Enrolling EKS Cluster

[Alex-Giaquinto]

Does anyone have experience enrolling EKS clusters into their teleport instance? I have been trying for days now and have found no success. In order to integrate teleport and AWS I ran the script it presents locally on my machine which has credentials to communicate with AWS. But now I am stuck after that when trying to enroll with this error message. Any help is greatly appreciated!

rpc error: code = Unknown desc = operation error EKS: ListClusters, get identity: get credentials: failed to retrieve credentials, operation error STS: AssumeRoleWithWebIdentity, exceeded maximum number of attempts, 3, https response error StatusCode: 400, RequestID: xxxxx, InvalidIdentityToken: Couldn't retrieve verification key from your identity provider, please reference AssumeRoleWithWebIdentity documentation for requirements

[marcoandredinis]

Hi 👋
It seems it is not accepting the Identity Provider we create during the enrollment flow.

Is your cluster publicly accessible?

I would also check the following:

• in AWS console, is there an IAM Identity Provider whose name matches your cluster public URL?
• is there an IAM Role which allows access (check Trust Relationship) to the Identity Provider?
• in that IAM Role, does it have an inline policy named EKSAccess? If so, it should have the eks:ListClusters action.

[Alex-Giaquinto]

Hey! Thanks for the reply @marcoandredinis really appreciate it! So when I first created the AWS integration, I had to run the script locally with a machine that had access to AWS because our teleport instance is behind VPN. So once I did that, it created the identity provider which matches the URL. The script then generated the IAM role that allows access. I also attached a permissions policy to the role that allows that eks action. I will paste the trust relationship and policy below for your reference!

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Federated": "arn:aws:iam::xxxx:oidc-provider/teleport.example.com" }, "Action": "sts:AssumeRoleWithWebIdentity", "Condition": { "StringEquals": { "teleport.example.com:aud": "discover.teleport" } } } ] }

{ "Version": "2012-10-17", "Statement": [ { "Sid": "EKSDiscovery", "Effect": "Allow", "Action": [ "eks:DescribeCluster", "eks:ListClusters" ], "Resource": "*" }, { "Sid": "EKSManageAccess", "Effect": "Allow", "Action": [ "eks:AssociateAccessPolicy", "eks:CreateAccessEntry", "eks:DeleteAccessEntry", "eks:DescribeAccessEntry" ], "Resource": "*" } ] }

If there is anything else you need me to check or if you need more information, just let me know! Really looking forward to solving this.

[marcoandredinis]

We don't support setting up the AWS OIDC Integration when your instance is behind a firewall
#34610
( Your username was familiar, just didn't know where from 😅 )

For the Integration to work, AWS needs to check the public keys that are exposed in the teleport instance. Given that AWS cannot fetch the public keys, it will refuse the token and that's why you get the InvalidIdentityToken.

[Alex-Giaquinto]

I said the same thing HA! Okay that is honestly what I figured. So in terms of best practice, what do you advice here? Not sure if we want something like this publicly exposed you know? We have Github integrated for user access, but any other recommendations? Appreciate it @marcoandredinis

[marcoandredinis]

Teleport has a SaaS offering where we publicly expose all of our instances.
So, I would say that if you keep a sane security configuration (long passwords and MFA), you should be good.