feat: add default kms encrypted gp3 StorageClass and PersistentVolume… #15
+264
−9
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,88 @@ | ||
| import { Easy_EKS_Config_Data } from './Easy_EKS_Config_Data'; | ||
| import * as cdk from 'aws-cdk-lib'; | ||
| import * as eks from 'aws-cdk-lib/aws-eks'; | ||
| import * as kms from 'aws-cdk-lib/aws-kms'; | ||
| import console = require('console'); | ||
| import { sign } from 'crypto'; | ||
| //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// | ||
|
|
||
| export class Storage_YAML_Generator{ | ||
|
|
||
| config: Easy_EKS_Config_Data; | ||
| cluster: eks.Cluster; | ||
| constructor(input_parmeters: Partial<Storage_YAML_Generator>){ Object.assign(this, input_parmeters); } | ||
|
|
||
| generate_storage_class_manifests(){ | ||
| let array_of_yaml_manifests_to_return: { [key:string]: any }[] = []; | ||
| let config = this.config; | ||
| const kms_key = config.kmsKey; | ||
| const storage_class_gp3 = { | ||
|
There was a problem hiding this comment. request: (reasoning behind the request)
when it comes to the persistent volume claim, I think it makes more sense to put it in ./config/eks/dev_eks_config.ts's deploy_workload_dependencies(), because it's functioning like a demo manifest, and since it's a demo it wouldn't belong in my_orgs_baseline (as that's intended to get applied to all environments dev, test, stage, prod) and demo apps wouldn't be appropriate to deploy to prod, but storage class would. (which is why storage_class.yaml makes sense here in ./config/eks/my_orgs_baseline_eks_config.ts, but pvc.yaml should be moved to ./config/eks/dev_eks_config.ts) further point of clarification: |
||
| "apiVersion": "storage.k8s.io/v1", | ||
| "kind": "StorageClass", | ||
| "metadata": { | ||
| "name": "kms-encrypted-gp3", | ||
| "annotations": { | ||
| "storageclass.kubernetes.io/is-default-class": "true" | ||
|
There was a problem hiding this comment. storageclass should be indented 4 spaces |
||
| } | ||
| }, | ||
| "provisioner": "ebs.csi.aws.com", | ||
| "volumeBindingMode": "WaitForFirstConsumer", | ||
| "allowVolumeExpansion": true, | ||
| "reclaimPolicy": "Delete", | ||
| "parameters": { | ||
| "type": "gp3", | ||
| "encrypted": "true", | ||
| "kmsKeyId": `${kms_key.keyArn}` | ||
| } | ||
| } | ||
| array_of_yaml_manifests_to_return.push(storage_class_gp3) | ||
| return array_of_yaml_manifests_to_return; | ||
| } //end generate_manifests | ||
|
|
||
| generate_volume_claim_manifests(name: string, size: string){ | ||
| let array_of_yaml_manifests_to_return: { [key:string]: any }[] = []; | ||
| let cluster = this.cluster; | ||
|
|
||
| const volume_claim_gp3 = { | ||
| "apiVersion": "v1", | ||
| "kind": "PersistentVolumeClaim", | ||
| "metadata": { | ||
| "name": `${name}`, | ||
| "namespace": "default" | ||
| }, | ||
| "spec": { | ||
| "accessModes": [ | ||
| "ReadWriteOnce" | ||
| ], | ||
| "storageClassName": "kms-encrypted-gp3", | ||
| "resources": { | ||
| "requests": { | ||
| "storage": `${size}` | ||
| } | ||
| } | ||
| } | ||
| } | ||
| array_of_yaml_manifests_to_return.push(volume_claim_gp3) | ||
| return array_of_yaml_manifests_to_return; | ||
| } //end generate_manifests | ||
|
|
||
|
|
||
| } //end class Karepnter_Manifests | ||
|
|
||
| //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// | ||
|
|
||
| export function Apply_Storage_Class_YAMLs(stack: cdk.Stack, cluster: eks.Cluster, config: Easy_EKS_Config_Data, | ||
| manifestName: string,storage_class_YAMLs: {[key: string]: any;}[]){ | ||
| const apply_storage_class_YAML = new eks.KubernetesManifest(stack, manifestName, | ||
| { | ||
| cluster: cluster, | ||
| manifest: storage_class_YAMLs, | ||
| overwrite: true, | ||
| prune: true, | ||
| } | ||
| ); | ||
|
|
||
| // Test volume claim | ||
|
|
||
|
|
||
| } //end function Storage_YAML_Generator | ||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I merged integration into your feature branch and then tested locally.
It doesn't deploy for me.
When I do a fresh install I get
I suspect this issue is the result of order of operations.
I think the logic is trying to introduce your change too soon, and it needs to deploy your change at a later time.
A solution I think might work is to implement something like this
But more like this:
^-- this should make it, so your logic doesn't start executing until after the cluster.awsAuth/csi addon is fully established/deployed