{"id":24377977,"url":"https://github.com/rochabr/dapr-eks-podidentity","last_synced_at":"2025-03-12T12:43:58.518Z","repository":{"id":268673867,"uuid":"905117072","full_name":"rochabr/dapr-eks-podidentity","owner":"rochabr","description":null,"archived":false,"fork":false,"pushed_at":"2025-02-19T00:31:31.000Z","size":14,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-02-19T01:26:01.250Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rochabr.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-12-18T07:40:13.000Z","updated_at":"2025-02-19T00:31:34.000Z","dependencies_parsed_at":"2025-02-19T01:24:12.814Z","dependency_job_id":"09120c50-ba64-4b16-bf1e-b6f8b71b6e1c","html_url":"https://github.com/rochabr/dapr-eks-podidentity","commit_stats":null,"previous_names":["rochabr/dapr-eks-podidentity"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rochabr%2Fdapr-eks-podidentity","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rochabr%2Fdapr-eks-podidentity/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rochabr%2Fdapr-eks-podidentity/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rochabr%2Fdapr-eks-podidentity/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rochabr","download_url":"https://codeload.github.com/rochabr/dapr-eks-podidentity/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243222184,"owners_count":20256220,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-01-19T06:17:41.010Z","updated_at":"2025-03-12T12:43:58.513Z","avatar_url":"https://github.com/rochabr.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Setting Up Dapr with AWS EKS Pod Identity, AWS Secrets Manager, and Amazon S3\n\nThis guide walks through setting up Dapr with AWS EKS Pod Identity for accessing AWS Secrets Manager and Amazon S3.\n\n## Prerequisites\n\n- AWS CLI configured with appropriate permissions\n- kubectl installed\n- eksctl installed\n- Docker installed and configured\n- A Docker Hub account or another container registry\n\n## Clone repository\n\n```bash\ngit clone https://github.com/rochabr/dapr-eks-podidentity.git\ncd dapr-eks-podidentity\n```\n\n## Create EKS Cluster and install Dapr\n\nFollow the official Dapr documentation for setting up an EKS cluster and installing Dapr:\n[Set up an Elastic Kubernetes Service (EKS) cluster](https://docs.dapr.io/operations/hosting/kubernetes/cluster/setup-eks/)\n\n## Create IAM Role and Enable Pod Identity\n\n1. Create IAM policy for Secrets Manager access:\n\n```bash\naws iam create-policy \\\n    --policy-name dapr-secrets-policy \\\n    --policy-document '{\n        \"Version\": \"2012-10-17\",\n        \"Statement\": [\n            {\n                \"Effect\": \"Allow\",\n                \"Action\": [\n                    \"secretsmanager:GetSecretValue\",\n                    \"secretsmanager:DescribeSecret\"\n                ],\n                \"Resource\": \"arn:aws:secretsmanager:YOUR_AWS_REGION:YOUR_ACCOUNT_ID:secret:*\"\n            }\n        ]\n    }'\n```\n\n2. Create IAM policy for S3 full access:\n\n```bash\naws iam create-policy \\\n    --policy-name dapr-s3-policy \\\n    --policy-document '{\n        \"Version\": \"2012-10-17\",\n        \"Statement\": [\n            {\n                \"Effect\": \"Allow\",\n                \"Action\": [\n                    \"s3:*\",\n                    \"s3-object-lambda:*\"\n                ],\n                \"Resource\": \"*\"\n            }\n        ]\n    }'\n```\n\n3. Create IAM role with Pod Identity trust relationship:\n\n```bash\naws iam create-role \\\n    --role-name dapr-pod-identity-role \\\n    --assume-role-policy-document '{\n        \"Version\": \"2012-10-17\",\n        \"Statement\": [\n            {\n                \"Effect\": \"Allow\",\n                \"Principal\": {\n                    \"Service\": \"pods.eks.amazonaws.com\"\n                },\n                \"Action\": [\n                    \"sts:AssumeRole\",\n                    \"sts:TagSession\"\n                ]\n            }\n        ]\n    }'\n```\n\n4. Attach the policies to the role:\n\n```bash\naws iam attach-role-policy \\\n    --role-name dapr-pod-identity-role \\\n    --policy-arn arn:aws:iam::YOUR_ACCOUNT_ID:policy/dapr-secrets-policy\n```\n\n```bash\naws iam attach-role-policy \\\n    --role-name dapr-pod-identity-role \\\n    --policy-arn arn:aws:iam::YOUR_ACCOUNT_ID:policy/dapr-s3-policy\n```\n\n## Create Test Resources\n\n1. Create namespace:\n\n```bash\nkubectl create namespace dapr-test\n```\n\n2. Create service account (`service-account.yaml`):\n\n```bash\nkubectl apply -f k8s-config/service-account.yaml\n```\n\n3. Create Pod Identity association:\n\n```bash\neksctl create podidentityassociation \\\n    --cluster [your-cluster-name] \\\n    --namespace dapr-test \\\n    --region [your-aws-region] \\\n    --service-account-name dapr-test-sa \\\n    --role-arn arn:aws:iam::YOUR_ACCOUNT_ID:role/dapr-pod-identity-role\n```\n\n4. Create a test secret in AWS Secrets Manager:\n\n```bash\naws secretsmanager create-secret \\\n    --name test-secret \\\n    --secret-string '{\"key\":\"value\"}' \\\n    --region [your-aws-region]\n```\n\n5. Create S3 bucket:\n\n```bash\naws s3api create-bucket --bucket [your-bucket-name] --region [your-aws-region]\n```\n\n6. Create Dapr component for AWS Secrets Manager (`aws-secretstore.yaml`) and AWS S3 (`aws-s3.yaml`):\n\n\u003e Update the necessary values on both component files before running the command below.\n\n```bash\nkubectl apply -f components/\n```\n\n## Deploy Test Application\n\n1. Build and push the Docker image:\n\n```bash\ncd app\ndocker build -t your-repository/dapr-secrets-test:latest .\ndocker push your-repository/dapr-secrets-test:latest\n```\n\n2. Apply the deployment:\n\n\u003e Update the `image` attribute by adding your repository name.\n\n```bash\nkubectl apply -f deploy/app.yaml\n```\n\n## Testing\n\n1. Check if the pod is running:\n\n```bash\nkubectl get pods -n dapr-test\n```\n\n2. Port forward to access the application:\n\n```bash\nkubectl port-forward -n dapr-test deploy/test-app 8080:8080\n```\n\n3. Test secret access:\n\n```bash\ncurl http://localhost:8080/test-secret\n```\n\n4. Test S3 access:\n\n```bash\ncurl -X POST -H \"Content-Type: application/json\" \\\n     -d '{\"data\": \"Hello World\"}' \\\n     http://localhost:8080/create-s3\n```\n\n## Troubleshooting\n\n### Authentication Issues\n\nIf you see \"You must be logged in to the server (Unauthorized)\", update your kubeconfig:\n\n```bash\naws eks update-kubeconfig --region [your-aws-region] --name [your-cluster-name]\n```\n\n### Pod Identity Issues\n\nVerify Pod Identity association:\n\n```bash\neksctl get podidentityassociation --cluster [your-cluster-name] --region [your-aws-region]\n```\n\n### Dapr Component Issues\n\nCheck Dapr sidecar logs:\n\n```bash\nkubectl logs -n dapr-test -l app=test-app -c daprd\n```\n\n## References\n\n- [EKS Pod Identity Documentation](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html)\n- [AWS Secrets Manager](https://docs.aws.amazon.com/secretsmanager/)\n- [Set up an Elastic Kubernetes Service (EKS) cluster](https://docs.dapr.io/operations/hosting/kubernetes/cluster/setup-eks/)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frochabr%2Fdapr-eks-podidentity","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frochabr%2Fdapr-eks-podidentity","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frochabr%2Fdapr-eks-podidentity/lists"}