[EKS insights] Add option to configure S3 authentication (#42)

* [EKS insights] Add option to configure S3 authentication * Add example
basisai · Jun 9, 2021 · ceb11ab · ceb11ab
1 parent a161a1c
commit ceb11ab
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 7 deletions.
diff --git a/charts/eks-container-insights/Chart.yaml b/charts/eks-container-insights/Chart.yaml
@@ -2,5 +2,5 @@ apiVersion: v1
 appVersion: "1.0"
 description: A Helm chart for EKS Container Insights
 name: eks-container-insights
-version: 0.4.0
+version: 0.4.1
 home: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Container-Insights-setup-logs.html
diff --git a/charts/eks-container-insights/templates/configmap.yaml b/charts/eks-container-insights/templates/configmap.yaml
@@ -171,8 +171,7 @@ data:
           s3_bucket "#{ENV.fetch('S3_BUCKET')}"
           s3_region "#{ENV.fetch('REGION')}"
           path "#{ENV.fetch('CLUSTER_NAME')}/application/${tag}/"
-          <instance_profile_credentials>
-          </instance_profile_credentials>
+          {{- .Values.s3Credentials | nindent 10 }}
           # if you want to use ${tag} or %Y/%m/%d/ like syntax in path / s3_object_key_format,
           # need to specify tag for ${tag} and time for %Y/%m/%d in <buffer> argument.
           <buffer tag,time>
@@ -294,8 +293,7 @@ data:
           s3_bucket "#{ENV.fetch('S3_BUCKET')}"
           s3_region "#{ENV.fetch('REGION')}"
           path "#{ENV.fetch('CLUSTER_NAME')}/dataplane/${tag}-#{ENV.fetch('KUBERNETES_NODE_NAME')}/"
-          <instance_profile_credentials>
-          </instance_profile_credentials>
+          {{- .Values.s3Credentials | nindent 10 }}
           # if you want to use ${tag} or %Y/%m/%d/ like syntax in path / s3_object_key_format,
           # need to specify tag for ${tag} and time for %Y/%m/%d in <buffer> argument.
           <buffer tag,time>
@@ -399,8 +397,7 @@ data:
           s3_bucket "#{ENV.fetch('S3_BUCKET')}"
           s3_region "#{ENV.fetch('REGION')}"
           path "#{ENV.fetch('CLUSTER_NAME')}/host/${tag}-#{ENV.fetch('KUBERNETES_NODE_NAME')}/"
-          <instance_profile_credentials>
-          </instance_profile_credentials>
+          {{- .Values.s3Credentials | nindent 10 }}
           # if you want to use ${tag} or %Y/%m/%d/ like syntax in path / s3_object_key_format,
           # need to specify tag for ${tag} and time for %Y/%m/%d in <buffer> argument.
           <buffer tag,time>

diff --git a/charts/eks-container-insights/values.yaml b/charts/eks-container-insights/values.yaml
@@ -21,6 +21,19 @@ clusterName: ""
 
 logToS3Bucket: false
 s3Bucket: ""
+# See https://github.com/fluent/fluent-plugin-s3/blob/master/docs/credentials.md
+# Defaults to using Instance IAM
+s3Credentials: |
+  <instance_profile_credentials>
+  </instance_profile_credentials>
+
+# IRSA Example
+# s3Credentials: |
+#   <web_identity_credentials>
+#     role_arn "#{ENV.fetch('AWS_ROLE_ARN')}"
+#     web_identity_token_file "#{ENV.fetch('AWS_WEB_IDENTITY_TOKEN_FILE')}"
+#     role_session_name "#{ENV.fetch('KUBERNETES_NODE_NAME')}-fluentd"
+#   </web_identity_credentials>
 
 additional_container_logs_filters: []
 additional_systemd_logs_filters: []