Associates an identity provider configuration to a cluster.
If you want to authenticate identities using an identity provider, you can create an identity provider configuration and associate it to your cluster. After configuring authentication to your cluster you can create Kubernetes Role and ClusterRole objects, assign permissions to them, and then bind them to the identities using Kubernetes RoleBinding and ClusterRoleBinding objects. For more information see Using RBAC Authorization in the Kubernetes documentation.
Parameters:
-
cluster_name
(String)
–
The name of your cluster.
-
oidc
(OidcIdentityProviderConfigRequest)
–
An object representing an OpenID Connect (OIDC) identity provider configuration.
-
tags
(Optional[TagMap], default:
None
)
–
Metadata that assists with categorization and organization. Each tag consists of a key and an optional value. You define both. Tags don't propagate to any other cluster or Amazon Web Services resources.
-
client_request_token
(Optional[String], default:
None
)
–
A unique, case-sensitive identifier that you provide to ensure the idempotency of the request.
Raises:
-
ClientException
–
These errors are usually caused by a client action. Actions can include using an action or resource on behalf of an IAM principal that doesn't have permissions to use the action or resource or specifying an identifier that is not valid.
-
InvalidParameterException
–
The specified parameter is invalid. Review the available parameters for the API request.
-
InvalidRequestException
–
The request is invalid given the state of the cluster. Check the state of the cluster and the associated operations.
-
ResourceInUseException
–
The specified resource is in use.
-
ResourceNotFoundException
–
The specified resource could not be found. You can view your available clusters with ListClusters. You can view your available managed node groups with ListNodegroups. Amazon EKS clusters and node groups are Amazon Web Services Region specific.
-
ServerException
–
These errors are usually caused by a server-side issue.
-
ThrottlingException
–
The request or operation couldn't be performed because a service is throttling requests.
-
UnknownServiceError
–
The service returned an error code this client does not model.
Source code in docs_src/capo_eks/_services/eks.py
| def associate_identity_provider_config(
self,
cluster_name: "capo_eks.types.string.String",
oidc: "capo_eks.types.oidc_identity_provider_config_request.OidcIdentityProviderConfigRequest",
*,
config_overrides: Optional[EKSClientConfig] = None,
tags: Optional["capo_eks.types.tag_map.TagMap"] = None,
client_request_token: Optional["capo_eks.types.string.String"] = None,
) -> "capo_eks.types.associate_identity_provider_config_response.AssociateIdentityProviderConfigResponse":
"""<p>Associates an identity provider configuration to a cluster.</p> <p>If you want to authenticate identities using an identity provider, you can create an identity provider configuration and associate it to your cluster. After configuring authentication to your cluster you can create Kubernetes <code>Role</code> and <code>ClusterRole</code> objects, assign permissions to them, and then bind them to the identities using Kubernetes <code>RoleBinding</code> and <code>ClusterRoleBinding</code> objects. For more information see <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/">Using RBAC Authorization</a> in the Kubernetes documentation.</p>
Args:
cluster_name: <p>The name of your cluster.</p>
oidc: <p>An object representing an OpenID Connect (OIDC) identity provider configuration.</p>
tags: <p>Metadata that assists with categorization and organization. Each tag consists of a key and an optional value. You define both. Tags don't propagate to any other cluster or Amazon Web Services resources.</p>
client_request_token: <p>A unique, case-sensitive identifier that you provide to ensure the idempotency of the request.</p>
Raises:
capo_eks.errors.client_exception.ClientException: <p>These errors are usually caused by a client action. Actions can include using an action or resource on behalf of an <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html">IAM principal</a> that doesn't have permissions to use the action or resource or specifying an identifier that is not valid.</p>
capo_eks.errors.invalid_parameter_exception.InvalidParameterException: <p>The specified parameter is invalid. Review the available parameters for the API request.</p>
capo_eks.errors.invalid_request_exception.InvalidRequestException: <p>The request is invalid given the state of the cluster. Check the state of the cluster and the associated operations.</p>
capo_eks.errors.resource_in_use_exception.ResourceInUseException: <p>The specified resource is in use.</p>
capo_eks.errors.resource_not_found_exception.ResourceNotFoundException: <p>The specified resource could not be found. You can view your available clusters with <code>ListClusters</code>. You can view your available managed node groups with <code>ListNodegroups</code>. Amazon EKS clusters and node groups are Amazon Web Services Region specific.</p>
capo_eks.errors.server_exception.ServerException: <p>These errors are usually caused by a server-side issue.</p>
capo_eks.errors.throttling_exception.ThrottlingException: <p>The request or operation couldn't be performed because a service is throttling requests.</p>
capo_eks.errors.UnknownServiceError: The service returned an error code this client does not model.
"""
def _handler(
req: "OperationRequest[capo_eks.types.associate_identity_provider_config_request.AssociateIdentityProviderConfigRequest]",
) -> OperationResponse[
"capo_eks.types.associate_identity_provider_config_response.AssociateIdentityProviderConfigResponse"
]:
import capo_eks._operations.aws_wesley_frontend.associate_identity_provider_config
output, http_response = (
capo_eks._operations.aws_wesley_frontend.associate_identity_provider_config.associate_identity_provider_config(
req.options, req.input
)
)
return OperationResponse(output=output, response=http_response)
interceptors_, options_ = self.operation_options(
config_overrides, OperationLogging("AssociateIdentityProviderConfig")
)
input_: capo_eks.types.associate_identity_provider_config_request.AssociateIdentityProviderConfigRequest = {
"cluster_name": cluster_name,
"oidc": oidc,
}
if tags is not None:
input_["tags"] = tags
if client_request_token is None:
client_request_token = str(uuid.uuid4())
input_["client_request_token"] = client_request_token
response = execute_pipeline(
OperationRequest(input=input_, options=options_),
handler=_handler,
interceptors=list(interceptors_),
)
response.response.close()
return response.output
|