使用cloudformation在aws中从eks集群创建OIDC提供程序

Question

我目前正在制作一个cloudformation模板。模板通常使用集群自动缩放器创建EKS集群。为此，我创建了一个lambda函数，该函数将自动创建具有EKS集群Url的OIDC提供程序。问题是指纹。我无法创建相同的指纹，这导致集群自动缩放器pod失败。有没有什么方法可以通过lambda函数创建指纹?下面是lambda函数的代码。此指纹为样本。

import boto3
import json
import cfnresponse

def lambda_handler(event, context):

client = boto3.client('iam')
name=  event['ResourceProperties']['cluster_name']
responseData= {}
responseStatus="SUCCESS"

try:
print("In thetry block")
if event['RequestType'] == 'Delete':
print("Request Type:",event['RequestType'])
print("Delete Request - No Physical resources to delete")
elif event['RequestType'] == 'Create' or event['RequestType'] == 'Update':
print("The request type is updated")
response2 = client.create_open_id_connect_provider(
ClientIDList=[
'my-application-id',
],
ThumbprintList=[
'3768084dfb3d2b68b7897bf5f565da8efEXAMPLE',
],
Url=fetchClusterOIDC(name),
)
print("The OIDC Created")
oidc_response_url = fetchClusterOIDC(name)
oidc_response=oidc_response_url.split("https://")[1]

responseData = {'oidc': oidc_response}
print("Responsedata Created",responseData)
print("Request Type:",event['RequestType'])
print("Sending response to custom resource for event type " + event['RequestType'])
cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData)
except Exception as e:
print(e)
responseData = {'Failed': 'Test Failed.'}
responseStatus="FAILED"
cfnresponse.send(event, context, cfnresponse.FAILED, responseData)  

def fetchClusterOIDC(cluster_name):
print("Getting Cluster OIDC value for cluster name "+ cluster_name)
oidc = ''
client = boto3.client('eks')
try:
response = client.describe_cluster(
name=cluster_name
)
if response['ResponseMetadata']['HTTPStatusCode'] == 200:
print("Success response recieved for describing cluster "+ cluster_name)
oidc = (response['cluster']['identity']['oidc']['issuer'])
print('OIDC output recieved '+ oidc + ' for Cluster Name ' + cluster_name)
return oidc
except Exception as e:
print('Failed to fetch Cluster OIDC value for cluster name ' + cluster_name, e)

Answer 1

我使用了aws api而不是Lambda函数。cloudformation脚本在输出中给出OIDC url和CertificateAuthority。之后，我运行bash脚本，它自动运行并生成拇指指纹，我们可以使用Aws api使用生成的url和拇指指纹创建OIDC提供者。

按照下面的链接生成拇指指纹:https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_oidc_verify-thumbprint.html

在这里，我们可以直接解码由EKS集群提供的CertificateAuthority，而不是执行步骤4。解码命令为:echo -n ' certificateauthority '| base64——decode

这将生成证书，使您的工作更容易。

我发现这种方法比创建lambda函数和生成OIDC提供程序要容易得多。