication mode supports it.
+    let accessEntries = undefined;
+    if ((0, authenticationMode_1.supportsAccessEntries)(args.authenticationMode)) {
+        let createdAccessEntries = [];
+        // This additionally maps the defaultInstanceRole to a EC2_LINUX access entry which allows the nodes to register & communicate with the EKS control plane.
+        if (defaultInstanceRole) {
+            createdAccessEntries = (0, authenticationMode_1.createAccessEntries)(name, eksCluster.name, {
+                defaultNodeGroupInstanceRole: {
+                    principalArn: defaultInstanceRole.arn,
+                    type: exports.AccessEntryType.EC2_LINUX,
+                },
+            }, { parent, provider });
+        }
+        createdAccessEntries = createdAccessEntries.concat((0, authenticationMode_1.createAccessEntries)(name, eksCluster.name, args.accessEntries || {}, {
+            parent,
+            provider,
+        }));
+        accessEntries = pulumi.output(createdAccessEntries);
+    }
     const fargateProfile = pulumi
         .output(args.fargate)
         .apply((argsFargate) => {
@@ -597,7 +590,7 @@ function createCore(name, args, parent, provider) {
                         return (0, nodegroup_1.computeWorkerSubnets)(parent, subnets);
                     }
                 }),
-            }, { parent, dependsOn: [eksNodeAccess], provider });
+            }, { parent, dependsOn: eksNodeAccess ? [eksNodeAccess] : undefined, provider });
             // Once the FargateProfile has been created, try to patch/remove the CoreDNS computeType annotation.  See
             // https://docs.aws.amazon.com/eks/latest/userguide/fargate-getting-started.html#fargate-gs-coredns.
             pulumi.all([result.id, selectors, kubeconfig]).apply(([_, sels, kconfig]) => {
@@ -680,20 +673,10 @@ function createCore(name, args, parent, provider) {
         oidcProvider: oidcProvider,
         encryptionConfig: encryptionConfig,
         clusterIamRole: eksRole,
+        accessEntries: accessEntries,
     };
 }
 exports.createCore = createCore;
-/**
- * Enable access to the EKS cluster for worker nodes, by creating an
- * instance role mapping to the k8s username and groups of aws-auth.
- */
-function createInstanceRoleMapping(arn) {
-    return {
-        roleArn: arn,
-        username: "system:node:{{EC2PrivateDNSName}}",
-        groups: ["system:bootstrappers", "system:nodes"],
-    };
-}
 /**
  * Create an HTTP Agent for use with HTTP(S) requests.
  * Using a proxy is supported.
@@ -732,6 +715,40 @@ function createHttpAgent(proxy) {
         maxCachedSessions: 0,
     });
 }
+/* tslint:disable-next-line */ // Generating the enum object for AuthenticationMode like codegen does
+exports.AuthenticationMode = {
+    /**
+     * Only Access Entries will be used for authenticating to the Kubernetes API.
+     */
+    API: "API",
+    /**
+     * Only aws-auth ConfigMap will be used for authenticating to the Kubernetes API.
+     */
+    CONFIG_MAP: "CONFIG_MAP",
+    /**
+     * Both aws-auth ConfigMap and Access Entries can be used for authenticating to the Kubernetes API.
+     */
+    API_AND_CONFIG_MAP: "API_AND_CONFIG_MAP",
+};
+/* tslint:disable-next-line */ // Generating the enum object for AccessEntryType like codegen does
+exports.AccessEntryType = {
+    /**
+     * Standard Access Entry Workflow. Allows users to input a username and kubernetesGroup, and to associate access policies.
+     */
+    STANDARD: "STANDARD",
+    /**
+     * For IAM roles used with AWS Fargate profiles.
+     */
+    FARGATE_LINUX: "FARGATE_LINUX",
+    /**
+     * For IAM roles associated with self-managed Linux node groups. Allows the nodes to join the cluster.
+     */
+    EC2_LINUX: "EC2_LINUX",
+    /**
+     * For IAM roles associated with self-managed Windows node groups. Allows the nodes to join the cluster.
+     */
+    EC2_WINDOWS: "EC2_WINDOWS",
+};
 /**
  * Cluster is a component that wraps the AWS and Kubernetes resources necessary to run an EKS cluster, its worker
  * nodes, its optional StorageClasses, and an optional deployment of the Kubernetes Dashboard.