策略引擎>> aws-eks-iam-auth-controller>> 返回
项目作者： rustrial

项目描述 ：
Kubernetes operator which consolidates custom resources into `aws-auth` ConfigMap.
高级语言： Rust
项目地址: git://github.com/rustrial/aws-eks-iam-auth-controller.git
创建时间： 2021-01-12T20:24:38Z
项目社区：https://github.com/rustrial/aws-eks-iam-auth-controller
开源协议：Other
下载


[!WARNING]
This project is archived as EKS now offers a viable alternative with Access Entries and we no longer intend to maintain this controller.
If you still need it, please feel free to fork this repository.

Artifact HUB

OCI Images
Publish Charts

AWS EKS iam-auth-controller

Kubernetes Controller tracking
IAMIdentityMapping
Custom Resource
objects to maintain the AWS EKS aws-auth ConfigMap.

Background & Motivation for this project

AWS EKS uses the
aws-auth ConfigMap in the
kube-system namespace to map authenticated identities to Kubernetes username and groups. Using a single ConfigMap
makes it hard and error prone to manage identity mappings using GitOps approach.
The Kubernetes SIG’s AWS IAM Authenticator for Kubernetes
addresses this by providing a IAMIdentityMapping Custom Resource. However, that Custom Resource is still in
alpha stage and is not yet enabled on the EKS control plane (master nodes).

This Kubernetes Controller closes the gap by implementing a Custom Resource Controller,
updating the aws-auth ConfigMap from IAMIdentityMapping objects.
Once #550 or
#512 is resolved this controller will no longer be needed.

Examples

  1. ---
  2. apiVersion: iamauthenticator.k8s.aws/v1alpha1
  3. kind: IAMIdentityMapping
  4. metadata:
  5.   name: kubernetes-admin-user
  6. spec:
  7.   arn: arn:aws:iam::XXXXXXXXXXXX:user/KubernetesAdmin
  8.   username: kubernetes-admin
  9.   groups:
  10.     - system:masters
  11. ---
  12. apiVersion: iamauthenticator.k8s.aws/v1alpha1
  13. kind: IAMIdentityMapping
  14. metadata:
  15.   name: kubernetes-admin-role
  16. spec:
  17.   arn: arn:aws:iam::XXXXXXXXXXXX:role/KubernetesAdmin
  18.   username: kubernetes-admin
  19.   groups:
  20.     - system:masters

Getting Started

Add Helm Repository

AWS EKS iam-auth-controller can be installed via Helm Chart, which by default will use the prebuilt OCI Images for Linux (amd64 and arm64) from DockerHub.

  1. helm repo add aws-eks-iam-auth-controller https://rustrial.github.io/aws-eks-iam-auth-controller

Install Helm Chart

  1. helm install my-rustrial-aws-eks-iam-auth-controller aws-eks-iam-auth-controller/rustrial-aws-eks-iam-auth-controller --version 0.1.0

Adding default IAMIdentityMapping objects for EKS Nodes

As it is implemented today, the controller does only reconcile IAMIdentityMapping objects, and will overwrite (remove) all entries in aws-auth which have no corresponding IAMIdentityMapping object.
To enable your EKS worker nodes respectively Fargate nodes to join your cluster, you have to deploy
the corresponding IAMIdentityMapping objects like this:

  1. kubectl apply -f- <<EOF
  2. ---
  3. apiVersion: iamauthenticator.k8s.aws/v1alpha1
  4. kind: IAMIdentityMapping
  5. metadata:
  6.   name: aws-ec2-nodes
  7. spec:
  8.   arn: 'arn:aws:iam::999999999999:role/your-ec2-node-role-name-here'
  9.   groups:
  10.     - 'system:bootstrappers'
  11.     - 'system:nodes'
  12.   username: 'system:node:{{EC2PrivateDNSName}}'
  13. ---
  14. apiVersion: iamauthenticator.k8s.aws/v1alpha1
  15. kind: IAMIdentityMapping
  16. metadata:
  17.   name: aws-fargate-nodes
  18. spec:
  19.   arn: 'arn:aws:iam::999999999999:role/your-fargate-node-role-name-here'
  20.   groups:
  21.     - 'system:bootstrappers'
  22.     - 'system:nodes'
  23.     - 'system:node-proxier'
  24.   username: 'system:node:{{SessionName}}'
  25. EOF

License

Licensed under either of

at your option.

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted
for inclusion in the work by you, as defined in the Apache-2.0 license, shall be
triple licensed as above, without any additional terms or conditions. See the
WAIVER and CONTRIBUTING.md files for more information.