Is it possible to use this outside of EKS?

[jan-osch]

We are looking for a solution to sync secrets from Secrets Manager to our k3s clusters running on EC2 (no EKS). Is it possible to use this project with outside clusters?

[roberto-sebastiano]

Same here, I run k3s on prem and I would like to use AWS secrets manager.
Is this possible with this project ?

[Elentary]

Yes, however it is not officially documented.
You shoud have working IAM role association for service accounts in your self-hosted cluster via AWS IAM OIDC (or similar approach like kube2iam, but I haven't tested it).
Then you should:

1. Set driverWritesSecrets launch argument to True (currently not possible via Helm, but I am already on it)
2. Create IAM role with permissions to sts:AssumeRoleWithWebIdentity (see the Medium article above) and secretsmanager:GetSecretValue.
3. Add "eks.amazonaws.com/role-arn" annotation to the service account you will use later for your pod. Use ARN of the role from step 2 as the value.
4. Add AWS_DEFAULT_REGION, AWS_ROLE_ARN, AWS_WEB_IDENTITY_TOKEN_FILE envs to your pod (also see Medium article above :)
5. Now configure volumes, volume mounts and SecretProviderClass as you would in EKS (see guide in this repo)

Do you think detailed article about using this project in self-hosted k8s would be useful ?

[roberto-sebastiano]

Absolutely, I think so

[laseanb]

In the case that a self-hosted cluster doesn't have IAM role association for service accounts - would there be a problem to use IAM role for Amazon EC2 instead?

[czapajew]

I did installation of secrets-store-csi-driver and secrets-store-csi-driver-provider-aws on non eks cluster but with instructions above, but unfortunately I don't have success because my provider log shows:

W0530 11:54:42.371675 1 pod_identity_credential_provider.go:142] IPv4 endpoint attempt failed: HTTP request to pod identity agent failed: Get "http://169.254.170.23/v1/credentials": context deadline exceeded (Client.Timeout exceeded while awaiting headers).

And endpoint is absent on non eks cluster.
What can I do ?