new: Learning Paths merging into main: Developer and Operator + Kubernetes Basic section.

.github/workflows/test-fastpaths.yaml

@@ -0,0 +1,100 @@
+name: Test - Fastpaths
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 7 * * 5"
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  run-tests:
+    if: github.repository == 'aws-samples/eks-workshop-v2'
+    name: run-tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v5
+      - name: Install utilities
+        run: |
+          sudo apt install -y gettext
+
+          mkdir -p ${HOME}/.local/bin
+          wget -q https://github.com/jckuester/awsweeper/releases/download/v0.12.0/awsweeper_0.12.0_linux_amd64.tar.gz
+          tar zxf awsweeper_0.12.0_linux_amd64.tar.gz
+          mv awsweeper_0.12.0_linux_amd64/awsweeper ${HOME}/.local/bin
+
+          chmod +x ${HOME}/.local/bin/*
+
+          echo "${HOME}/.local/bin" >> $GITHUB_PATH
+      - name: Set cluster ID
+        env:
+          RUN_ID: "${{ github.job }}"
+          AWS_REGION: "${{ secrets.AWS_REGION }}"
+        run: |
+          CLUSTER_ID=$(echo $RANDOM | md5sum | head -c 8)
+          echo "Using cluster ID ${CLUSTER_ID}"
+          echo "CLUSTER_ID=$CLUSTER_ID" >> $GITHUB_ENV
+      - name: Get AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4.3.1
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          role-duration-seconds: 3600
+          aws-region: ${{ secrets.AWS_REGION }}
+          role-session-name: GithubActionsSession-${{ env.CLUSTER_ID }}
+      - name: Create infrastructure
+        id: create-infrastructure
+        env:
+          AWS_REGION: "${{ secrets.AWS_REGION }}"
+        run: |
+          make create-infrastructure environment="$CLUSTER_ID"
+      - name: Refresh AWS credentials
+        if: always()
+        uses: aws-actions/configure-aws-credentials@v4.3.1
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          role-duration-seconds: 3600
+          aws-region: ${{ secrets.AWS_REGION }}
+          role-session-name: GithubActionsSession-${{ env.CLUSTER_ID }}
+      - name: Run tests - Fastpaths
+        env:
+          DOCKER_BUILDKIT: 1
+          DEV_MODE: 1
+          AWS_REGION: "${{ secrets.AWS_REGION }}"
+          DOCKER_DNS_OVERRIDE: "8.8.8.8"
+        run: |
+          export AWS_DEFAULT_REGION="$AWS_REGION"
+          bash hack/run-tests.sh "$CLUSTER_ID" "-" "{fastpaths/getting-started,fastpaths/getting-started/**,fastpaths/operator,fastpaths/operator/**,fastpaths/developer,fastpaths/developer/**}"
+      - name: Refresh AWS credentials
+        if: always()
+        uses: aws-actions/configure-aws-credentials@v4.3.1
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          role-duration-seconds: 3600
+          aws-region: ${{ secrets.AWS_REGION }}
+          role-session-name: GithubActionsSession-${{ env.CLUSTER_ID }}
+      - name: Run tests - Cleanup
+        if: always()
+        env:
+          DOCKER_BUILDKIT: 1
+          DEV_MODE: 1
+          AWS_REGION: "${{ secrets.AWS_REGION }}"
+        run: |
+          export AWS_DEFAULT_REGION="$AWS_REGION"
+          make test environment="$CLUSTER_ID" module="cleanup"
+      - name: Refresh AWS credentials
+        if: always()
+        uses: aws-actions/configure-aws-credentials@v4.3.1
+        with:
+          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
+          role-duration-seconds: 3600
+          aws-region: ${{ secrets.AWS_REGION }}
+          role-session-name: GithubActionsSession-${{ env.CLUSTER_ID }}
+      - name: Cleanup environment
+        if: always()
+        env:
+          AWS_REGION: "${{ secrets.AWS_REGION }}"
+        run: |
+          make destroy-infrastructure environment="$CLUSTER_ID"

Makefile

@@ -4,15 +4,28 @@ environment=''
 shell_command=''
 shell_simple_command=''
 glob='-'
+cluster='all'
 
 .PHONY: install
 install:
 	yarn install
 
+.PHONY: build
+build: install
+	yarn build
+
+.PHONY: warning
+warning:
+	@echo "Note: 'make serve' now does a full static build. For dev mode, use 'make start' instead."
+
 .PHONY: serve
-serve: install
+serve: warning build
 	yarn serve
 
+.PHONY: start
+start: install
+	yarn start
+
 .PHONY: tf-fmt
 tf-fmt:
 	cd ./terraform && terraform fmt --recursive
@@ -39,11 +52,11 @@ delete-environment:
 
 .PHONY: create-infrastructure
 create-infrastructure:
-	bash hack/create-infrastructure.sh $(environment)
+	bash hack/create-infrastructure.sh $(environment) $(cluster)
 
 .PHONY: destroy-infrastructure
 destroy-infrastructure:
-	bash hack/destroy-infrastructure.sh $(environment)
+	bash hack/destroy-infrastructure.sh $(environment) $(cluster)
 
 .PHONY: deploy-ide
 deploy-ide:
@@ -55,4 +68,5 @@ destroy-ide:
 
 .PHONY: lint
 lint:
-	yarn lint
+	yarn lint
+

cluster/eksctl/access-entries.yaml

@@ -0,0 +1,6 @@
+  accessEntries:
+    - principalARN: ${RESOURCE_CODEBUILD_ROLE_ARN}
+      accessPolicies:
+        - policyARN: "arn:aws:eks::aws:cluster-access-policy/AmazonEKSClusterAdminPolicy"
+          accessScope:
+            type: cluster

cluster/eksctl/cluster-auto.yaml

@@ -0,0 +1,25 @@
+apiVersion: eksctl.io/v1alpha5
+kind: ClusterConfig
+availabilityZones:
+  - ${AWS_REGION}a
+  - ${AWS_REGION}b
+  - ${AWS_REGION}c
+metadata:
+  name: ${EKS_CLUSTER_AUTO_NAME}
+  region: ${AWS_REGION}
+  version: "1.33"
+  tags:
+    karpenter.sh/discovery: ${EKS_CLUSTER_AUTO_NAME}
+    created-by: eks-workshop-v2
+    env: ${EKS_CLUSTER_AUTO_NAME}
+vpc:
+  cidr: 10.43.0.0/16
+  clusterEndpoints:
+    privateAccess: true
+    publicAccess: true
+autoModeConfig:
+  enabled: true
+  nodePools: [general-purpose, system]
+accessConfig:
+  authenticationMode: API
+  bootstrapClusterCreatorAdminPermissions: true

cluster/eksctl/cluster.yaml

@@ -40,4 +40,7 @@ remoteNetworkConfig:
   remoteNodeNetworks:
     - cidrs: ["10.52.0.0/16"]
   remotePodNetworks:
-    - cidrs: ["10.53.0.0/16"]
+    - cidrs: ["10.53.0.0/16"]
+accessConfig:
+  authenticationMode: API
+  bootstrapClusterCreatorAdminPermissions: true

docs/style_guide.md

@@ -64,6 +64,14 @@ sidebar_custom_props:
 ---
 ```
 
+To mark your module as optional:
+```
+---
+...
+sidebar_custom_props:  { "optional": "true" }
+---
+```
+
 ### Navigating the AWS console
 
 There are instances where the user needs to navigate to specific screens in the AWS console. It is preferable to provide a link to the exact screen if possible, or a close as can be done.

hack/create-infrastructure.sh

@@ -1,6 +1,9 @@
 #!/bin/bash
 
 environment=$1
+cluster=${2:-all}
+export USE_CURRENT_USER=${USE_CURRENT_USER:-1} # We don't want to change the ARN in exec
+echo "Creating infrastructure for environment ${environment} and cluster ${cluster}"
 
 set -Eeuo pipefail
 set -u
@@ -13,12 +16,30 @@ bash $SCRIPT_DIR/update-iam-role.sh $environment
 
 sleep 5
 
+pids=()
+
 cluster_exists=0
 aws eks describe-cluster --name "${EKS_CLUSTER_NAME}" &> /dev/null || cluster_exists=$?
 
-if [ $cluster_exists -eq 0 ]; then
+if [ $cluster_exists -ne 0 ] && [[ "$cluster" == "standard" || "$cluster" == "all" ]]; then
+  echo "Creating cluster ${EKS_CLUSTER_NAME}"
+  bash $SCRIPT_DIR/exec.sh "${environment}" 'cat /cluster/eksctl/cluster.yaml /cluster/eksctl/access-entries.yaml | envsubst | eksctl create cluster -f -' &
+  pids+=($!)
+else
   echo "Cluster ${EKS_CLUSTER_NAME} already exists"
+fi
+
+auto_cluster_exists=0
+aws eks describe-cluster --name "${EKS_CLUSTER_AUTO_NAME}" &> /dev/null || auto_cluster_exists=$?
+
+if [ $auto_cluster_exists -ne 0 ] && [[ "$cluster" == "auto" || "$cluster" == "all" ]]; then
+  echo "Creating auto mode cluster ${EKS_CLUSTER_AUTO_NAME}"
+  bash $SCRIPT_DIR/exec.sh "${environment}" 'cat /cluster/eksctl/cluster-auto.yaml /cluster/eksctl/access-entries.yaml | envsubst | eksctl create cluster -f -' &
+  pids+=($!)
 else
-  echo "Creating cluster ${EKS_CLUSTER_NAME}"
-  bash $SCRIPT_DIR/exec.sh "${environment}" 'cat /cluster/eksctl/cluster.yaml | envsubst | eksctl create cluster -f -'
-fi
+  echo "Auto mode cluster ${EKS_CLUSTER_AUTO_NAME} already exists"
+fi
+
+for pid in "${pids[@]}"; do
+  wait "$pid" || exit 1
+done

hack/deploy-ide-cfn.sh

@@ -10,5 +10,13 @@ outfile=$(mktemp)
 
 bash $SCRIPT_DIR/build-ide-cfn.sh $outfile
 
+REPOSITORY_OWNER=${REPOSITORY_OWNER:-"aws-samples"}
+REPOSITORY_NAME=${REPOSITORY_NAME:-"eks-workshop-v2"}
+REPOSITORY_REF=${REPOSITORY_REF:-"main"}
+
 aws cloudformation deploy --stack-name "$EKS_CLUSTER_NAME-ide" \
-  --capabilities CAPABILITY_NAMED_IAM --disable-rollback --template-file $outfile
+  --capabilities CAPABILITY_NAMED_IAM --disable-rollback --template-file $outfile \
+  --parameter-overrides \
+    RepositoryOwner="$REPOSITORY_OWNER" \
+    RepositoryName="$REPOSITORY_NAME" \
+    RepositoryRef="$REPOSITORY_REF"

hack/destroy-infrastructure.sh

@@ -1,24 +1,43 @@
 #!/bin/bash
 
 environment=$1
+cluster=${2:-all}
+echo "Destroying infrastructure for environment ${environment} and cluster ${cluster}"
 
 set -Eeuo pipefail
 set -u
 
 SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
-
+export USE_CURRENT_USER=1;
 source $SCRIPT_DIR/lib/common-env.sh
 
 cluster_exists=0
 aws eks describe-cluster --name "${EKS_CLUSTER_NAME}" &> /dev/null || cluster_exists=$?
 
-if [ $cluster_exists -eq 0 ]; then
+if [ $cluster_exists -eq 0 ] && [[ "$cluster" == "standard" || "$cluster" == "all" ]]; then
   echo "Deleting cluster ${EKS_CLUSTER_NAME}"
   bash $SCRIPT_DIR/shell.sh "${environment}" 'delete-environment' || true
+  bash $SCRIPT_DIR/exec.sh "${environment}" 'eksctl delete cluster --name ${EKS_CLUSTER_NAME} --region ${AWS_REGION} --wait --force --disable-nodegroup-eviction --timeout 45m'&
+else
+  echo "Cluster ${EKS_CLUSTER_NAME} does not exist or skipped"
+fi
 
-  bash $SCRIPT_DIR/exec.sh "${environment}" 'eksctl delete cluster --name ${EKS_CLUSTER_NAME} --region ${AWS_REGION} --wait --force --disable-nodegroup-eviction --timeout 45m'
+export EKS_CLUSTER_AUTO_NAME="${EKS_CLUSTER_AUTO_NAME}"
+auto_cluster_exists=0
+aws eks describe-cluster --name "${EKS_CLUSTER_AUTO_NAME}" &> /dev/null || auto_cluster_exists=$?
+
+if [ $auto_cluster_exists -eq 0 ] && [[ "$cluster" == "auto" || "$cluster" == "all" ]]; then
+  echo "Deleting auto mode cluster ${EKS_CLUSTER_AUTO_NAME}"
+  #bash $SCRIPT_DIR/shell.sh "${environment}" 'delete-environment' || true # Needed ?
+  bash $SCRIPT_DIR/exec.sh "${environment}" 'eksctl delete cluster --name ${EKS_CLUSTER_AUTO_NAME} --region ${AWS_REGION} --wait --force --disable-nodegroup-eviction --timeout 45m'
 else
-  echo "Cluster ${EKS_CLUSTER_NAME} does not exist"
+  echo "Auto mode cluster ${EKS_CLUSTER_AUTO_NAME} does not exist or skipped"
 fi
 
-aws cloudformation delete-stack --stack-name ${EKS_CLUSTER_NAME}-ide-role || true
+wait
+
+# Only delete ide-role if all clusters are deleted
+if [ "$cluster" == "all" ]; then
+  aws cloudformation delete-stack --stack-name ${EKS_CLUSTER_NAME}-ide-role || true
+  echo "Deleted role"
+fi

hack/exec.sh

@@ -19,9 +19,19 @@ container_image='eks-workshop-environment'
 
 (cd $SCRIPT_DIR/../lab && $CONTAINER_CLI build -q -t $container_image .)
 
-if [ -z "$SKIP_CREDENTIALS" ]; then
+
+if [ "${SKIP_CREDENTIALS:-0}" = "0" ] && [ "${USE_CURRENT_USER:-0}" = "0" ]; then
+  echo "Passing temp AWS credentials"
   source $SCRIPT_DIR/lib/generate-aws-creds.sh
+elif [ "${USE_CURRENT_USER:-0}" != "0" ]; then
+  if [ -z "$AWS_ACCESS_KEY_ID" ]; then
+    echo "No AWS_ACCESS_KEY_ID found, please check your AWS credentials"
+    exit 1
+  fi
+  echo "Using USE_CURRENT_USER"
+  aws_credential_args="-e AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID -e AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY -e AWS_SESSION_TOKEN=${AWS_SESSION_TOKEN:-}"
 else
+  echo "Using DEFAULT no credentials passed"
   aws_credential_args=""
 fi
 
@@ -31,5 +41,6 @@ $CONTAINER_CLI run --rm \
   -v $SCRIPT_DIR/../manifests:/manifests \
   -v $SCRIPT_DIR/../cluster:/cluster \
   --entrypoint /bin/bash \
-  -e 'EKS_CLUSTER_NAME' -e 'AWS_REGION' -e 'AWS_CONTAINER_CREDENTIALS_RELATIVE_URI' \
+  -e "RESET_NO_DELETE=true" \
+  -e 'EKS_CLUSTER_NAME' -e 'EKS_CLUSTER_AUTO_NAME'  -e 'AWS_REGION' -e 'AWS_CONTAINER_CREDENTIALS_RELATIVE_URI' -e RESOURCE_CODEBUILD_ROLE_ARN \
   $aws_credential_args $container_image -c "$shell_command"

hack/lib/common-env.sh

@@ -2,8 +2,10 @@ environment=${environment:-""}
 
 if [ -z "$environment" ]; then
   export EKS_CLUSTER_NAME="eks-workshop"
+  export EKS_CLUSTER_AUTO_NAME="eks-workshop-auto"
 else
   export EKS_CLUSTER_NAME="eks-workshop-${environment}"
+  export EKS_CLUSTER_AUTO_NAME="eks-workshop-${environment}-auto"
 fi
 
 AWS_REGION=${AWS_REGION:-""}
@@ -15,6 +17,8 @@ if [ -z "$AWS_REGION" ]; then
 fi
 
 SKIP_CREDENTIALS=${SKIP_CREDENTIALS:-""}
+USE_CURRENT_USER=${USE_CURRENT_USER:-""}
+AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID:-""} # We check the access key
 
 if [ -z "$SKIP_CREDENTIALS" ]; then
   ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
@@ -23,4 +27,9 @@ if [ -z "$SKIP_CREDENTIALS" ]; then
   IDE_ROLE_ARN="arn:aws:iam::${ACCOUNT_ID}:role/${IDE_ROLE_NAME}"
 fi
 
+# Set RESOURCE_CODEBUILD_ROLE_ARN if not already provided (e.g. by Workshop Studio)
+if [ -z "${RESOURCE_CODEBUILD_ROLE_ARN:-}" ]; then
+  export RESOURCE_CODEBUILD_ROLE_ARN="${IDE_ROLE_ARN:-}"
+fi
+
 export DOCKER_CLI_HINTS="false"