The AWS IAM provisioner operator provisions IAM roles and policies on the fly for the Kubernetes clusters managed using Kubernetes Cluster API Provider AWS.
After a managed AWS EKS cluster is provisioned using Kubernetes Cluster API Provider AWS, it might be required to provision IAM roles and policies for the installed services, e.g. AWS Load Balancer Controller, AWS Elastic Block Store CSI driver.
The AWS IAM Provisioner Operator implements the creation and management of AWS IAM resources, including roles and policies,
based on information obtained after provisioning the target cluster via the Kubernetes Cluster API Provider AWS.
While a CR of an IAM policy is a static definition, which can be defined in advance, a CR of an IAM role might contain dynamic parts such as OIDC ARN/name of a created EKS cluster. It means, that while a role can reference existing policies, the dynamic parts should be provisioned on the fly, upon a managed EKS cluster is provisioned by Cluster API and is ready.
For that purposes, the AWSIAMProvision CR can be used for defining a Golang template for such on-the-fly IAM role
provisioning:
apiVersion: iam.aws.edenlab.io/v1alpha1
kind: AWSIAMProvision
metadata:
name: deps-develop
namespace: capa-system
# truncated
spec:
eksClusterName: deps-develop
region: us-east-1
roles:
deps-develop-ebs-csi-controller:
spec:
assumeRolePolicyDocument: |
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "",
"Effect": "Allow",
"Principal": {
"Federated": "{{ .OIDCProviderARN }}"
},
"Action": "sts:AssumeRoleWithWebIdentity",
"Condition": {
"StringEquals": {
"{{ .OIDCProviderName }}:sub": "system:serviceaccount:kube-system:ebs-csi-controller"
}
}
}
]
}
policies:
- deps-develop-ebs-csi-controller-core
tags:
- key: Foo
value: Bar
policies:
deps-develop-ebs-csi-controller-core:
spec:
name: deps-develop-ebs-csi-controller-core
tags:
- key: Foo
value: Bar
policyDocument: |
{
"Statement": [
{
"Action": [
"ec2:CreateSnapshot",
"ec2:AttachVolume",
"ec2:DetachVolume",
"ec2:ModifyVolume",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeInstances",
"ec2:DescribeSnapshots",
# truncatedThe assumeRolePolicyDocument field of the AWSIAMProvision CR supports the following Golang template's placeholders:
{{ .OIDCProviderARN }}: rendered to something likearn:aws:iam::012345678901:oidc-provider/oidc.eks.us-east-1.amazonaws.com/id/AAAAABBBBB0000011111222223333344{{ .OIDCProviderName }}: rendered to something likeoidc.eks.us-east-1.amazonaws.com/id/AAAAABBBBB0000011111222223333344
In this example, the
kube-system:ebs-csi-controllerpart means, that theebs-csi-controllerK8S service account is in thekube-systemnamespace.
The rest of the spec.roles.*.spec fields are identical to the original AWS IAM role.
The AWSManagedControlPlane Cluster API CR is watched the AWS IAM provisioner operator. As the result, a role CR will be created on the fly by the operator upon a EKS cluster provisioning.
Example of an original AWSManagedControlPlane resource:
apiVersion: controlplane.cluster.x-k8s.io/v1beta2
kind: AWSManagedControlPlane
metadata:
name: deps-develop
namespace: capa-system
# truncated
spec:
controlPlaneEndpoint:
host: https://AAAAABBBBB0000011111222223333344.gr7.us-east-1.eks.amazonaws.com
port: 443
eksClusterName: deps-develop
region: us-east-1
roleName: deps-develop-iam-service-role
version: v1.29.8
# truncated
spec.roles.*.policiesshould be attached to an existing AWS IAMPolicycreated by the AWS IAM Provisioner Operator.
spec.*.*.tagsfield is used to define additional custom tags. Tags can only be specified at the time ofpolicyorrolecreation and cannot be updated after a resource has been created.
The AWS IAM Provisioner Operator follows idempotent behavior and a declarative configuration approach.
It continuously synchronizes policy or role resources based on the current state of AWS resources and
the CR configuration.
Supported operations on AWS IAM Resources (policy or role):
- Creating or deleting resources based on the CR configuration.
- Updating the trust relationship policy document for a
roleor thepolicydocument for a policy. - Attaching or detaching policies from roles according to the CR configuration.
- go version v1.22.0+
- docker version 17.03+.
- kubectl version v1.11.3+.
- Access to a Kubernetes v1.11.3+ cluster.
Build and push your image to the location specified by IMG:
make docker-build docker-push IMG=<some-registry>/aws-iam-provisioner:tagNOTE: This image ought to be published in the personal registry you specified. And it is required to have access to pull the image from the working environment. Make sure you have the proper permission to the registry if the above commands don’t work.
Install the CRDs into the cluster:
make installDeploy the Manager to the cluster with the image specified by IMG:
make deploy IMG=<some-registry>/aws-iam-provisioner:tagNOTE: If you encounter RBAC errors, you may need to grant yourself cluster-admin privileges or be logged in as admin.
Create instances of your solution You can apply the samples (examples) from the config/sample:
kubectl apply -k config/samples/NOTE: Ensure that the samples has default values to test it out.
Delete the instances (CRs) from the cluster:
kubectl delete -k config/samples/Delete the APIs(CRDs) from the cluster:
make uninstallUnDeploy the controller from the cluster:
make undeployFollowing are the steps to build the installer and distribute this project to users.
- Build the installer for the image built and published in the registry:
make build-installer IMG=<some-registry>/aws-iam-provisioner:tagNOTE: The makefile target mentioned above generates an 'install.yaml' file in the dist directory. This file contains all the resources built with Kustomize, which are necessary to install this project without its dependencies.
- Using the installer
Users can just run kubectl apply -f to install the project, i.e.:
kubectl apply -f https://raw.githubusercontent.com/<org>/aws-iam-provisioner/<tag or branch>/dist/install.yaml