Add support for EKS Pod Identity #416
Conversation
tongshen-stephanie
changed the title
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #416 +/- ##
==========================================
+ Coverage 49.67% 51.74% +2.06%
==========================================
Files 9 9
Lines 781 862 +81
==========================================
+ Hits 388 446 +58
- Misses 383 398 +15
- Partials 10 18 +8 ☔ View full report in Codecov by Sentry. |
| *Note: EKS Pod Identity option is only supported for EKS in the Cloud. It's not supported for [Amazon EKS Anywhere](https://aws.amazon.com/eks/eks-anywhere/), [Red Hat Openshift Service on AWS (ROSA)](https://aws.amazon.com/rosa/) and self-managed Kubernetes clusters on Amazon Elastic Compute Cloud (Amazon EC2) instances.* | ||
| 1. Install Amazon EKS Pod Identity Agent Add-on on the cluster. | ||
| ```shell | ||
| eksctl create addon --name eks-pod-identity-agent --cluster "$CLUSTERNAME" --version v1.0.0-eksbuild.1 --region="$REGION" |
There was a problem hiding this comment.
The version flag is optional. let's remove it or set it to latest otherwise we'll have to bump it in this README.
| irsaAudience = "sts.amazonaws.com" | ||
| podIdentityAudience = "pods.eks.amazonaws.com" | ||
| ProviderName = "secrets-store-csi-driver-provider-aws" | ||
| defaultPodIdentityAgentEndpoint = "http://169.254.170.23/v1/credentials" |
There was a problem hiding this comment.
The default pod identity agent IPV6 address is fd00:ec2::23, can we support IPV6 as long as the customer hasn't disabled IPV6 in their cluster?
https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html#pod-id-considerations
|
|
||
| fetcher := &authTokenFetcher{p.nameSpace, p.svcAcc, p.podName, p.k8sClient, p.usePodIdentity} | ||
|
|
||
| if p.usePodIdentity { |
There was a problem hiding this comment.
Instead of doing this, you could write an interface for providing credentials and have two implementations of that interface, one for PIA and one for IRSA.
Issue #, if available: Closes #300
Description of changes:
Introduce an optional parameter usePodIdentity to support EKS Pod Identity
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.