...
| Code Block |
|---|
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: cloudaware-reader rules: - apiGroups: ["*"] resources: ["*"] verbs: ["get", "watch", "list"] --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: cloudaware-binding subjects: - kind: User name: cloudaware namespace: default apiGroup: "" roleRef: kind: ClusterRole name: cloudaware-reader apiGroup: "" |
ClusterRole cloudaware-reader grants read access to all resources within the cluster. ClusterRoleBinding cloudaware-binding maps the aforementioned cluster role to Cloudaware User.
...
To map IAM users and roles to Kubernetes users in the EKS cluster, you have to define them in the aws-auth ConfigMap which should exist after creation of your cluster. To add an IAM role to the cluster, modify this ConfigMap by adding the respective ARN and Kubernetes username value to the mapRole property as an array item. To perform the modification, run the following command:
...
| Code Block |
|---|
apiVersion: v1
kind: ConfigMap
metadata:
name: aws-auth
namespace: kube-system
data:
mapRoles: |
- rolearn: <CLOUDAWARE_ROLE_ARN>
username: cloudaware |
WHERE
CLOUDAWARE_ROLE_ARN - is a placeholder that needs to be updated with your Cluster Role ARN
Make sure to not remove the existing mappings in mapRoles and/or mapUsers sections. You only need to append a role for Cloudaware.
...