Comments (5)
Thanks for raising this issue @phanimullapudi!
https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html
It sounds like what you want to do is leverage the above EKS functionality such that Crossplane can use an IAM role associated with a Kubernetes ServiceAccount
, instead of using an IAM role whose access token is stored in a Kubernetes Secret
?
It's possible we could enable this by:
- Adding a field to the existing AWS provider that instructs the
stack-aws
binary to fall back to using web identity tokens per aws/aws-sdk-go#2667. - Update all managed resource controllers to respect said field.
- Documenting how to setup the stack-aws deployment to use service account based IAM roles ala https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-cni-walkthrough.html (and/or automating it in our Helm chart).
from provider-aws.
This is very closely related to #110.
from provider-aws.
Our current EKS stack is configured to use IAM roles using OIDC. The mentioned above way looks reasonable for me.
from provider-aws.
Cross linking another related issue: crossplane/crossplane-runtime#101
from provider-aws.
Providing an update here. We currently use aws-sdk-go-v2
across stack-aws
and unfortunately this functionality has not been implemented on v2
: aws/aws-sdk-go-v2#475
I have successfully deployed stack-aws
in an EKS cluster using IAM roles for ServiceAccount
, and that is working well, it is just consuming the credentials that is a bit more of a hurdle. I believe we can manually assume the role using the sts
client, but I will also investigate if I can provide a simple upstream fix to the issue referenced above.
from provider-aws.
Related Issues (20)
- LogGroup - allow updating kmsKeyID parameter
- domain.opensearchservice: vpc endpoint URI does not appear in status.atProvider HOT 1
- server.transfer: Add vpc endpoint URI to status.atProvider HOT 1
- Updating RolePolicyAttachment policyArn does not detach policy HOT 2
- Cannot create RDS DBInstance when autogeneratePassword - clean instance HOT 3
- s3 bucket settings not defined in the MR are removed after upgrade to v0.46.0 HOT 4
- RDSInstance doesn't set username in `writeConnectionSecretToRef` if you are importing an existing resource
- [documentation] Missing `required` tag in SecurityGrou `region` parameter
- CannotConnectToProvider
- CannotConnectToProvider while trying to create BucketVersioning using Composition HOT 1
- Validation error updating Cloudfront distribution HOT 3
- Release v0.48.0 May 2, 2024
- Time parse issue in compareTimeRanges (maintenanceWindow) HOT 2
- Dynamically referencing the ARN of Lambda Layer in Lambda Function HOT 2
- S3 Bucket constantly calls PutBucketNotification with NotificationConfiguration HOT 1
- Unable to set poll-interval time for EFS mount target beyond default
- EFS FileSystem Support Of Lifecycle policies HOT 1
- Unable to create EKS Cluster using crossplane managed resources HOT 2
- EC2 Instance Tags have two fields in the spec with different semantics HOT 1
- Improve scalability of the EC2/Route53 controllers HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from provider-aws.