{"id":24637969,"url":"https://github.com/upbound/configuration-aws-eks-pod-identity","last_synced_at":"2025-03-20T09:25:50.905Z","repository":{"id":253402299,"uuid":"843366475","full_name":"upbound/configuration-aws-eks-pod-identity","owner":"upbound","description":null,"archived":false,"fork":false,"pushed_at":"2025-03-14T10:44:52.000Z","size":90,"stargazers_count":2,"open_issues_count":5,"forks_count":0,"subscribers_count":14,"default_branch":"main","last_synced_at":"2025-03-15T02:50:21.371Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Makefile","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/upbound.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-08-16T11:05:25.000Z","updated_at":"2025-03-05T14:14:14.000Z","dependencies_parsed_at":"2024-08-16T13:57:37.459Z","dependency_job_id":"74391aaf-497e-452f-afba-aa15f20ce178","html_url":"https://github.com/upbound/configuration-aws-eks-pod-identity","commit_stats":null,"previous_names":["upbound/configuration-aws-eks-pod-identity"],"tags_count":5,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/upbound%2Fconfiguration-aws-eks-pod-identity","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/upbound%2Fconfiguration-aws-eks-pod-identity/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/upbound%2Fconfiguration-aws-eks-pod-identity/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/upbound%2Fconfiguration-aws-eks-pod-identity/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/upbound","download_url":"https://codeload.github.com/upbound/configuration-aws-eks-pod-identity/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244584474,"owners_count":20476553,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-01-25T10:12:40.639Z","updated_at":"2025-03-20T09:25:50.881Z","avatar_url":"https://github.com/upbound.png","language":"Makefile","funding_links":[],"categories":[],"sub_categories":[],"readme":"# AWS EKS Pod Identity Configuration\n\nAt a high level, EKS Pod Identity allows you to use the AWS API to define permissions that specific Kubernetes service accounts should have in AWS:\n\n## Configuration\nThis configuration is for implementing AWS EKS Pod Identity, which involves creating the IAM Role and configuring the EKS PodIdentityAssociation.\n\n```bash\napiVersion: pkg.crossplane.io/v1\nkind: Configuration\nmetadata:\n  name: configuration-aws-eks-pod-identity\nspec:\n  package: xpkg.upbound.io/upbound/configuration-aws-eks-pod-identity:v0.1.0\n```\n\n## The How\n\nThe following step is automatically completed when you install your EKS Cluster using our predefined configuration for AWS EKS - which is installed as dependency per default:\n\n```bash\napiVersion: pkg.crossplane.io/v1\nkind: Configuration\nmetadata:\n  name: configuration-aws-eks\nspec:\n  package: xpkg.upbound.io/upbound/configuration-aws-eks:v0.12.0\n```\n\nSetting up Pod Identity starts by installing an add-on:\nhttps://github.com/aws/eks-pod-identity-agent\n\n```bash\naws eks create-addon \\\n  --cluster-name cluster-name \\\n  --addon-name eks-pod-identity-agent\n```\n\nThis sets up a new DaemonSet in the kube-system namespace:\n\n```bash\n$ kubectl get daemonset -n kube-system\nNAME                     DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE\neks-pod-identity-agent   2         2         2       2            2           \u003cnone\u003e\n```\n\n![pod-identity](images/s3-access-podidentity.png)\nhttps://github.com/awslabs/crossplane-on-eks\n\n### EKS Pod Identity at a glance\n\n```bash\naws eks create-pod-identity-association \\\n  --cluster-name your-cluster \\\n  --namespace default \\\n  --service-account pod-service-account \\\n  --role-arn arn:aws:iam::012345678901:role/YourPodRole\n```\n\nHere, YourPodRole has the following trust policy:\n\n```json\n{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [{\n    \"Effect\": \"Allow\",\n    \"Principal\": {\n      \"Service\": \"pods.eks.amazonaws.com\"\n    },\n    \"Action\": [\"sts:AssumeRole\",\"sts:TagSession\"]\n  }]\n}\n```\n\nOnce you’ve run the commands to configure Pod Identity, any pod that runs under the pod-service-account service account magically has access to AWS resources, through temporary Security Token Service (STS) credentials:\n\n```bash\n\n$ kubectl apply -f - \u003c\u003cEOF\napiVersion: v1\nkind: Pod\nmetadata:\n  name: pod-with-aws-access\nspec:\n  serviceAccountName: pod-service-account\n  containers:\n  - name: main\n    image: public.ecr.aws/aws-cli/aws-cli\n    command: [\"sleep\", \"infinity\"]\nEOF\n\n$ kubectl exec pod/pod-with-aws-access -- aws sts get-caller-identity\n{\n    \"UserId\": \"XXXX\",\n    \"Account\": \"012345678901\",\n    \"Arn\": \"arn:aws:sts::012345678901:assumed-role/YourPodRole/eks-cluster-pod-xxx\"\n}\n\n```\n\nFor a given EKS cluster, you can easily see which pods have access to AWS resources using eks:ListPodIdentityAssociations:\n\n```bash\naws eks list-pod-identity-associations --cluster-name your-cluster\n\n{\n  \"associations\": [{\n    {\n            \"clusterName\": \"your-cluster\",\n            \"namespace\": \"default\",\n            \"serviceAccount\": \"pod-service-account\",\n            \"associationArn\": \"arn:aws:eks:us-east-1:012345678901:podidentityassociation/your-cluster/a-0123\",\n            \"associationId\": \"a-0123\"\n        },\n\n  }]\n}\n```\n\nThen, you can use eks:DescribePodIdentityAssociation to retrieve the ARN of the role it maps to:\n\n```bash\naws eks describe-pod-identity-association \\\n  --cluster-name your-cluster \\\n  --association-id a-0123\n\n{\n    \"association\": {\n        \"clusterName\": \"your-cluster\",\n        \"namespace\": \"default\",\n        \"serviceAccount\": \"pod-service-account\",\n        \"roleArn\": \"arn:aws:iam::012345678901:role/YourRole\"\n    }\n}\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fupbound%2Fconfiguration-aws-eks-pod-identity","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fupbound%2Fconfiguration-aws-eks-pod-identity","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fupbound%2Fconfiguration-aws-eks-pod-identity/lists"}