AWS IAM Authentication

[nicolai0]

Hi!

I have an on-premise Talos cluster. I'm trying to set up IAM authentication for my pods, so I've been trying to use this. I've gotten to the "Kubernetes API Server configuration" section where I have to set (among others) --service-account-key-file and --service-account-signing-key-file which I have (at /cluster/apiServer/extraArgs), however, when my control plane nodes launch I can see in the logs that those arguments are "not allowed". I've checked the Talos source code here and it seems to suggest that is indeed the case.

My question is, if I can't set those parameters, then what do I do?

[smira]

Talos already generates service account key for you, so you have it already available. If you're using Talos 1.7+, it's in RSA format suitable for AWS directly, so skip the generation step and use what Talos already has configured.

[nicolai0]

I see, thank you!

[bmiddha]

@smira I've just upgraded Talos to 1.7. How can I regenerate this key pair to use RSA? It is currently an EC key pair. Is there any support for periodically auto-rotating this key pair or a Talos API to rotate the key pair?

[frezbo]

you can just generate a keypair locally and patch the machine config to use that (make sure to base64 encode, this is a little old, but the idea is the same https://www.siderolabs.com/blog/workload-identity-for-kubernetes-on-gcp/)

[frezbo]

Actually there's a nice writeup here: https://nikogura.com/TalosAWSOIDC.html