@pulumi/eks 2.8.1 → 3.0.0-alpha.6

package/cmd/provider/securitygroup.d.ts

@@ -1 +0,0 @@
-export {};

package/cmd/provider/securitygroup.js

@@ -1,41 +0,0 @@
-"use strict";
-// Copyright 2016-2020, Pulumi Corporation.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.nodeGroupSecurityGroupProviderFactory = void 0;
-const securitygroup_1 = require("../../securitygroup");
-const nodeGroupSecurityGroupProvider = {
-    construct: (name, type, inputs, options) => {
-        try {
-            const nodeGroupSecurityGroup = new securitygroup_1.NodeGroupSecurityGroup(name, inputs, options);
-            return Promise.resolve({
-                urn: nodeGroupSecurityGroup.urn,
-                state: {
-                    securityGroup: nodeGroupSecurityGroup.securityGroup,
-                    securityGroupRule: nodeGroupSecurityGroup.securityGroupRule,
-                },
-            });
-        }
-        catch (e) {
-            return Promise.reject(e);
-        }
-    },
-    version: "", // ignored
-};
-/** @internal */
-function nodeGroupSecurityGroupProviderFactory() {
-    return nodeGroupSecurityGroupProvider;
-}
-exports.nodeGroupSecurityGroupProviderFactory = nodeGroupSecurityGroupProviderFactory;
-//# sourceMappingURL=securitygroup.js.map

package/cmd/provider/securitygroup.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"securitygroup.js","sourceRoot":"","sources":["../../../cmd/provider/securitygroup.ts"],"names":[],"mappings":";AAAA,2CAA2C;AAC3C,EAAE;AACF,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;;;AAGjC,uDAA6D;AAE7D,MAAM,8BAA8B,GAA6B;IAC7D,SAAS,EAAE,CACP,IAAY,EACZ,IAAY,EACZ,MAAqB,EACrB,OAAwC,EAC1C,EAAE;QACA,IAAI;YACA,MAAM,sBAAsB,GAAG,IAAI,sCAAsB,CAAC,IAAI,EAAO,MAAM,EAAE,OAAO,CAAC,CAAC;YACtF,OAAO,OAAO,CAAC,OAAO,CAAC;gBACnB,GAAG,EAAE,sBAAsB,CAAC,GAAG;gBAC/B,KAAK,EAAE;oBACH,aAAa,EAAE,sBAAsB,CAAC,aAAa;oBACnD,iBAAiB,EAAE,sBAAsB,CAAC,iBAAiB;iBAC9D;aACJ,CAAC,CAAC;SACN;QAAC,OAAO,CAAC,EAAE;YACR,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;SAC5B;IACL,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,UAAU;CAC1B,CAAC;AAEF,gBAAgB;AAChB,SAAgB,qCAAqC;IACjD,OAAO,8BAA8B,CAAC;AAC1C,CAAC;AAFD,sFAEC"}

package/cni/README.md

@@ -1,6 +0,0 @@
-The CNI manfiest used has divergence between the
-[upstream CNI](https://github.com/aws/amazon-vpc-cni-k8s/blob/v1.16.0/config/master/aws-k8s-cni.yaml),
-Pulumi's [approach](https://github.com/pulumi/pulumi-eks/blob/master/nodejs/eks/cni/aws-k8s-cni.yaml),
-and what AWS does by [default](https://github.com/aws/amazon-vpc-cni-k8s/issues/755) for Fargate clusters.
-
-Pulumi's fork of the manifest removes certain lines from the upstream manifest. This is showcased in our forked copy by commenting out such lines.

package/cni/aws-k8s-cni.yaml

@@ -1,602 +0,0 @@
-# Adapted from: https://raw.githubusercontent.com/aws/amazon-vpc-cni-k8s/v1.16.0/config/master/aws-k8s-cni.yaml
-# Configuration that differs from upstream are commented out.
----
-# Source: aws-vpc-cni/crds/customresourcedefinition.yaml
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-    name: eniconfigs.crd.k8s.amazonaws.com
-spec:
-    scope: Cluster
-    group: crd.k8s.amazonaws.com
-    preserveUnknownFields: false
-    versions:
-        - name: v1alpha1
-          served: true
-          storage: true
-          schema:
-              openAPIV3Schema:
-                  type: object
-                  x-kubernetes-preserve-unknown-fields: true
-    names:
-        plural: eniconfigs
-        singular: eniconfig
-        kind: ENIConfig
----
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-    annotations:
-        controller-gen.kubebuilder.io/version: v0.11.3
-    creationTimestamp: null
-    labels:
-        app.kubernetes.io/name: amazon-network-policy-controller-k8s
-    name: policyendpoints.networking.k8s.aws
-spec:
-    group: networking.k8s.aws
-    names:
-        kind: PolicyEndpoint
-        listKind: PolicyEndpointList
-        plural: policyendpoints
-        singular: policyendpoint
-    scope: Namespaced
-    versions:
-        - name: v1alpha1
-          schema:
-              openAPIV3Schema:
-                  description: PolicyEndpoint is the Schema for the policyendpoints API
-                  properties:
-                      apiVersion:
-                          description:
-                              "APIVersion defines the versioned schema of this representation
-                              of an object. Servers should convert recognized schemas to the latest
-                              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
-                          type: string
-                      kind:
-                          description: "Kind is a string value representing the REST resource this
-                              object represents. Servers may infer this from the endpoint the client
-                              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
-                          type: string
-                      metadata:
-                          type: object
-                      spec:
-                          description: PolicyEndpointSpec defines the desired state of PolicyEndpoint
-                          properties:
-                              egress:
-                                  description:
-                                      Egress is the list of egress rules containing resolved
-                                      network addresses
-                                  items:
-                                      description:
-                                          EndpointInfo defines the network endpoint information
-                                          for the policy ingress/egress
-                                      properties:
-                                          cidr:
-                                              description: CIDR is the network address(s) of the endpoint
-                                              type: string
-                                          except:
-                                              description:
-                                                  Except is the exceptions to the CIDR ranges mentioned
-                                                  above.
-                                              items:
-                                                  type: string
-                                              type: array
-                                          ports:
-                                              description: Ports is the list of ports
-                                              items:
-                                                  description:
-                                                      Port contains information about the transport
-                                                      port/protocol
-                                                  properties:
-                                                      endPort:
-                                                          description:
-                                                              Endport specifies the port range port to
-                                                              endPort port must be defined and an integer, endPort
-                                                              > port
-                                                          format: int32
-                                                          type: integer
-                                                      port:
-                                                          description:
-                                                              Port specifies the numerical port for the
-                                                              protocol. If empty applies to all ports
-                                                          format: int32
-                                                          type: integer
-                                                      protocol:
-                                                          default: TCP
-                                                          description:
-                                                              Protocol specifies the transport protocol,
-                                                              default TCP
-                                                          type: string
-                                                  type: object
-                                              type: array
-                                      required:
-                                          - cidr
-                                      type: object
-                                  type: array
-                              ingress:
-                                  description:
-                                      Ingress is the list of ingress rules containing resolved
-                                      network addresses
-                                  items:
-                                      description:
-                                          EndpointInfo defines the network endpoint information
-                                          for the policy ingress/egress
-                                      properties:
-                                          cidr:
-                                              description: CIDR is the network address(s) of the endpoint
-                                              type: string
-                                          except:
-                                              description:
-                                                  Except is the exceptions to the CIDR ranges mentioned
-                                                  above.
-                                              items:
-                                                  type: string
-                                              type: array
-                                          ports:
-                                              description: Ports is the list of ports
-                                              items:
-                                                  description:
-                                                      Port contains information about the transport
-                                                      port/protocol
-                                                  properties:
-                                                      endPort:
-                                                          description:
-                                                              Endport specifies the port range port to
-                                                              endPort port must be defined and an integer, endPort
-                                                              > port
-                                                          format: int32
-                                                          type: integer
-                                                      port:
-                                                          description:
-                                                              Port specifies the numerical port for the
-                                                              protocol. If empty applies to all ports
-                                                          format: int32
-                                                          type: integer
-                                                      protocol:
-                                                          default: TCP
-                                                          description:
-                                                              Protocol specifies the transport protocol,
-                                                              default TCP
-                                                          type: string
-                                                  type: object
-                                              type: array
-                                      required:
-                                          - cidr
-                                      type: object
-                                  type: array
-                              podIsolation:
-                                  description:
-                                      PodIsolation specifies whether the pod needs to be isolated
-                                      for a particular traffic direction Ingress or Egress, or both. If
-                                      default isolation is not specified, and there are no ingress/egress
-                                      rules, then the pod is not isolated from the point of view of this
-                                      policy. This follows the NetworkPolicy spec.PolicyTypes.
-                                  items:
-                                      description:
-                                          PolicyType string describes the NetworkPolicy type
-                                          This type is beta-level in 1.8
-                                      type: string
-                                  type: array
-                              podSelector:
-                                  description: PodSelector is the podSelector from the policy resource
-                                  properties:
-                                      matchExpressions:
-                                          description:
-                                              matchExpressions is a list of label selector requirements.
-                                              The requirements are ANDed.
-                                          items:
-                                              description:
-                                                  A label selector requirement is a selector that
-                                                  contains values, a key, and an operator that relates the key
-                                                  and values.
-                                              properties:
-                                                  key:
-                                                      description:
-                                                          key is the label key that the selector applies
-                                                          to.
-                                                      type: string
-                                                  operator:
-                                                      description:
-                                                          operator represents a key's relationship to
-                                                          a set of values. Valid operators are In, NotIn, Exists
-                                                          and DoesNotExist.
-                                                      type: string
-                                                  values:
-                                                      description:
-                                                          values is an array of string values. If the
-                                                          operator is In or NotIn, the values array must be non-empty.
-                                                          If the operator is Exists or DoesNotExist, the values
-                                                          array must be empty. This array is replaced during a strategic
-                                                          merge patch.
-                                                      items:
-                                                          type: string
-                                                      type: array
-                                              required:
-                                                  - key
-                                                  - operator
-                                              type: object
-                                          type: array
-                                      matchLabels:
-                                          additionalProperties:
-                                              type: string
-                                          description:
-                                              matchLabels is a map of {key,value} pairs. A single
-                                              {key,value} in the matchLabels map is equivalent to an element
-                                              of matchExpressions, whose key field is "key", the operator
-                                              is "In", and the values array contains only "value". The requirements
-                                              are ANDed.
-                                          type: object
-                                  type: object
-                                  x-kubernetes-map-type: atomic
-                              podSelectorEndpoints:
-                                  description:
-                                      PodSelectorEndpoints contains information about the pods
-                                      matching the podSelector
-                                  items:
-                                      description:
-                                          PodEndpoint defines the summary information for the
-                                          pods
-                                      properties:
-                                          hostIP:
-                                              description:
-                                                  HostIP is the IP address of the host the pod is
-                                                  currently running on
-                                              type: string
-                                          name:
-                                              description: Name is the pod name
-                                              type: string
-                                          namespace:
-                                              description: Namespace is the pod namespace
-                                              type: string
-                                          podIP:
-                                              description: PodIP is the IP address of the pod
-                                              type: string
-                                      required:
-                                          - hostIP
-                                          - name
-                                          - namespace
-                                          - podIP
-                                      type: object
-                                  type: array
-                              policyRef:
-                                  description:
-                                      PolicyRef is a reference to the Kubernetes NetworkPolicy
-                                      resource.
-                                  properties:
-                                      name:
-                                          description: Name is the name of the Policy
-                                          type: string
-                                      namespace:
-                                          description: Namespace is the namespace of the Policy
-                                          type: string
-                                  required:
-                                      - name
-                                      - namespace
-                                  type: object
-                          required:
-                              - policyRef
-                          type: object
-                      status:
-                          description: PolicyEndpointStatus defines the observed state of PolicyEndpoint
-                          type: object
-                  type: object
-          served: true
-          storage: true
-          subresources:
-              status: {}
----
-# Source: aws-vpc-cni/templates/serviceaccount.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-    name: aws-node
-    namespace: kube-system
-    labels:
-        app.kubernetes.io/name: aws-node
-        app.kubernetes.io/instance: aws-vpc-cni
-        k8s-app: aws-node
-        app.kubernetes.io/version: "v1.16.0"
----
-# Source: aws-vpc-cni/templates/configmap.yaml
-apiVersion: v1
-kind: ConfigMap
-metadata:
-    name: amazon-vpc-cni
-    namespace: kube-system
-    labels:
-        app.kubernetes.io/name: aws-node
-        app.kubernetes.io/instance: aws-vpc-cni
-        k8s-app: aws-node
-        app.kubernetes.io/version: "v1.16.0"
-data:
-    enable-windows-ipam: "false"
-    enable-network-policy-controller: "false"
-    enable-windows-prefix-delegation: "false"
-    warm-prefix-target: "0"
-    warm-ip-target: "1"
-    minimum-ip-target: "3"
-    branch-eni-cooldown: "60"
----
-# Source: aws-vpc-cni/templates/clusterrole.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-    name: aws-node
-    labels:
-        app.kubernetes.io/name: aws-node
-        app.kubernetes.io/instance: aws-vpc-cni
-        k8s-app: aws-node
-        app.kubernetes.io/version: "v1.16.0"
-rules:
-    - apiGroups:
-          - crd.k8s.amazonaws.com
-      resources:
-          - eniconfigs
-      verbs: ["list", "watch", "get"]
-    - apiGroups: [""]
-      resources:
-          - namespaces
-      verbs: ["list", "watch", "get"]
-    - apiGroups: [""]
-      resources:
-          - pods
-      verbs: ["list", "watch", "get"]
-    - apiGroups: [""]
-      resources:
-          - nodes
-      verbs: ["list", "watch", "get"]
-    - apiGroups: ["", "events.k8s.io"]
-      resources:
-          - events
-      verbs: ["create", "patch", "list"]
-    - apiGroups: ["networking.k8s.aws"]
-      resources:
-          - policyendpoints
-      verbs: ["get", "list", "watch"]
-    - apiGroups: ["networking.k8s.aws"]
-      resources:
-          - policyendpoints/status
-      verbs: ["get"]
-    - apiGroups:
-          - vpcresources.k8s.aws
-      resources:
-          - cninodes
-      verbs: ["get", "list", "watch", "patch"]
----
-# Source: aws-vpc-cni/templates/clusterrolebinding.yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-    name: aws-node
-    labels:
-        app.kubernetes.io/name: aws-node
-        app.kubernetes.io/instance: aws-vpc-cni
-        k8s-app: aws-node
-        app.kubernetes.io/version: "v1.16.0"
-roleRef:
-    apiGroup: rbac.authorization.k8s.io
-    kind: ClusterRole
-    name: aws-node
-subjects:
-    - kind: ServiceAccount
-      name: aws-node
-      namespace: kube-system
----
-# Source: aws-vpc-cni/templates/daemonset.yaml
-kind: DaemonSet
-apiVersion: apps/v1
-metadata:
-    name: aws-node
-    namespace: kube-system
-    labels:
-        app.kubernetes.io/name: aws-node
-        app.kubernetes.io/instance: aws-vpc-cni
-        k8s-app: aws-node
-        app.kubernetes.io/version: "v1.16.0"
-spec:
-    updateStrategy:
-        rollingUpdate:
-            maxUnavailable: 10%
-        type: RollingUpdate
-    selector:
-        matchLabels:
-            k8s-app: aws-node
-    template:
-        metadata:
-            labels:
-                app.kubernetes.io/name: aws-node
-                app.kubernetes.io/instance: aws-vpc-cni
-                k8s-app: aws-node
-        spec:
-            priorityClassName: "system-node-critical"
-            serviceAccountName: aws-node
-            hostNetwork: true
-            initContainers:
-                - name: aws-vpc-cni-init
-                  image: 602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon-k8s-cni-init:v1.16.0
-                  env: []
-                  # env:
-                  # - name: DISABLE_TCP_EARLY_DEMUX
-                  #   value: "false"
-                  # - name: ENABLE_IPv6
-                  #   value: "false"
-                  securityContext:
-                      privileged: true
-                  resources:
-                      requests:
-                          cpu: 25m
-                  volumeMounts:
-                      - mountPath: /host/opt/cni/bin
-                        name: cni-bin-dir
-            terminationGracePeriodSeconds: 10
-            tolerations:
-                - operator: Exists
-            securityContext: {}
-            containers:
-                - name: aws-node
-                  image: 602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon-k8s-cni:v1.16.0
-                  ports:
-                      - containerPort: 61678
-                        name: metrics
-                  livenessProbe:
-                      exec:
-                          command:
-                              - /app/grpc-health-probe
-                              - -addr=:50051
-                              - -connect-timeout=5s
-                              - -rpc-timeout=5s
-                      initialDelaySeconds: 60
-                      timeoutSeconds: 10
-                  readinessProbe:
-                      exec:
-                          command:
-                              - /app/grpc-health-probe
-                              - -addr=:50051
-                              - -connect-timeout=5s
-                              - -rpc-timeout=5s
-                      initialDelaySeconds: 1
-                      timeoutSeconds: 10
-                  env:
-                      - name: ADDITIONAL_ENI_TAGS
-                        value: "{}"
-                      # - name: AWS_VPC_CNI_NODE_PORT_SUPPORT
-                      #   value: "true"
-                      # - name: AWS_VPC_ENI_MTU
-                      #   value: "9001"
-                      # - name: AWS_VPC_K8S_CNI_CUSTOM_NETWORK_CFG
-                      # value: "false"
-                      # - name: AWS_VPC_K8S_CNI_EXTERNALSNAT
-                      #   value: "false"
-                      # - name: AWS_VPC_K8S_CNI_LOGLEVEL
-                      #   value: "DEBUG"
-                      # - name: AWS_VPC_K8S_CNI_LOG_FILE
-                      #   value: "/host/var/log/aws-routed-eni/ipamd.log"
-                      - name: AWS_VPC_K8S_CNI_RANDOMIZESNAT
-                        value: "prng"
-                      # - name: AWS_VPC_K8S_CNI_VETHPREFIX
-                      #   value: "eni"
-                      # - name: AWS_VPC_K8S_PLUGIN_LOG_FILE
-                      #   value: "/var/log/aws-routed-eni/plugin.log"
-                      # - name: AWS_VPC_K8S_PLUGIN_LOG_LEVEL
-                      #   value: "DEBUG"
-                      - name: DISABLE_INTROSPECTION
-                        value: "false"
-                      - name: DISABLE_METRICS
-                        value: "false"
-                      - name: DISABLE_NETWORK_RESOURCE_PROVISIONING
-                        value: "false"
-                      - name: ENABLE_IPv4
-                        value: "true"
-                      # - name: ENABLE_IPv6
-                      #   value: "false"
-                      # - name: ENABLE_POD_ENI
-                      #   value: "false"
-                      # - name: ENABLE_PREFIX_DELEGATION
-                      #   value: "false"
-                      - name: VPC_CNI_VERSION
-                        value: "v1.16.0"
-                      # - name: WARM_ENI_TARGET
-                      #   value: "1"
-                      - name: WARM_PREFIX_TARGET
-                        value: "1"
-                      - name: MY_NODE_NAME
-                        valueFrom:
-                            fieldRef:
-                                apiVersion: v1
-                                fieldPath: spec.nodeName
-                      - name: MY_POD_NAME
-                        valueFrom:
-                            fieldRef:
-                                apiVersion: v1
-                                fieldPath: metadata.name
-                  resources:
-                      requests:
-                          cpu: 25m
-                  securityContext:
-                      capabilities:
-                          add:
-                              - NET_ADMIN
-                              - NET_RAW
-                  volumeMounts:
-                      - mountPath: /host/opt/cni/bin
-                        name: cni-bin-dir
-                      - mountPath: /host/etc/cni/net.d
-                        name: cni-net-dir
-                      - mountPath: /host/var/log/aws-routed-eni
-                        name: log-dir
-                      - mountPath: /var/run/aws-node
-                        name: run-dir
-                      - mountPath: /run/xtables.lock
-                        name: xtables-lock
-                - name: aws-eks-nodeagent
-                  image: 602401143452.dkr.ecr.us-west-2.amazonaws.com/amazon/aws-network-policy-agent:v1.0.7
-                  env:
-                      - name: MY_NODE_NAME
-                        valueFrom:
-                            fieldRef:
-                                apiVersion: v1
-                                fieldPath: spec.nodeName
-                  args:
-                      - --enable-ipv6=false
-                      - --enable-network-policy=false
-                      - --enable-cloudwatch-logs=false
-                      - --enable-policy-event-logs=false
-                      - --metrics-bind-addr=:8162
-                      - --health-probe-bind-addr=:8163
-                      - --conntrack-cache-cleanup-period=300
-                  resources:
-                      requests:
-                          cpu: 25m
-                  securityContext:
-                      capabilities:
-                          add:
-                              - NET_ADMIN
-                      privileged: true
-                  volumeMounts:
-                      - mountPath: /host/opt/cni/bin
-                        name: cni-bin-dir
-                      - mountPath: /sys/fs/bpf
-                        name: bpf-pin-path
-                      - mountPath: /var/log/aws-routed-eni
-                        name: log-dir
-                      - mountPath: /var/run/aws-node
-                        name: run-dir
-            volumes:
-                - name: bpf-pin-path
-                  hostPath:
-                      path: /sys/fs/bpf
-                - name: cni-bin-dir
-                  hostPath:
-                      path: /opt/cni/bin
-                - name: cni-net-dir
-                  hostPath:
-                      path: /etc/cni/net.d
-                - name: log-dir
-                  hostPath:
-                      path: /var/log/aws-routed-eni
-                      type: DirectoryOrCreate
-                - name: run-dir
-                  hostPath:
-                      path: /var/run/aws-node
-                      type: DirectoryOrCreate
-                - name: xtables-lock
-                  hostPath:
-                      path: /run/xtables.lock
-            affinity:
-                nodeAffinity:
-                    requiredDuringSchedulingIgnoredDuringExecution:
-                        nodeSelectorTerms:
-                            - matchExpressions:
-                                  - key: kubernetes.io/os
-                                    operator: In
-                                    values:
-                                        - linux
-                                  - key: kubernetes.io/arch
-                                    operator: In
-                                    values:
-                                        - amd64
-                                        - arm64
-                                  - key: eks.amazonaws.com/compute-type
-                                    operator: NotIn
-                                    values:
-                                        - fargate