✨ Add ability to control "EKS Auto Mode" for EKS clusters #5642

CharlieR-o-o-t · 2025-09-02T19:43:31Z

What type of PR is this?
/kind feature
/kind api-change

What this PR does / why we need it
This PR introduces support for controlling EKS Auto Mode for EKS clusters managed with AWSManagedControlPlane CRD.
Previously, the EKSAutoMode was always enabled by default, for someone it's not needed.
With this change, users can explicitly set the spec.eksAutoMode field in the AWSManagedControlPlane resource to true or false based on their needs.

Special notes for your reviewer:
Includes extra fix:
AWSManagedControlPlane.spec.bootstrapSelfManagedAddons was always defaulted to true by webhook.

Checklist:

Release note:

Ability to control "EKS Auto Mode" with AWSManagedControlPlane CRD. New field "EKSAutoMode" has been added to spec.

k8s-ci-robot · 2025-09-02T19:43:39Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign ankitasw for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot · 2025-09-02T19:43:40Z

Welcome @CharlieR-o-o-t!

It looks like this is your first PR to kubernetes-sigs/cluster-api-provider-aws 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/cluster-api-provider-aws has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

k8s-ci-robot · 2025-09-02T19:43:41Z

Hi @CharlieR-o-o-t. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

richardcase · 2025-09-04T06:03:26Z

/ok-to-test

CharlieR-o-o-t · 2025-09-04T10:40:06Z

/retest-required

CharlieR-o-o-t · 2025-09-04T10:58:20Z

/retest-required

punkwalker

Thank you @CharlieR-o-o-t for working on this, I added some initial thoughts.

punkwalker · 2025-09-04T17:37:48Z

controlplane/eks/api/v1beta2/awsmanagedcontrolplane_types.go

+	// EKSAutoMode indicates the EKS Auto Mode state for control-plane.
+	// If you set this value to false, the following params will be disabled for EKS:
+	// AWS::EKS::Cluster KubernetesNetworkConfig ElasticLoadBalancing Enabled -> false.
+	// AWS::EKS::Cluster StorageConfig blockStorage Enabled -> false.
+	// AWS::EKS::Cluster ComputeConfig Enabled -> false.
+	// +kubebuilder:default=true
+	EKSAutoMode *bool `json:"eksAutoMode"`


Can we name the field autoMode instead of eksAutoMode?
Also, IMO, this should not default to true and field should be optional as upstream EKS service does not default to AutoMode.

yes, my bad. For some reason though it's default feature.

punkwalker · 2025-09-04T17:39:53Z

pkg/cloud/services/eks/cluster.go

+	} else {
+		netConfig.ElasticLoadBalancing = &ekstypes.ElasticLoadBalancing{Enabled: aws.Bool(false)}
+	}


I think we don't need this else as the field should be unset if autoMode is disabled.

punkwalker · 2025-09-04T17:51:36Z

pkg/cloud/services/eks/cluster.go

+		ComputeConfig:              &ekstypes.ComputeConfigRequest{Enabled: aws.Bool(false)},
+		StorageConfig:              &ekstypes.StorageConfigRequest{BlockStorage: &ekstypes.BlockStorage{Enabled: aws.Bool(false)}},


Let's keep the ComputeConfig and StorageConfig unset when autoMode disabled.

punkwalker · 2025-09-04T17:56:35Z

pkg/cloud/services/eks/cluster.go

+	if s.scope.EKSAutoMode() {
+		input.ComputeConfig = &ekstypes.ComputeConfigRequest{Enabled: aws.Bool(true)}
+		input.StorageConfig = &ekstypes.StorageConfigRequest{BlockStorage: &ekstypes.BlockStorage{Enabled: aws.Bool(true)}}


The computeConfig has nodepools and if this is provided, it should also have nodeRoleArn. This is crucial if user wants to use default nodepools (general-purpose and system). When this is not specified, the user will need to create own nodepools.

Ref: https://docs.aws.amazon.com/eks/latest/APIReference/API_CreateCluster.html#AmazonEKS-CreateCluster-request-computeConfig

good point, will handle nodepools/nodeRoleArn + validation

+1, Let's keep this PR focused on AutoMode.

faiq · 2025-09-05T18:50:39Z

controlplane/eks/api/v1beta2/awsmanagedcontrolplane_webhook.go

+	// Set default value for AutoMode
+	if r.Spec.AutoMode == nil {
+		r.Spec.AutoMode = aws.Bool(false)
+	}


shouldn't the default be true considering this was always on by default in previous versions? a change like this could be breaking for users

agree, have changed that.

CharlieR-o-o-t · 2025-09-05T18:52:35Z

Thanks for review, will add new version soon.

CharlieR-o-o-t · 2025-09-08T16:09:35Z

/retest-required

CharlieR-o-o-t · 2025-09-08T16:31:28Z

/retest-required

CharlieR-o-o-t · 2025-09-08T16:35:03Z

/retest-required

Signed-off-by: Siarhei Rasiukevich <[email protected]>

k8s-ci-robot · 2025-09-08T19:11:01Z

@CharlieR-o-o-t: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-cluster-api-provider-aws-apidiff-main	`57862a3`	link	false	`/test pull-cluster-api-provider-aws-apidiff-main`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

CharlieR-o-o-t · 2025-09-08T19:33:45Z

@punkwalker , hello,

I’m unsure how we should handle the breaking change reported here: https://prow.k8s.io/view/gs/kubernetes-ci-logs/pr-logs/pull/kubernetes-sigs_cluster-api-provider-aws/5642/pull-cluster-api-provider-aws-apidiff-main/1965129880395845632

bootstrapSelfManagedAddons should be pointer, it's possible mistype in type definition, and it's not possible to set to false because of this:

cluster-api-provider-aws/controlplane/eks/api/v1beta2/awsmanagedcontrolplane_webhook.go

Line 575 in 60649f3

r.Spec.BootstrapSelfManagedAddons = true

Also I have added new field to struct AccessConfig, because AutoMode is not capable with CONFIG_MAP authenticationMode in EKS. + validation has been added with unit tests.

Thank you for your review, I appreciate it.

faiq · 2025-09-08T20:05:03Z

config/crd/bases/controlplane.cluster.x-k8s.io_awsmanagedcontrolplanes.yaml

+              accessConfig:
+                description: |-
+                  AccessConfig specifies the EKS cluster access configuration.
+                  It defines the authentication mode and whether to bootstrap the cluster creator
+                  as a cluster-admin.
+                properties:
+                  authenticationMode:
+                    description: |-
+                      AuthenticationMode mode controls how Kubernetes API authentication is performed:
+                        - CONFIG_MAP — uses only the aws-auth ConfigMap (legacy mode).
+                        - API — uses only EKS Access Entries (aws-auth is ignored).
+                        - API_AND_CONFIG_MAP — enables both Access Entries and aws-auth.
+                    type: string
+                  bootstrapAdminPermissions:
+                    description: |-


Is it possible to rebase your changes off https://github.com/kubernetes-sigs/cluster-api-provider-aws/pull/5578/files -- we're implementing the same changes there.

Rebasing your changes off that would make the PR much smaller and less work down the line -- considering that has a lot of reviews already

sure, will do

faiq · 2025-09-08T20:06:24Z

controlplane/eks/api/v1beta2/awsmanagedcontrolplane_types.go

+
+// Compute allows to run compute capability with EKS AutoMode.
+type Compute struct {
+	NodePools []string `json:"nodePools,omitempty"`


needs a comment describing the field.

punkwalker · 2025-09-08T22:44:05Z

@punkwalker , hello,

I’m unsure how we should handle the breaking change reported here: https://prow.k8s.io/view/gs/kubernetes-ci-logs/pr-logs/pull/kubernetes-sigs_cluster-api-provider-aws/5642/pull-cluster-api-provider-aws-apidiff-main/1965129880395845632

bootstrapSelfManagedAddons should be pointer, it's possible mistype in type definition, and it's not possible to set to false because of this:

cluster-api-provider-aws/controlplane/eks/api/v1beta2/awsmanagedcontrolplane_webhook.go

Line 575 in 60649f3

r.Spec.BootstrapSelfManagedAddons = true

Also I have added new field to struct AccessConfig, because AutoMode is not capable with CONFIG_MAP authenticationMode in EKS. + validation has been added with unit tests.

Thank you for your review, I appreciate it.

@CharlieR-o-o-t
Can you confirm why are we changing BootstrapSelfManagedAddons frombool to *bool? The reason api-diff will fail because this change breaks API compatibility with previous API versions, so it would flag it. If you feel this change is necessary, Let's check with @richardcase about how to handle it!

richardcase · 2025-09-10T13:36:45Z

@CharlieR-o-o-t Can you confirm why are we changing BootstrapSelfManagedAddons frombool to *bool? The reason api-diff will fail because this change breaks API compatibility with previous API versions, so it would flag it. If you feel this change is necessary, Let's check with @richardcase about how to handle it!

Yeah we should probably change this back to bool. Was there a specific reason it was changed?

We will probably change all option bool fields to *bool in the future, like CAPI did (as part of v1beta2): kubernetes-sigs/cluster-api#12436

CharlieR-o-o-t · 2025-09-22T09:21:10Z

thank you, will change back to "bool".
Will continue to work on this PR after merge of #5578

k8s-ci-robot added the needs-priority label Sep 2, 2025

k8s-ci-robot requested review from faiq and luthermonson September 2, 2025 19:43

k8s-ci-robot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. labels Sep 2, 2025

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Sep 4, 2025

CharlieR-o-o-t force-pushed the main branch from 53a9c82 to 6867e42 Compare September 4, 2025 10:23

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 4, 2025

CharlieR-o-o-t force-pushed the main branch from 6867e42 to 49ba275 Compare September 4, 2025 10:39

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Sep 4, 2025

CharlieR-o-o-t force-pushed the main branch from 49ba275 to 1aad8ad Compare September 4, 2025 10:58

punkwalker suggested changes Sep 4, 2025

View reviewed changes

CharlieR-o-o-t force-pushed the main branch from 1aad8ad to e8d4e67 Compare September 4, 2025 20:52

faiq reviewed Sep 5, 2025

View reviewed changes

CharlieR-o-o-t force-pushed the main branch from e8d4e67 to 3cc0375 Compare September 8, 2025 16:08

CharlieR-o-o-t force-pushed the main branch 2 times, most recently from f7906fd to 8b952fe Compare September 8, 2025 16:27

CharlieR-o-o-t force-pushed the main branch from 8b952fe to c7ae944 Compare September 8, 2025 16:29

CharlieR-o-o-t force-pushed the main branch 5 times, most recently from 6ac1f29 to d052fc9 Compare September 8, 2025 18:38

✨ Add ability to control "EKS Auto Mode" for EKS clusters

57862a3

Signed-off-by: Siarhei Rasiukevich <[email protected]>

CharlieR-o-o-t force-pushed the main branch from d052fc9 to 57862a3 Compare September 8, 2025 19:07

CharlieR-o-o-t requested a review from punkwalker September 8, 2025 19:23

faiq reviewed Sep 8, 2025

View reviewed changes

		ComputeConfig: &ekstypes.ComputeConfigRequest{Enabled: aws.Bool(false)},
		StorageConfig: &ekstypes.StorageConfigRequest{BlockStorage: &ekstypes.BlockStorage{Enabled: aws.Bool(false)}},

✨ Add ability to control "EKS Auto Mode" for EKS clusters #5642

Are you sure you want to change the base?

✨ Add ability to control "EKS Auto Mode" for EKS clusters #5642

Conversation

CharlieR-o-o-t commented Sep 2, 2025

Uh oh!

k8s-ci-robot commented Sep 2, 2025

Uh oh!

k8s-ci-robot commented Sep 2, 2025

Uh oh!

k8s-ci-robot commented Sep 2, 2025

Uh oh!

richardcase commented Sep 4, 2025

Uh oh!

CharlieR-o-o-t commented Sep 4, 2025

Uh oh!

CharlieR-o-o-t commented Sep 4, 2025

Uh oh!

punkwalker left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

punkwalker Sep 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

CharlieR-o-o-t commented Sep 5, 2025

Uh oh!

CharlieR-o-o-t commented Sep 8, 2025

Uh oh!

CharlieR-o-o-t commented Sep 8, 2025

Uh oh!

CharlieR-o-o-t commented Sep 8, 2025

Uh oh!

k8s-ci-robot commented Sep 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

CharlieR-o-o-t commented Sep 8, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

punkwalker commented Sep 8, 2025

Uh oh!

richardcase commented Sep 10, 2025

Uh oh!

CharlieR-o-o-t commented Sep 22, 2025

Uh oh!

Uh oh!

punkwalker Sep 4, 2025 •

edited

Loading

k8s-ci-robot commented Sep 8, 2025 •

edited

Loading