{"id":51418814,"url":"https://github.com/appthrust/aws-workload-identity-operator","last_synced_at":"2026-07-04T22:30:45.744Z","repository":{"id":354960953,"uuid":"1222311347","full_name":"appthrust/aws-workload-identity-operator","owner":"appthrust","description":null,"archived":false,"fork":false,"pushed_at":"2026-06-30T05:42:42.000Z","size":491,"stargazers_count":1,"open_issues_count":1,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-30T07:17:36.811Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/appthrust.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-04-27T08:38:42.000Z","updated_at":"2026-06-30T05:41:31.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/appthrust/aws-workload-identity-operator","commit_stats":null,"previous_names":["appthrust/aws-workload-identity-operator"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/appthrust/aws-workload-identity-operator","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/appthrust%2Faws-workload-identity-operator","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/appthrust%2Faws-workload-identity-operator/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/appthrust%2Faws-workload-identity-operator/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/appthrust%2Faws-workload-identity-operator/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/appthrust","download_url":"https://codeload.github.com/appthrust/aws-workload-identity-operator/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/appthrust%2Faws-workload-identity-operator/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35138074,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-04T02:00:05.987Z","response_time":113,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-07-04T22:30:45.592Z","updated_at":"2026-07-04T22:30:45.720Z","avatar_url":"https://github.com/appthrust.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# aws-workload-identity-operator\n\n`aws-workload-identity-operator` binds Kubernetes `ServiceAccount` identities to\nAWS IAM roles across a fleet of clusters.\n\nThe operator runs on a hub cluster. It discovers target clusters through the\nCluster Inventory API, writes remote Kubernetes resources through\nmulticluster-runtime, and treats ACK custom resources as the source of truth for\nAWS IAM, S3 bucket, and EKS resources.\n\n## Delivery Types\n\nThe public workload API is the same for all delivery mechanisms:\n\n- `SelfHostedIRSA`: for self-hosted Kubernetes clusters that use AWS web identity\n  federation through a platform-managed OIDC issuer.\n- `EKSIRSA`: for managed EKS clusters that use the native EKS OIDC issuer and\n  IAM Roles for Service Accounts.\n- `EKSPodIdentity`: for managed EKS clusters that use EKS Pod Identity\n  associations.\n\nSee [delivery types](docs/concepts/delivery-types.md) for the decision model and\nrequired cluster facts.\n\n## Design\n\nThe operator owns four API types in `aws.identity.appthrust.io/v1alpha1`:\n\n- `AWSWorkloadIdentityOperatorConfig`: cluster-scoped platform defaults.\n- `AWSWorkloadIdentityConfig`: namespace-scoped target-cluster identity\n  configuration.\n- `AWSServiceAccountRole`: namespace-scoped binding from one remote Kubernetes\n  `ServiceAccount` to one generated IAM role.\n- `AWSServiceAccountRoleReplicaSet`: namespace-scoped fleet binding that creates\n  one `AWSServiceAccountRole` child per selected cluster namespace.\n\nThe hub namespace is the target-cluster boundary. ACK CRs are created in that\nhub namespace, and ACK reconciles those CRs into AWS resources.\n\n```mermaid\nflowchart LR\n  subgraph hub[\"Hub namespace\"]\n    operator[\"operator manager\"]\n    config[\"AWSWorkloadIdentityConfig/default\"]\n    role[\"AWSServiceAccountRole\"]\n    ack[\"ACK IAM/S3/EKS CRs\"]\n  end\n\n  subgraph inventory[\"Cluster Inventory\"]\n    profile[\"ClusterProfile\"]\n  end\n\n  subgraph target[\"Target cluster\"]\n    serviceAccount[\"ServiceAccount\"]\n    webhook[\"SelfHostedIRSA webhook runtime\"]\n    eksIssuer[\"EKS native OIDC issuer\"]\n    eksAgent[\"EKS Pod Identity Agent\"]\n    pods[\"Workload Pods\"]\n  end\n\n  subgraph aws[\"AWS\"]\n    iamRole[\"IAM Role\"]\n    iamOIDC[\"IAM OIDC Provider\"]\n    s3Bucket[\"S3 Bucket\"]\n    oidcObjects[\"OIDC discovery + JWKS objects\"]\n    podIdentity[\"EKS PodIdentityAssociation\"]\n    sts[\"STS\"]\n  end\n\n  operator --\u003e|reads/resolves| profile\n  profile --\u003e|target facts| config\n  config --\u003e role\n  role --\u003e ack\n  ack --\u003e iamRole\n  ack --\u003e iamOIDC\n  ack --\u003e s3Bucket\n  operator --\u003e oidcObjects\n  s3Bucket --\u003e oidcObjects\n  eksIssuer --\u003e iamOIDC\n  ack --\u003e podIdentity\n  role --\u003e serviceAccount\n  serviceAccount --\u003e pods\n  webhook --\u003e pods\n  eksAgent --\u003e pods\n  iamRole --\u003e sts\n  pods --\u003e sts\n```\n\nSee [architecture](docs/concepts/architecture.md) and\n[resource ownership](docs/concepts/resource-ownership.md) for the full model.\n\n## Prerequisites\n\n- Kubernetes 1.35 or newer.\n- Cluster Inventory API and `ClusterProfile` objects for target clusters.\n- For OCM, `ClusterProfile` access through the OCM access provider, backed by a\n  normal `ManagedClusterSetBinding` in the operator namespace.\n- ACK controllers for the selected delivery type: IAM and S3 for\n  `SelfHostedIRSA`; IAM for `EKSIRSA`; IAM and EKS for `EKSPodIdentity`.\n- AWS credentials for ACK controllers, plus S3 object write/delete permissions\n  for the manager when using `SelfHostedIRSA`.\n- cert-manager for the chart-managed validating webhook TLS.\n\nSee [compatibility and prerequisites](docs/reference/compatibility.md),\n[install with Helm](docs/guides/install-helm.md),\n[Cluster Inventory and OCM](docs/concepts/cluster-inventory-and-ocm.md), and\n[IAM permissions](docs/reference/iam-permissions.md).\n\n## Install\n\nInstall the operator from the Helm chart, or from a local chart checkout when\ntesting local changes. The command and chart setup details live in\n[Install With Helm](docs/guides/install-helm.md); full chart behavior and\nvalues live in the\n[chart README](charts/aws-workload-identity-operator/README.md).\n\n## Configure Platform Defaults\n\nCreate `AWSWorkloadIdentityOperatorConfig/default` before creating workload\nbindings. See [configure platform defaults](docs/guides/configure-platform-defaults.md).\n\n## Self-Hosted IRSA\n\nFor self-hosted clusters, use `AWSWorkloadIdentityConfig/default` with\n`spec.type: SelfHostedIRSA`, then create `AWSServiceAccountRole` bindings for\nremote service accounts. See\n[kubeadm and kind preparation](docs/guides/selfhosted-irsa-kubeadm-kind.md),\n[bind a service account](docs/guides/bind-service-account.md) and\n[SelfHostedIRSA behavior](docs/reference/operator-behavior.md#self-hosted-irsa-behavior).\n\n### Hub-Side Remote IRSA Consumers\n\nHub-side consumers are an advanced integration path for controllers or tools\nthat need AWS credentials for a remote `ServiceAccount` without running a Pod on\nthe target cluster. They are not part of the normal workload binding flow.\n\nSee [hub-side remote IRSA consumers](docs/guides/remote-irsa-consumers.md).\n\n### Manager IAM Policy\n\nFor `SelfHostedIRSA`, the manager verifies, writes, and deletes only the OIDC\ndiscovery and JWKS S3 objects directly with the AWS S3 API. See\n[IAM permissions](docs/reference/iam-permissions.md#selfhostedirsa-manager-policy).\n\n## EKS IRSA\n\nFor EKS clusters that use native IAM Roles for Service Accounts, use the same\nbinding API with `spec.type: EKSIRSA` and set `spec.eksIRSA.issuerURL` to the EKS\nOIDC issuer URL. `EKSIRSA` can manage the IAM OIDC provider through ACK IAM or\nreference an external provider ARN. It creates no self-hosted S3 issuer and no\nself-hosted webhook runtime. See\n[delivery types](docs/concepts/delivery-types.md#eksirsa) and\n[EKSIRSA behavior](docs/reference/operator-behavior.md#eksirsa-behavior).\n\n## EKS Pod Identity\n\nFor EKS clusters that use EKS Pod Identity, use the same binding API with\n`spec.type: EKSPodIdentity`.\n`EKSPodIdentity` creates no self-hosted OIDC issuer. See\n[delivery types](docs/concepts/delivery-types.md#eks-pod-identity) and\n[EKS Pod Identity behavior](docs/reference/operator-behavior.md#eks-pod-identity-behavior).\n\n## Fleet Bindings\n\nUse `AWSServiceAccountRoleReplicaSet` when an OCM `Placement` should fan out the\nsame binding to many selected cluster namespaces. See\n[fleet bindings](docs/guides/fleet-bindings.md).\n\n## Restrict IAM Policy Inputs\n\nThe operator validates the `AWSServiceAccountRole` API shape and generates IAM\nroles and trust policies, but platform-specific IAM allowlists belong in an\nadmission policy engine. See\n[restrict IAM policy inputs](docs/guides/restrict-iam-policy-inputs.md).\n\n## Observability\n\nThe manager metrics endpoint is always enabled. The Helm chart can render a\nPrometheus Operator `ServiceMonitor`, and logging is configured with\nOpenTelemetry-oriented values. See [observability](docs/operations/observability.md)\nand [metrics](docs/reference/metrics.md).\n\n## Documentation\n\nStart with the [documentation index](docs/README.md):\n\n- New users: [quickstart](docs/quickstart.md).\n- Platform operators: [install](docs/guides/install-helm.md), [configure\n  defaults](docs/guides/configure-platform-defaults.md), and\n  [bind service accounts](docs/guides/bind-service-account.md).\n- Example manifests: [examples](docs/examples/README.md).\n- Integrators: [hub-side remote IRSA consumers](docs/guides/remote-irsa-consumers.md).\n- Operators debugging behavior: [operator behavior](docs/reference/operator-behavior.md),\n  [status conditions](docs/reference/status-conditions.md), and\n  [cleanup](docs/operations/cleanup-and-force-delete.md).\n\n## Contributing\n\nDevelopment, testing, image build, and CI details are in\n[CONTRIBUTING.md](CONTRIBUTING.md).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fappthrust%2Faws-workload-identity-operator","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fappthrust%2Faws-workload-identity-operator","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fappthrust%2Faws-workload-identity-operator/lists"}