#TERRAFORM KUBERNETES ANNOTATIONS INSTALL#

This is a simplified version, but it is enough to grasp the concepts, and why each EKS cluster needs an OIDC provider attached. Since EKS hosts a public IODC discovery endpoint, these tokens can be validated by AWS, in exchange of IAM temporary role credentials, which a pod can use to interact with AWS services. In Kubernetes, pods authenticate with the Kubernetes API server by tokens. This controller makes a good example, since it clearly needs to interact with multiple AWS services.įirst of all, the AWS documentation tells us to create an IAM OIDC provider for our cluster. To demonstrate IRSA and Terraform, I will go ahead and use the AWS Load Balancer Controller as an example. In the examples, I'm using Terraform, and the AWS EKS Terraform module, which is something that most guides and articles that I have found, on this subject, does not cover. This article will make an effort to explain, on a higher level, the relationship between IAM policies and roles, and Kubernetes service accounts. Ingress is a collection of rules that allow inbound connections to reach the endpoints defined by a backend.

This way, one can achieve a more fine-grained control over what IAM policies each pod has. The latter approach, to associate roles to service accounts, or IRSA (IAM Roles for Service Accounts), offers the option to assign different policies to different service accounts. The first approach results in all pods running on a specific node having the same policies, which could be fine, depending on context. There are basically two ways to allow the controller to do this, either by assigning policies to the entire node's instance role, or to associate an IAM role with a Kubernetes service account.

#TERRAFORM KUBERNETES ANNOTATIONS INSTALL#

When you install a controller in Kubernetes, that needs to interact with services in AWS, such as Ec2, that controller somehow has to get the sufficient IAM policies to be able to perform whatever actions it needs to, on the respective Ec2 instance.

Kubernetes, Helm, and Terraform are three powerful tools that work synergistically to streamline the process of deploying and scaling applications reliably and efficiently. When I first started working with Kubernetes on EKS, for production environments, I spent quite a long time trying to understand the relation between EKS (the platform on which Kubernetes runs in AWS), IAM and Kubernetes RBAC. Introduction In the ever-evolving landscape of modern application development and deployment, managing complex infrastructures has become a critical challenge.

Terraform kubernetes annotations