Sitelet https://github.com/kubernetes/kops/pull/18602/files
Skip to content

Automated cherry pick of #18600: nodeup: don't mutate the cluster spec when clearing authenticator config #18602

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kubernetes-prow merged 1 commit into from
Jul 16, 2026
Merged

Automated cherry pick of #18600: nodeup: don't mutate the cluster spec when clearing authenticator config #18602

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions pkg/apis/nodeup/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -372,11 +372,13 @@ func NewConfig(cluster *kops.Cluster, instanceGroup *kops.InstanceGroup) (*Confi
},
}
if cluster.Spec.Authentication != nil {
config.APIServerConfig.Authentication = cluster.Spec.Authentication
if cluster.Spec.Authentication.AWS != nil {
// Copy before clearing fields, so that we don't mutate the shared cluster spec.
authentication := *cluster.Spec.Authentication
if authentication.AWS != nil {
// The values go into the manifest and aren't needed by nodeup.
config.APIServerConfig.Authentication.AWS = &kops.AWSAuthenticationSpec{}
authentication.AWS = &kops.AWSAuthenticationSpec{}
}
config.APIServerConfig.Authentication = &authentication
}
if cluster.Spec.API.DNS != nil {
config.APIServerConfig.API.DNS = &kops.DNSAccessSpec{}
Expand Down
9 changes: 8 additions & 1 deletion tests/integration/update_cluster/complex/data/aws_s3_object_cluster-completed.spec_content
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,14 @@ spec:
name: us-test-1a
type: Public
authentication:
aws: {}
aws:
backendMode: CRD
clusterID: complex.example.com
identityMappings:
- arn: arn:aws-test:iam::000000000000:role/AWSReservedSSO_Developer_7de86b085b6056ae
groups:
- he:dev
username: dev:{{SessionNameRaw}}
authorization:
rbac: {}
channel: stable
Expand Down
25 changes: 19 additions & 6 deletions ...complex/data/aws_s3_object_complex.example.com-addons-authentication.aws-k8s-1.12_content
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,9 +155,10 @@ spec:
containers:
- args:
- server
- --config=/etc/aws-iam-authenticator/config.yaml
- --cluster-id=complex.example.com
- --state-dir=/var/aws-iam-authenticator
- --kubeconfig-pregenerated=true
- --backend-mode=CRD
image: public.ecr.aws/eks-distro/kubernetes-sigs/aws-iam-authenticator:v0.6.20-eks-1-30-7
livenessProbe:
httpGet:
Expand All @@ -180,8 +181,6 @@ spec:
runAsGroup: 10000
runAsUser: 10000
volumeMounts:
- mountPath: /etc/aws-iam-authenticator/
name: config
- mountPath: /var/aws-iam-authenticator/
name: state
- mountPath: /etc/kubernetes/aws-iam-authenticator/
Expand All @@ -203,9 +202,6 @@ spec:
- key: CriticalAddonsOnly
operator: Exists
volumes:
- configMap:
name: aws-iam-authenticator
name: config
- hostPath:
path: /srv/kubernetes/aws-iam-authenticator/
name: output
Expand All @@ -214,3 +210,20 @@ spec:
name: state
updateStrategy:
type: RollingUpdate

---

apiVersion: iamauthenticator.k8s.aws/v1alpha1
kind: IAMIdentityMapping
metadata:
labels:
addon.kops.k8s.io/name: authentication.aws
app.kubernetes.io/managed-by: kops
k8s-app: aws-iam-authenticator
role.kubernetes.io/authentication: "1"
name: iam-identity-mapping-0
spec:
arn: arn:aws-test:iam::000000000000:role/AWSReservedSSO_Developer_7de86b085b6056ae
groups:
- he:dev
username: dev:{{SessionNameRaw}}
2 changes: 1 addition & 1 deletion ...on/update_cluster/complex/data/aws_s3_object_complex.example.com-addons-bootstrap_content
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,7 @@ spec:
k8s-addon: storage-aws.addons.k8s.io
- id: k8s-1.12
manifest: authentication.aws/k8s-1.12.yaml
manifestHash: 7233a06582f37d422ad0fd908ff5c23965edff21d81e5888549c9ea9089a8309
manifestHash: 22e33f833fccae05f3e7060ea11f4eca26c2a480d8beff874ffda473b6dd0140
name: authentication.aws
selector:
role.kubernetes.io/authentication: "1"
Expand Down
9 changes: 8 additions & 1 deletion tests/integration/update_cluster/complex/in-legacy-v1alpha2.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,14 @@ spec:
accessLog:
bucket: access-log-example
authentication:
aws: {}
aws:
backendMode: CRD
clusterID: complex.example.com
identityMappings:
- arn: arn:aws-test:iam::000000000000:role/AWSReservedSSO_Developer_7de86b085b6056ae
groups:
- he:dev
username: dev:{{SessionNameRaw}}
kubernetesApiAccess:
- 1.1.1.0/24
- pl-44444444
Expand Down
9 changes: 8 additions & 1 deletion tests/integration/update_cluster/complex/in-v1alpha2.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,14 @@ spec:
accessLog:
bucket: access-log-example
authentication:
aws: {}
aws:
backendMode: CRD
clusterID: complex.example.com
identityMappings:
- arn: arn:aws-test:iam::000000000000:role/AWSReservedSSO_Developer_7de86b085b6056ae
groups:
- he:dev
username: dev:{{SessionNameRaw}}
kubernetesApiAccess:
- 1.1.1.0/24
- pl-44444444
Expand Down
Loading