https://github.com/upbound/configuration-aws-eks-pod-identity
https://github.com/upbound/configuration-aws-eks-pod-identity
Last synced: over 1 year ago
JSON representation
- Host: GitHub
- URL: https://github.com/upbound/configuration-aws-eks-pod-identity
- Owner: upbound
- License: apache-2.0
- Created: 2024-08-16T11:05:25.000Z (almost 2 years ago)
- Default Branch: main
- Last Pushed: 2025-03-14T10:44:52.000Z (over 1 year ago)
- Last Synced: 2025-03-15T02:50:21.371Z (over 1 year ago)
- Language: Makefile
- Size: 87.9 KB
- Stars: 2
- Watchers: 14
- Forks: 0
- Open Issues: 5
-
Metadata Files:
- Readme: README.md
- License: LICENSE
- Codeowners: .github/CODEOWNERS
Awesome Lists containing this project
README
# AWS EKS Pod Identity Configuration
At a high level, EKS Pod Identity allows you to use the AWS API to define permissions that specific Kubernetes service accounts should have in AWS:
## Configuration
This configuration is for implementing AWS EKS Pod Identity, which involves creating the IAM Role and configuring the EKS PodIdentityAssociation.
```bash
apiVersion: pkg.crossplane.io/v1
kind: Configuration
metadata:
name: configuration-aws-eks-pod-identity
spec:
package: xpkg.upbound.io/upbound/configuration-aws-eks-pod-identity:v0.1.0
```
## The How
The following step is automatically completed when you install your EKS Cluster using our predefined configuration for AWS EKS - which is installed as dependency per default:
```bash
apiVersion: pkg.crossplane.io/v1
kind: Configuration
metadata:
name: configuration-aws-eks
spec:
package: xpkg.upbound.io/upbound/configuration-aws-eks:v0.12.0
```
Setting up Pod Identity starts by installing an add-on:
https://github.com/aws/eks-pod-identity-agent
```bash
aws eks create-addon \
--cluster-name cluster-name \
--addon-name eks-pod-identity-agent
```
This sets up a new DaemonSet in the kube-system namespace:
```bash
$ kubectl get daemonset -n kube-system
NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE
eks-pod-identity-agent 2 2 2 2 2
```
https://github.com/awslabs/crossplane-on-eks
### EKS Pod Identity at a glance
```bash
aws eks create-pod-identity-association \
--cluster-name your-cluster \
--namespace default \
--service-account pod-service-account \
--role-arn arn:aws:iam::012345678901:role/YourPodRole
```
Here, YourPodRole has the following trust policy:
```json
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": {
"Service": "pods.eks.amazonaws.com"
},
"Action": ["sts:AssumeRole","sts:TagSession"]
}]
}
```
Once you’ve run the commands to configure Pod Identity, any pod that runs under the pod-service-account service account magically has access to AWS resources, through temporary Security Token Service (STS) credentials:
```bash
$ kubectl apply -f - <