Skip to content

Commit 81aec4c

Browse files
niallthomsonniallthomson
committed
Fixes for ingress control
1 parent 9d57271 commit 81aec4c

10 files changed

Lines changed: 50 additions & 19 deletions

‎hack/deploy-ide-cfn.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ aws cloudformation deploy --stack-name "$STACK_NAME" \
2424
RepositoryOwner="$REPOSITORY_OWNER" \
2525
RepositoryName="$REPOSITORY_NAME" \
2626
RepositoryRef="$REPOSITORY_REF" \
27-
InboundCIDR="$INBOUND_CIDRS"
27+
InboundCIDR="$BASE_INBOUND_CIDRS"
2828

2929
if [ -z "$CI" ]; then
3030
IDE_URL=$(aws cloudformation describe-stacks --stack-name "$STACK_NAME" \

‎hack/destroy-infrastructure.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,8 @@ aws eks describe-cluster --name "${EKS_CLUSTER_AUTO_NAME}" &> /dev/null || auto_
2828

2929
if [ $auto_cluster_exists -eq 0 ] && [[ "$cluster" == "auto" || "$cluster" == "all" ]]; then
3030
echo "Deleting auto mode cluster ${EKS_CLUSTER_AUTO_NAME}"
31-
#bash $SCRIPT_DIR/shell.sh "${environment}" 'delete-environment' || true # Needed ?
32-
bash $SCRIPT_DIR/exec.sh "${environment}" 'eksctl delete cluster --name ${EKS_CLUSTER_AUTO_NAME} --region ${AWS_REGION} --wait --force --disable-nodegroup-eviction --timeout 45m'
31+
bash $SCRIPT_DIR/shell.sh "${environment}" 'delete-environment' || true
32+
bash $SCRIPT_DIR/exec.sh "${environment}" 'eksctl delete cluster --name ${EKS_CLUSTER_AUTO_NAME} --region ${AWS_REGION} --wait --force --disable-nodegroup-eviction --timeout 45m'&
3333
else
3434
echo "Auto mode cluster ${EKS_CLUSTER_AUTO_NAME} does not exist or skipped"
3535
fi

‎hack/lib/common-env.sh‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,31 @@ SKIP_CREDENTIALS=${SKIP_CREDENTIALS:-""}
2020
USE_CURRENT_USER=${USE_CURRENT_USER:-""}
2121
AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID:-""} # We check the access key
2222

23+
# If no credentials are configured, attempt to retrieve them from EC2 IMDSv2
24+
if [ -z "$AWS_ACCESS_KEY_ID" ] && [ -z "$SKIP_CREDENTIALS" ]; then
25+
IMDS_TOKEN=$(curl -s --connect-timeout 2 -X PUT "http://169.254.169.254/latest/api/token" \
26+
-H "X-aws-ec2-metadata-token-ttl-seconds: 21600" 2>/dev/null) || true
27+
28+
if [ -n "$IMDS_TOKEN" ]; then
29+
IMDS_ROLE=$(curl -s --connect-timeout 2 \
30+
-H "X-aws-ec2-metadata-token: $IMDS_TOKEN" \
31+
"http://169.254.169.254/latest/meta-data/iam/security-credentials/" 2>/dev/null) || true
32+
33+
if [ -n "$IMDS_ROLE" ]; then
34+
IMDS_CREDS=$(curl -s --connect-timeout 2 \
35+
-H "X-aws-ec2-metadata-token: $IMDS_TOKEN" \
36+
"http://169.254.169.254/latest/meta-data/iam/security-credentials/${IMDS_ROLE}" 2>/dev/null) || true
37+
38+
if [ -n "$IMDS_CREDS" ]; then
39+
export AWS_ACCESS_KEY_ID=$(echo "$IMDS_CREDS" | grep -o '"AccessKeyId" *: *"[^"]*"' | cut -d'"' -f4)
40+
export AWS_SECRET_ACCESS_KEY=$(echo "$IMDS_CREDS" | grep -o '"SecretAccessKey" *: *"[^"]*"' | cut -d'"' -f4)
41+
export AWS_SESSION_TOKEN=$(echo "$IMDS_CREDS" | grep -o '"Token" *: *"[^"]*"' | cut -d'"' -f4)
42+
echo "Retrieved credentials from EC2 IMDSv2 (role: ${IMDS_ROLE})"
43+
fi
44+
fi
45+
fi
46+
fi
47+
2348
if [ -z "$SKIP_CREDENTIALS" ]; then
2449
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
2550

‎hack/lib/resolve-source-ip.sh‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/bin/bash
22

3-
# Resolves SOURCE_IP_ADDRESS to INBOUND_CIDRS
3+
# Resolves SOURCE_IP_ADDRESS to BASE_INBOUND_CIDRS
44
# If SOURCE_IP_ADDRESS is blank or "auto", resolves the current public IP
55
# Otherwise uses the provided value verbatim
66

@@ -11,5 +11,5 @@ else
1111
echo "Using provided source IP address: ${SOURCE_IP_ADDRESS}"
1212
fi
1313

14-
export INBOUND_CIDRS="${SOURCE_IP_ADDRESS}/32"
15-
echo "Inbound CIDRs: ${INBOUND_CIDRS}"
14+
export BASE_INBOUND_CIDRS="${SOURCE_IP_ADDRESS}/32"
15+
echo "Inbound CIDRs: ${BASE_INBOUND_CIDRS}"

‎hack/run-tests.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ $CONTAINER_CLI run $background_args $dns_args \
9393
--name $container_name \
9494
-v $SCRIPT_DIR/../website/docs:/content \
9595
-v $SCRIPT_DIR/../manifests:/eks-workshop/manifests \
96-
-e 'EKS_CLUSTER_NAME' -e 'EKS_CLUSTER_AUTO_NAME' -e 'AWS_REGION' -e 'RESOURCES_PRECREATED' -e 'INBOUND_CIDRS' \
96+
-e 'EKS_CLUSTER_NAME' -e 'EKS_CLUSTER_AUTO_NAME' -e 'AWS_REGION' -e 'RESOURCES_PRECREATED' -e 'BASE_INBOUND_CIDRS' \
9797
$aws_credential_args $container_image -g "${actual_glob}" --hook-timeout 3600 --timeout 3600 $output_args ${AWS_EKS_WORKSHOP_TEST_FLAGS} || exit_code=$?
9898

9999
if [ $exit_code -eq 0 ]; then

‎hack/shell.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,6 @@ $CONTAINER_CLI run --rm $interactive_args $dns_args \
4343
-v $SCRIPT_DIR/../manifests:/eks-workshop/manifests \
4444
-v $SCRIPT_DIR/../cluster:/cluster \
4545
-e "RESET_NO_DELETE=true" \
46-
-e 'EKS_CLUSTER_NAME' -e 'EKS_CLUSTER_AUTO_NAME' -e 'AWS_REGION' -e 'INBOUND_CIDRS' \
46+
-e 'EKS_CLUSTER_NAME' -e 'EKS_CLUSTER_AUTO_NAME' -e 'AWS_REGION' -e 'BASE_INBOUND_CIDRS' \
4747
-p 8889:8889 \
4848
$aws_credential_args $container_image $shell_command

‎hack/update-iam-role.sh‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,4 +21,5 @@ aws cloudformation deploy \
2121
--stack-name ${EKS_CLUSTER_NAME}-ide-role \
2222
--capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM \
2323
--template-file $outfile \
24-
--region $AWS_REGION
24+
--region $AWS_REGION \
25+
--no-fail-on-empty-changeset

‎lab/bin/reset-environment‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,18 @@ export EKS_CLUSTER_AUTO_NAME
4747
aws eks update-kubeconfig --name $EKS_CLUSTER_AUTO_NAME --alias eks-workshop-auto 2>/dev/null || true
4848
aws eks update-kubeconfig --name $EKS_CLUSTER_NAME --alias default --user-alias default 2>/dev/null || true
4949

50+
INBOUND_CIDRS="${BASE_INBOUND_CIDRS}"
51+
for cluster in "$EKS_CLUSTER_NAME" "$EKS_CLUSTER_AUTO_NAME"; do
52+
ip=$(aws ec2 describe-nat-gateways \
53+
--filter "Name=tag:created-by,Values=eks-workshop-v2" "Name=tag:env,Values=${cluster}" \
54+
--query "NatGateways[0].NatGatewayAddresses[0].PublicIp" --output text 2>/dev/null) || continue
55+
if [ "$ip" != "None" ] && [ -n "$ip" ]; then
56+
INBOUND_CIDRS="${INBOUND_CIDRS:+${INBOUND_CIDRS},}${ip}/32"
57+
fi
58+
done
59+
60+
echo "Resolved IPs: ${INBOUND_CIDRS}"
61+
5062
module=$1
5163

5264
repository_path="/eks-workshop/repository"
@@ -327,6 +339,7 @@ if [ ! -z "$module" ]; then
327339
fi
328340

329341
terraform -chdir="$tf_dir" output -json | jq -r '.environment.value | select(. != null)' > ~/.bashrc.d/workshop-env.bash
342+
echo "export INBOUND_CIDRS='${INBOUND_CIDRS}'" >> ~/.bashrc.d/workshop-env.bash
330343

331344
# Node groups
332345
expected_size_config="$EKS_DEFAULT_MNG_MIN $EKS_DEFAULT_MNG_MAX $EKS_DEFAULT_MNG_DESIRED"

‎lab/cfn/eks-workshop-vscode-cfn.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -315,7 +315,7 @@ Resources:
315315
export ANALYTICS_ENDPOINT="${AnalyticsEndpoint}"
316316
IMDS_TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
317317
IDE_IP=$(curl -s -H "X-aws-ec2-metadata-token: $IMDS_TOKEN" http://169.254.169.254/latest/meta-data/public-ipv4)
318-
export INBOUND_CIDRS="${InboundCIDR},$IDE_IP/32"
318+
export BASE_INBOUND_CIDRS="${InboundCIDR},$IDE_IP/32"
319319
320320
curl -fsSL https://raw.githubusercontent.com/${RepositoryOwner}/${RepositoryName}/${RepositoryRef}/lab/scripts/installer.sh | bash
321321

‎lab/scripts/setup.sh‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -80,15 +80,7 @@ echo "export RESOURCES_PRECREATED='${RESOURCES_PRECREATED}'" > ~/.bashrc.d/infra
8080

8181
echo "export ANALYTICS_ENDPOINT='${ANALYTICS_ENDPOINT}'" > ~/.bashrc.d/analytics.bash
8282

83-
NAT_GW_IP=$(aws ec2 describe-nat-gateways \
84-
--filter "Name=tag:created-by,Values=eks-workshop-v2" "Name=tag:env,Values=${EKS_CLUSTER_NAME}" \
85-
--query "NatGateways[0].NatGatewayAddresses[0].PublicIp" --output text)
86-
87-
if [ "$NAT_GW_IP" != "None" ] && [ ! -z "$NAT_GW_IP" ]; then
88-
INBOUND_CIDRS="${INBOUND_CIDRS:+${INBOUND_CIDRS},}${NAT_GW_IP}/32"
89-
fi
90-
91-
echo "export INBOUND_CIDRS='${INBOUND_CIDRS}'" > ~/.bashrc.d/inbound-cidr.bash
83+
echo "export BASE_INBOUND_CIDRS='${BASE_INBOUND_CIDRS}'" > ~/.bashrc.d/inbound-cidr.bash
9284

9385
/usr/local/bin/kubectl completion bash > ~/.bashrc.d/kubectl_completion.bash
9486
echo "alias k=kubectl" >> ~/.bashrc.d/kubectl_completion.bash

0 commit comments

Comments
 (0)