Containers-roadmap: [EKS] Cloudformation support for control plane logging and endpoint access control

[tabern]

Ability to define control plane logging and endpoint access control (public/private) during EKS cluster creation and update via Cloudformation.

Which service(s) is this request for?
Amazon EKS, AWS Cloudformation

Are you currently working around this issue?
You can currently control these settings for EKS clusters using the EKS APIs, console, and AWS CLI.

Attachments
Control Plane logging: https://github.com/aws/containers-roadmap/issues/26
Endpoint access control: https://github.com/aws/containers-roadmap/issues/22

[icereed]

Hello,

is there any ETA on this? We need to build dirty workarounds for this.

Best,
Icereed

[max-allan-surevine]

Most people are doing "secure by default" and here AWS are doing "open to the internet" by default and all my carefully secured instances without any internet connectivity cannot join an EKS cluster. Unless I run the cloudformation and then manually enable the private access later.
Please hurry it up!
The feature is already there, it just needs exposing to CloudFormation.

[PatMyron]

CloudFormation Roadmap issue for logging

[sbonasu]

+1

[quocdung3007]

+1

[zetas]

Big +1. This just caused me a solid week of pulling my hair out trying to figure out why my private EC2 nodes won't bootstrap. Why amazon, why would you ever default to private off. I get public on but private off? why?

[ismailyenigul]

I would like to configure EKS endpoint parameter by Cloudformation templates.
Current cloudformation AWS::EKS::Cluster does not have any parameter to configure private/public endpoints. It creates the cluster with public endpoint enabled and we have to run some cli commands to enable private endpoint.

[vikram-katkar]

+1
Would love to see these features in CloudFormation:

• endpointPrivateAccess
• endpointPublicAccess
• publicAccessCidrs
• clusterLogging

This already available in API:
https://docs.aws.amazon.com/eks/latest/APIReference/API_CreateCluster.html

[clayvan]

It's not a good look when even Terraform beats CloudFormation to support both logging and private endpoints.

https://www.terraform.io/docs/providers/aws/r/eks_cluster.html#vpc_config-1

[clayvan]

FYI the AWS Quick start team created their own custom CF resource to do this https://github.com/aws-quickstart/quickstart-amazon-eks-cluster-resource-provider

Commit to the quick start guide for reference https://github.com/aws-quickstart/quickstart-amazon-eks/commit/0bf72f132fbe9c34c84e4d2b9b2e0a603ec06d0b

It seems..weird..that the AWS quick start team had to create a workaround to do this instead of just baking that logic into the EKS CF resource itself?

[clayvan]

I noticed today that the EKS cloudformation resource has been updated to mention these parameters, but are not in the example.

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-eks-cluster.html

I have not tried it yet.

[evanlurvey]

@clayvan I tried today and got a failed deploy. Property validation failure: [Encountered unsupported properties in {/ResourcesVpcConfig}: [EndpointPrivateAccess]] I know there is some sort of way to disable validation that sometimes works but I can't remember the syntax.