Allow passing scalar security group properties to node groups (#1446)

This change builds on top of #1445 and makes `NodeGroup` & `NodeGroupV2` accept the scalar security group properties introduced in that PR. This way users can connect their node groups to the cluster without having to use any applies.
pulumi · Oct 16, 2024 · d40deeb · d40deeb
1 parent 1e2e4aa
commit d40deeb
Show file tree

Hide file tree

Showing 28 changed files with 1,169 additions and 78 deletions.
diff --git a/examples/examples_nodejs_test.go b/examples/examples_nodejs_test.go
@@ -923,6 +923,23 @@ func TestAccSelfManagedNodeGroupOS(t *testing.T) {
 
 				assert.NoError(t, utils.ValidateNodePodCapacity(t, info.Outputs["kubeconfig"], 4, 100, "increased-pod-capacity"))
 				assert.NoError(t, utils.ValidateNodeStorage(t, info.Outputs["kubeconfig"], 4, 100*1_000_000_000, "increased-storage-capacity"))
+
+				// Validate that nodeSecurityGroupId is set to the security group passed in as an input
+				require.NotNil(t, info.Outputs["standardNodeSecurityGroup"])
+				require.NotNil(t, info.Outputs["standardNodeSecurityGroupV2"])
+				standardSecurityGroup := info.Outputs["standardNodeSecurityGroup"].(map[string]interface{})
+				standardSecurityGroupV2 := info.Outputs["standardNodeSecurityGroupV2"].(map[string]interface{})
+				assert.Equal(t, standardSecurityGroup["id"], info.Outputs["standardNodeSecurityGroupId"])
+				assert.Equal(t, standardSecurityGroupV2["id"], info.Outputs["standardNodeSecurityGroupIdV2"])
+
+				// Validate that the nodeSecurityGroupId is set to security group ID passed in as an input
+				assert.Nil(t, info.Outputs["customNodeSecurityGroup"])
+				assert.Nil(t, info.Outputs["customNodeSecurityGroupV2"])
+				require.NotEmpty(t, info.Outputs["clusterNodeSecurityGroupId"])
+				clusterNodeGroupId := info.Outputs["clusterNodeSecurityGroupId"].(string)
+
+				assert.Equal(t, clusterNodeGroupId, info.Outputs["customNodeSecurityGroupId"])
+				assert.Equal(t, clusterNodeGroupId, info.Outputs["customNodeSecurityGroupIdV2"])
 			},
 		})
 

diff --git a/examples/tests/migrate-nodegroups/utils.ts b/examples/tests/migrate-nodegroups/utils.ts
@@ -16,8 +16,8 @@ export function createNodeGroup(
 ): eks.NodeGroup {
     return new eks.NodeGroup(name, {
         cluster: args.cluster,
-        nodeSecurityGroup: args.cluster.nodeSecurityGroup.apply(v => v!),
-        clusterIngressRule: args.cluster.eksClusterIngressRule.apply(v => v!),
+        nodeSecurityGroupId: args.cluster.nodeSecurityGroupId,
+        clusterIngressRuleId: args.cluster.clusterIngressRuleId,
         instanceType: args.instanceType,
         nodeAssociatePublicIpAddress: false,
         desiredCapacity: args.desiredCapacity,

diff --git a/examples/tests/self-managed-ng-os/index.ts b/examples/tests/self-managed-ng-os/index.ts
@@ -186,3 +186,32 @@ const nodeGroupBottlerocketUserdata = new eks.NodeGroupV2("bottlerocket-userdata
     },
   },
 });
+
+const nodegroupWithSecurityGroupId = new eks.NodeGroup("ng-security-group-id", {
+  ...capacity,
+  cluster: cluster,
+  instanceType: "t3.medium",
+  instanceProfile: instanceProfile,
+  nodeSecurityGroupId: cluster.nodeSecurityGroupId,
+  clusterIngressRuleId: cluster.clusterIngressRuleId,
+});
+
+const nodegroupV2WithSecurityGroupId = new eks.NodeGroupV2("ng-security-group-id", {
+  ...capacity,
+  cluster: cluster,
+  instanceType: "t3.medium",
+  instanceProfile: instanceProfile,
+  nodeSecurityGroupId: cluster.nodeSecurityGroupId,
+  clusterIngressRuleId: cluster.clusterIngressRuleId,
+});
+
+export const standardNodeSecurityGroup = nodeGroupAL2023V1.nodeSecurityGroup;
+export const standardNodeSecurityGroupId = nodeGroupAL2023V1.nodeSecurityGroupId;
+export const standardNodeSecurityGroupV2 = nodeGroupAL2023.nodeSecurityGroup;
+export const standardNodeSecurityGroupIdV2 = nodeGroupAL2023.nodeSecurityGroupId;
+
+export const clusterNodeSecurityGroupId = cluster.nodeSecurityGroupId;
+export const customNodeSecurityGroup = nodegroupWithSecurityGroupId.nodeSecurityGroup;
+export const customNodeSecurityGroupId = nodegroupWithSecurityGroupId.nodeSecurityGroupId;
+export const customNodeSecurityGroupV2 = nodegroupV2WithSecurityGroupId.nodeSecurityGroup;
+export const customNodeSecurityGroupIdV2 = nodegroupV2WithSecurityGroupId.nodeSecurityGroupId;
diff --git a/nodejs/eks/cmd/provider/nodegroup.ts b/nodejs/eks/cmd/provider/nodegroup.ts
@@ -28,6 +28,7 @@ const nodeGroupProvider: pulumi.provider.Provider = {
                 urn: nodegroup.urn,
                 state: {
                     nodeSecurityGroup: nodegroup.nodeSecurityGroup,
+                    nodeSecurityGroupId: nodegroup.nodeSecurityGroupId,
                     extraNodeSecurityGroups: nodegroup.extraNodeSecurityGroups,
                     cfnStack: nodegroup.cfnStack,
                     autoScalingGroupName: nodegroup.autoScalingGroupName,
@@ -85,6 +86,7 @@ const nodeGroupV2Provider: pulumi.provider.Provider = {
                 urn: nodegroup.urn,
                 state: {
                     nodeSecurityGroup: nodegroup.nodeSecurityGroup,
+                    nodeSecurityGroupId: nodegroup.nodeSecurityGroupId,
                     extraNodeSecurityGroups: nodegroup.extraNodeSecurityGroups,
                     autoScalingGroup: nodegroup.autoScalingGroup,
                 },