| Info |
|---|
The article instructs on how to grant provide Cloudaware with read-only access to Amazon EKS Cluster resources so that Cloudaware for auto-discovers is able to discover EKS resources automatically. |
1. Check to see if you have already applied the aws-auth ConfigMap. (тут ссылка на доку, типа если у вас нету, то пиздуйте в доку и делайте по ней).
| Code Block |
|---|
kubectl describe configmap -n kube-system aws-auth |
1.1 Download, edit, and apply the AWS authenticator configuration map.
a. Download the configuration map. и блла бла бла из доки2
| Code Block |
|---|
curl -o aws-auth-cm.yaml https://s3.us-west-2.amazonaws.com/amazon-eks/cloudformation/2020-10-29/aws-auth-cm.yaml |
b. Open the file with a text editor. Replace <ARN of instance role (not instance profile)> with the Amazon Resource Name (ARN) of the IAM role associated with your nodes, and save the file. Do not modify any other lines in this file.
The role ARN cannot include a path. The format of the role ARN must be arn:aws:iam::<123456789012>:role/<role-name>. For more information, see aws-auth ConfigMap does not grant access to the cluster.
2. Ensure that the AWS credentials that kubectl is using are already authorized for your cluster. The IAM user that created the cluster has these permissions by default.
2.1. Open the aws-auth ConfigMap.:
| Code Block |
|---|
kubectl edit -n kube-system configmap/aws-auth |
...
2.2 Add CloudAware IAM role to the configMap.
a. To locate CloudAware IAM role, log in to your Cloudaware account → Admin → Amazon accounts → locate AWS account where the access to EKS should be granted → click SEE ALL in column ‘Connected Identities’
b. To add an IAM role (for example, for federated users): add the role details to the mapRoles section of the ConfigMap, under data. Add this Use the section below if it does not already exist in the file. Each entry supports the following parameters:
...
.
...
username: The user name within Kubernetes to map to the IAM role.
...
groups: A list of groups within Kubernetes to which the role is mapped. For more information, see Default Roles and Role Bindings in the Kubernetes documentation.
| Code Block |
|---|
...
apiVersion: v1
kind: ConfigMap
metadata:
name: aws-auth
namespace: kube-system
data:
mapRoles: |
- rolearn: <CLOUDAWARE_ROLE_ARN>
username: system:node:{{EC2PrivateDNSName}}
groups:
- system:masters |
WHERE
rolearn - the ARN of the IAM role to add
username - the user name within Kubernetes to map to the IAM role
groups - a list of groups within Kubernetes to which the role is mapped. Read Default Roles and Role Bindings in the Kubernetes documentation for more information