amazon-eks-pod-identity-webhook icon indicating copy to clipboard operation
amazon-eks-pod-identity-webhook copied to clipboard

Published 20 hours ago • verified publisher icon aws

Allow specifying baseArn to prepend to role names.

Open danp60 opened this issue 5 years ago • 9 comments
trafficstars

Description of changes: This PR introduces the ability to specify a baseArn to prepend to role names when we detect that the arn passed to the eks.amazonaws.com/role-arn annotation is not fully qualified.

Our use case is that we have different clusters that run in different AWS accounts. This will allow us to use the same manifest to deploy to these different clusters and allow each pod to assume the correct IAM role local to their account.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

danp60 avatar Nov 21 '20 02:11 danp60

Any feedback or comments @aws/eks-contributors?

danp60 avatar Nov 30 '20 21:11 danp60

@jqmichael @josselin-c @micahhausler Any chance someone could take a look at this?

danp60 avatar Dec 05 '20 00:12 danp60

I'd love to see this merged; it's silly to require the role annotation to differ between AWS accounts. Splitting accounts by environment is pretty common practice, as is one cluster per account.

Fixes #56

danopia avatar Dec 08 '20 23:12 danopia

@nckturner @wongma7 does this look like a worthwhile contribution to you? Please let me know and I will cleanup this PR

danp60 avatar Apr 30 '22 00:04 danp60

Is anyone still working on this patch?

seh avatar Sep 02 '22 23:09 seh

@jyotimahapatra would this approach help anyone running on EKS? I would expect some template like {{clusterAccount}} might be supported in EKS, but configuring a CLI option would only work for self-hosted installations

chlunde avatar Sep 03 '22 20:09 chlunde

would this approach help anyone running on EKS? I would expect some template like {{clusterAccount}} might be supported in EKS, but configuring a CLI option would only work for self-hosted installations

Correct. This is right now relevant for self hosted installations.

jyotimahapatra avatar Sep 05 '22 16:09 jyotimahapatra

How this would work on EKS is a problem for EKS. It is not particularly relevant for the amazon-eks-pod-identity-webhook project.

johngmyers avatar Sep 06 '22 16:09 johngmyers

How this would work on EKS is a problem for EKS. It is not particularly relevant for the amazon-eks-pod-identity-webhook project.

Correct. Once this is implemented, EKS can make it work by default.

jyotimahapatra avatar Sep 06 '22 18:09 jyotimahapatra