EKS: Kubectl Lambda Function Doesn't Support Regional STS Endpoints #30496
Description
Describe the bug
When deploying a private EKS cluster using an STS VPC endpoint, the Kubetctl function access to STS fails because it attempts to use the global endpoint. This is either from using a V1 SDK, the endpoint is explicitly set, or the environment variable is set
Expected Behavior
All SDKs and functions not under user control should default to using regional STS endpoints.
Current Behavior
The function uses the global endpoint.
Reproduction Steps
Deploy a private EKS cluster with an STS VPC endpoint.
Possible Solution
Set the environment variable in the Lambda function definition. This is my current workaround:
FixUpLambdaFunctions("@aws-cdk--aws-eks.KubectlProvider");
private void FixUpLambdaFunctions(string name)
{
IConstruct resourceProviderNestedStack = this.Node.TryFindChild(name);
if (resourceProviderNestedStack != null)
{
NestedStack nestedStack = resourceProviderNestedStack as NestedStack;
if (nestedStack != null)
{
Function lambda = nestedStack.Node.TryFindChild("Handler") as Function;
if (lambda != null)
{
lambda.AddEnvironment("AWS_STS_REGIONAL_ENDPOINTS", "regional");
}
IConstruct provider = nestedStack.Node.TryFindChild("Provider");
Function onEvent = provider.Node.TryFindChild("framework-onEvent") as Function;
if (onEvent != null)
{
onEvent.AddEnvironment("AWS_STS_REGIONAL_ENDPOINTS", "regional");
}
}
}
}Additional Information/Context
No response
CDK CLI Version
2.138.0
Framework Version
No response
Node.js Version
v20.9.0
OS
darwin
Language
.NET
Language Version
No response
Other information
No response