keikoproj / aws-auth

Manage the aws-auth config map for EKS Kubernetes clusters

aws-auth

The aws-auth utility and library makes the management of the aws-auth ConfigMap for EKS Kubernetes clusters easier and safer.

Use cases

• make bootstrapping a node group or removing/adding user access on EKS fast and easy

• useful for automation purposes, any workflow that needs to grant IAM access to an EKS cluster can use this library to modify the config map.

• run as part of a workflow on kubernetes using a docker image

The aws-auth tool is referenced in the AWS EKS best practices documentation here.

Install

aws-auth includes both a CLI and a go library. You can install the CLI via go get or as a kubectl plugin via Krew or by downloading a binary from the releases page.

go get

go get github.com/keikoproj/aws-auth
aws-auth help

kubectl krew

Alternatively, install aws-auth with the krew plugin manager for kubectl.

kubectl krew install aws-auth
kubectl aws-auth

Download release artifact

The latest release artifacts can be downloaded from the GitHub releases page.

Or you can use the following command to download the latest release artifact for your platform:

curl -s https://api.github.com/repos/keikoproj/aws-auth/releases/latest
| grep "browser_download_url" \
| grep $(go env GOARCH) | grep $(go env GOOS) \
| cut -d : -f 2,3 \
| tr -d \" \
| wget -qi -

Usage from command line or Krew

Either download/install a released binary or add as a plugin to kubectl via Krew

$ kubectl krew update
$ kubectl krew install aws-auth
Installing plugin: aws-auth
Installed plugin: aws-auth

$ kubectl krew aws-auth
aws-auth modifies the aws-auth configmap on eks clusters

Usage:
  aws-auth [command]

Available Commands:
  help               Help about any command
  remove             remove removes a user or role from the aws-auth configmap
  remove-by-username remove-by-username removes all map roles and map users from the aws-auth configmap
  upsert             upsert updates or inserts a user or role to the aws-auth configmap
  version            Version of aws-auth

Flags:
  -h, --help   help for aws-auth

Use "aws-auth [command] --help" for more information about a command.

Given a config map with the following data:

$ kubectl get configmap aws-auth -n kube-system -o yaml
apiVersion: v1
kind: ConfigMap
metadata:
    name: aws-auth
    namespace: kube-system
data:
  mapRoles: |
    - rolearn: arn:aws:iam::555555555555:role/devel-worker-nodes-NodeInstanceRole-74RF4UBDUKL6
      username: system:node:{{EC2PrivateDNSName}}
      groups:
        - system:bootstrappers
        - system:nodes
    - rolearn: arn:aws:iam::555555555555:role/abc
      username: ops-user
      groups:
        - system:masters
  mapUsers: |
    - userarn: arn:aws:iam::555555555555:user/a-user
      username: admin
      groups:
        - system:masters
    - userarn: arn:aws:iam::555555555555:user/a-user
      username: ops-user
      groups:
        - system:masters

Remove all access belonging to an ARN (both mapUser roles will be removed)

$ aws-auth remove --mapusers --userarn arn:aws:iam::555555555555:user/a-user
removed arn:aws:iam::555555555555:user/a-user from aws-auth

Remove by full match (only mapUsers[0] will be removed)

$ aws-auth remove --mapusers --userarn arn:aws:iam::555555555555:user/a-user --username admin --groups system:masters
removed arn:aws:iam::555555555555:user/a-user from aws-auth

Remove based on a username

This command removes all map roles and map users that have matching input username. In the above configmap, map role for roleARN arn:aws:iam::555555555555:role/abc and mapUser for userARN arn:aws:iam::555555555555:user/a-user will be removed.

$ aws-auth remove-by-username --username ops-user

Bootstrap a new node group role

$ aws-auth upsert --maproles --rolearn arn:aws:iam::555555555555:role/my-new-node-group-NodeInstanceRole-74RF4UBDUKL6 --username system:node:{{EC2PrivateDNSName}} --groups system:bootstrappers system:nodes
added arn:aws:iam::555555555555:role/my-new-node-group-NodeInstanceRole-74RF4UBDUKL6 to aws-auth

You can also add retries with exponential backoff

$ aws-auth upsert --maproles --rolearn arn:aws:iam::555555555555:role/my-new-node-group-NodeInstanceRole-74RF4UBDUKL6 --username system:node:{{EC2PrivateDNSName}} --groups system:bootstrappers system:nodes --retry

Retries are configurable using the following flags

      --retry                     Retry on failure with exponential backoff
      --retry-max-count int       Maximum number of retries before giving up (default 12)
      --retry-max-time duration   Maximum wait interval (default 30s)
      --retry-min-time duration   Minimum wait interval (default 200ms)

Append groups to mapping instead of overwriting by using --append

$ aws-auth upsert --maproles --rolearn arn:aws:iam::00000000000:role/test --username test --groups test --append

Avoid overwriting username by using --update-username=false

$ aws-auth upsert --maproles --rolearn arn:aws:iam::00000000000:role/test --username test2 --groups test --update-username=false

Use the get command to get a detailed view of mappings

$ aws-auth get

TYPE        	ARN                                               USERNAME                         	GROUPS
Role Mapping	arn:aws:iam::555555555555:role/my-new-node-group  system:node:{{EC2PrivateDNSName}}	system:bootstrappers, system:nodes

use impersonate

aws-auth get|update|remove --as <username> --as-group <groupname> 

Usage as a library

package main

import (
    awsauth "github.com/keikoproj/aws-auth/pkg/mapper"
)

func someFunc(client kubernetes.Interface) error {
    awsAuth := awsauth.New(client, false)
    myUpsertRole := &awsauth.MapperArguments{
        MapRoles: true,
        RoleARN:  "arn:aws:iam::555555555555:role/my-new-node-group-NodeInstanceRole-74RF4UBDUKL6",
        Username: "system:node:{{EC2PrivateDNSName}}",
        Groups: []string{
            "system:bootstrappers",
            "system:nodes",
        },
        WithRetries: true,
        MinRetryTime:   time.Millisecond * 100,
        MaxRetryTime:   time.Second * 30,
        MaxRetryCount:  12,
    }

    err = awsAuth.Upsert(myUpsertRole)
    if err != nil {
        return err
    }
}

Run in a container

$ docker run \
-v ~/.kube/:/root/.kube/ \
-v ~/.aws/:/root/.aws/ \
keikoproj/aws-auth:latest \
aws-auth upsert --mapusers \
--userarn arn:aws:iam::555555555555:user/a-user \
--username admin \
--groups system:masters

aws-auth's Issues

Consider adding a controller implementation

Considering we already have the logic to interact with the aws-auth configmap, we should consider adding a CRD to be able to interact with it natively in the cluster, e.g. have UserMapping & RoleMapping objects in-cluster.

This will give more immutability / declarative state to the auth configuration

aws-auth remove calls remove-by-username

I tried to remove a role I had added with aws-auth

$ aws-auth remove --maproles --rolearn arn:aws:iam::11111111:role/role --username cluster-admin --groups system:masters

and instead of removing just this role it removed all mappings with the username cluster-admin!

With some digging I also found that the more basic version also fails

$ aws-auth remove --maproles --rolearn arn:aws:iam::role:role/role

failed to remove based on username , found zero matches
failed to remove based on username , found zero matches

Issue seems to stem from here

aws-auth/cmd/cli/remove.go

Line 42 in 80ca7b8

if err := worker.RemoveByUsername(removeArgs); err != nil {

where the remove cmd calls worker.RemoveByUsername not worker.Remove.

Should be an easy fix hopefully.

Upsert: should create configmap if it doesnt exist

Currently, if you Upsert to a non-existing configmap, it will silently continue.
We need to create the configmap if it doesnt exist

Conflict Retries

It's possible that when many controllers/goroutines are trying to make updates to aws-auth using this library, that some of them will fail due to conflict of resourceVersion.

We should have an option to retry with exponential backoff when this happens.

Example

$ aws-auth upsert --username test3 --mapusers --userarn role2 --retry

Doesn't work when KUBECONFIG variable has two and more records

aws-auth upsert --maproles --rolearn test --username system:node:"{{EC2PrivateDNSName}}" --groups system:bootstrappers --groups system:nodes
stat /Users/alexandr/.kube/config:/Users/alexandr/.kube/nodes_config: no such file or directory
➜ ~ printenv KUBECONFIG
/Users/alexandr/.kube/config:/Users/alexandr/.kube/nodes_config

Actually aws-auth -h doesn't tell us that we can pass kubeconfig flag.

Thanks!

Move to the latest client-go k8s

https://github.com/kubernetes/client-go/tree/v0.19.6

https://github.com/argoproj/argo-cd/blob/master/go.mod#L90

https://github.com/keikoproj/aws-auth/blob/master/go.mod

aws-auth is using v0.16.9 which is quite old.

We would like to move to the recent k8s client, the dependency on this repo blocks us.

Version is not displayed in CLI

When running aws-auth version we get:

aws-auth version {GitCommit: BuildDate: GoVersion:go1.12.6 Compiler:gc Platform:darwin/amd64}

We should display the GitCommit / BuildDate

Command line arguments should override environment variables

When trying to use aws-auth in one cluster to manage another cluster it always uses in-cluster auth unless I manually unset the KUBERNETES_SERVICE_HOST environment variable. Most applications respect direct command line arguments (in this case I tried passing in --kubeconfig) over environment variables. Would it be possible to change the order of the logic so cli flags override environment variables?

Retries: version conflicts do not get retried

It seems when there is a resource version conflict the retries are meaningless because they do not re-read the config map.
We should have the retry logic include ReadAuthMap instead of only UpdateAuthMap

upsert does not remove duplicates from group list

running this command multiple times does not remove duplicates from group list

upsert  --maproles --rolearn <rolearn>   --append --groups testing --username foo --update-username=false
role <rolearn> has been updated

result

apiVersion: v1
data:
  mapRoles: |
    - rolearn: <rolearn>
      username: foo
      groups:
      - testing
      - testing
      - testing

Krew plugin

Would you consider making this a krew plugin?

README.md shows `uspert` rather than `upsert`

starting at the instructions here:
https://github.com/keikoproj/aws-auth/blob/master/README.md#user-content-usage-from-command-line:~:text=Bootstrap%20a%20new%20node%20group%20role,%24%20aws

Both of the references to aws-auth upsert say aws-auth uspert

--groups should not be required when doing upsert --maproles --rolearn --username

I don't have a particular group to add the role to, and k8s doesn't care when I edit manually. aws-auth forces me to specify a group, and inserts an empty list [] everywhere that I didn't used to have groups specified.

Keikoproj/aws-auth not building

I'm trying to build the binary but I can't due to this error. I've tryed to add this context.Context object to the function, but it still return me errors.

I'm using go 1.15

github.com/keikoproj/aws-auth/pkg/mapper/configmaps.go:35:56: not enough arguments in call to k.CoreV1().ConfigMaps(AwsAuthNamespace).Get
	have (string, "k8s.io/apimachinery/pkg/apis/meta/v1".GetOptions)
	want (context.Context, string, "k8s.io/apimachinery/pkg/apis/meta/v1".GetOptions)
github.com/keikoproj/aws-auth/pkg/mapper/configmaps.go:67:63: not enough arguments in call to k.CoreV1().ConfigMaps("kube-system").Create
	have (*"k8s.io/api/core/v1".ConfigMap)
	want (context.Context, *"k8s.io/api/core/v1".ConfigMap, "k8s.io/apimachinery/pkg/apis/meta/v1".CreateOptions)
github.com/keikoproj/aws-auth/pkg/mapper/configmaps.go:92:58: not enough arguments in call to k.CoreV1().ConfigMaps(AwsAuthNamespace).Update
	have (*"k8s.io/api/core/v1".ConfigMap)
	want (context.Context, *"k8s.io/api/core/v1".ConfigMap, "k8s.io/apimachinery/pkg/apis/meta/v1".UpdateOptions)