Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[aws-eks] with IRSA(IAM Roles for Service Accounts) support #3949

Closed
2 tasks
pahud opened this issue Sep 5, 2019 · 3 comments · Fixed by #6062
Closed
2 tasks

[aws-eks] with IRSA(IAM Roles for Service Accounts) support #3949

pahud opened this issue Sep 5, 2019 · 3 comments · Fixed by #6062
Assignees
@eladb @iliapolo
Labels
@aws-cdk/aws-eks Related to Amazon Elastic Kubernetes Service effort/medium Medium work item – several days of effort feature-request A feature should be added or improved. p1

Comments

@pahud
Copy link
Contributor

pahud commented Sep 5, 2019

🚀 Feature Request

General Information

  • 👋 I may be able to implement this feature request
  • ⚠️ This feature might incur a breaking change

Description

AWS just announced the IRSA(IAM Roles for Service Accounts) support for Amazon EKS as well as DIY Kubernetes on AWS.
https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/
https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html

It would be great if we can optionally specify the pod role as a property for the aws-eks/lib/k8s-resource to simplify the heavy-lifting.

Proposed Solution

Environment

  • CDK CLI Version: 1.6.1
  • Module Version: 1.6.1
  • OS: all
  • Language: all

Other information
@pahud pahud added feature-request A feature should be added or improved. needs-triage This issue or PR still needs to be triaged. labels Sep 5, 2019
@SomayaB SomayaB added the @aws-cdk/aws-eks Related to Amazon Elastic Kubernetes Service label Sep 5, 2019
@NGL321 NGL321 added needs-cfn This issue is waiting on changes to CloudFormation before it can be addressed. and removed needs-triage This issue or PR still needs to be triaged. labels Oct 14, 2019
@NGL321
Copy link
Contributor

NGL321 commented Oct 14, 2019

Hey @pahud,

It looks like Cloudformation doesnt yet support IRSA. Lets keep this issue on the backburner until they add support!

😸

@arhea
Copy link

arhea commented Nov 15, 2019

I think most of this should be possible. The issue is getting the OIDC provider URL. To @NGL321's point, once Cloudformation supports the OIDC provider URL, I think this can happen.

aws eks describe-cluster --name irptes --query cluster.identity.oidc.issuer --output text

@RicoToothless RicoToothless mentioned this issue Jan 9, 2020
Closed
@eladb eladb added the effort/medium Medium work item – several days of effort label Jan 23, 2020
@eladb eladb added the p1 label Mar 9, 2020
@ccfife ccfife mentioned this issue Apr 8, 2020
Closed
19 tasks
@hlascelles
Copy link

Our blog post on this can give guidance for how to do this with a lambda. Could be used as a crib. I think it relates to #5388 too.

https://bambooengineering.io/configuring-eks-for-iam-oidc-using-cloudformation/

eladb pushed a commit that referenced this issue May 5, 2020
feat(iam): openid connect providers
89903a3 
Implements `iam.OpenIdConnectProvider` through a custom resource.

See README for details.

Related #5388
Related #3949
Related #6308
@eladb eladb mentioned this issue May 5, 2020
Merged
mergify bot pushed a commit that referenced this issue May 6, 2020
feat(iam): openid connect providers
20621ac 
Implements `iam.OpenIdConnectProvider` through a custom resource.

See README for details.

Related #5388
Related #3949
Related #6308
karupanerura pushed a commit to karupanerura/aws-cdk that referenced this issue May 7, 2020
@karupanerura
feat(iam): openid connect providers
cbcbbaf 
Implements `iam.OpenIdConnectProvider` through a custom resource.

See README for details.

Related aws#5388
Related aws#3949
Related aws#6308
@vlesierse vlesierse mentioned this issue May 18, 2020
Merged
7 tasks
@mergify mergify bot closed this as completed in #6062 May 18, 2020
mergify bot pushed a commit that referenced this issue May 18, 2020
@vlesierse
feat(eks): IAM roles for service accounts
3f0d2c8 
## Commit Message
feat(eks): IAM roles for service accounts (#6062)

Adds support for IAM roles for service account which allows pods the assume IAM roles.

NOTE: currently there are no condition set on the IAM Role which results that there are no restrictions on other pods to assume the role. This will be fixed in a subsequent PR.

See README for details.

Fixes #5388 
Fixes #3949 

## End of Commit Message

- [x] Enable OpenID Connect Provider
- [x] Service Account construct
- [ ] Role constraints
- [x] Add `cluster.addServiceAccount` convenience method
- [x] Integration Tests
- [x] Unit Tests
- [x] Update README.md

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

<!-- 
Please read the contribution guidelines and follow the pull-request checklist:
https://github.com/aws/aws-cdk/blob/master/CONTRIBUTING.md
 -->
karupanerura pushed a commit to karupanerura/aws-cdk that referenced this issue May 22, 2020
@vlesierse @karupanerura
feat(eks): IAM roles for service accounts
e5f6806 
## Commit Message
feat(eks): IAM roles for service accounts (aws#6062)

Adds support for IAM roles for service account which allows pods the assume IAM roles.

NOTE: currently there are no condition set on the IAM Role which results that there are no restrictions on other pods to assume the role. This will be fixed in a subsequent PR.

See README for details.

Fixes aws#5388 
Fixes aws#3949 

## End of Commit Message

- [x] Enable OpenID Connect Provider
- [x] Service Account construct
- [ ] Role constraints
- [x] Add `cluster.addServiceAccount` convenience method
- [x] Integration Tests
- [x] Unit Tests
- [x] Update README.md

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

<!-- 
Please read the contribution guidelines and follow the pull-request checklist:
https://github.com/aws/aws-cdk/blob/master/CONTRIBUTING.md
 -->
@iliapolo iliapolo changed the title aws-eks with IRSA(IAM Roles for Service Accounts) support [aws-eks] with IRSA(IAM Roles for Service Accounts) support Aug 16, 2020
@iliapolo iliapolo removed the needs-cfn This issue is waiting on changes to CloudFormation before it can be addressed. label Aug 16, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@eladb eladb

@iliapolo iliapolo

Labels
@aws-cdk/aws-eks Related to Amazon Elastic Kubernetes Service effort/medium Medium work item – several days of effort feature-request A feature should be added or improved. p1
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

feat(eks): IAM roles for service accounts vlesierse/aws-cdk
7 participants
@pahud @hlascelles @eladb @arhea @iliapolo @NGL321 @SomayaB