CDK-Lib EKS Constructs - Private repo support for artifacts

[elarsson1]

Describe the feature

Allow customers to specify private repositories for external artifacts referenced by AWS provided constructs. For example, the AWS Load Balancer Controller construct directly references the public GitHub repo for its Helm chart:

https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-eks/lib/alb-controller.ts#L273

Use Case

Security sensitive customers have requirements for all software artifacts to be sourced from internal vetted repos, that may take additional measures to ensure artifacts are immutable, and that consumption from upstream is vetted through organization required security checks. They cannot have.a deployment trigger a system to pull artifacts directly from a source on the internet.

Proposed Solution

Expose artifact URLs as configuration instead of hard coding them in construct libraries. Allow customers to override the artifact URL with a local URL or OCI compliant repository for supported artifacts, such as container images or Helm charts.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.92

Environment details (OS name and version, etc.)

Amazon Linux 2

[peterwoodworth]

Makes sense, thanks for the request.

[rix0rrr]

We can add a property to customize that URL.

[iliapolo]

As a workaround, you can use escape hatches:

const cluster = new eks.Cluster(this, 'Cluster', {
  version: eks.KubernetesVersion.V1_27,
  albController: {
    version: eks.AlbControllerVersion.V2_2_3,
  }
});

const albHelmChart = cluster.albController?.node.defaultChild as eks.HelmChart
const albCr = albHelmChart.node.defaultChild?.node.defaultChild as cdk.CfnResource
albCr.addPropertyOverride('Repository', '<my-company-repository>')

[manupatteri]

+1. Thank you @elarsson1 for raising this issue. We are definitely looking forward to a clean and easy solution as you have described.
Thanks for the workaround @iliapolo. I will try it out.

[caretak3r]

+1 Currently I have to host the image and helm chart package in ECR (privately), and add_helm_chart to the cluster to do this. Not even sure if some configurations are being missed going in this direction, versus using the construct's albController setup.