Skip to content

Commit 4e6be80

Browse files
kkb0318kkb0318
committed
fix docs for supporting eks
1 parent d0b39e4 commit 4e6be80

File tree

3 files changed

+105
-79
lines changed

3 files changed

+105
-79
lines changed

‎README.md‎

Lines changed: 7 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
[![CI](https://github.com/kkb0318/irsa-manager/actions/workflows/ci.yaml/badge.svg)](https://github.com/kkb0318/irsa-manager/actions/workflows/ci.yaml)
55
[![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/irsa-manager)](https://artifacthub.io/packages/search?repo=irsa-manager)
66

7-
IRSA Manager allows you to easily set up IAM Roles for Service Accounts (IRSA) on non-EKS Kubernetes clusters.
7+
IRSA Manager allows you to easily set up IAM Roles for Service Accounts (IRSA) on both EKS and non-EKS Kubernetes clusters.
88

99
![](docs/irsa-manager-overview.png)
1010

@@ -19,7 +19,7 @@ For detailed guidelines on how irsa-manager works, please refer to the [**blog p
1919

2020
Before you begin, ensure you have the following:
2121

22-
- A running Kubernetes cluster (non-EKS).
22+
- A running Kubernetes cluster.
2323
- Helm installed on your local machine.
2424
- AWS user credentials with appropriate permissions.
2525
- The permissions should allow irsa-manager to call the necessary AWS APIs. You can find all the APIs that irsa-manager calls in the internal/aws/aws.go interfaces.
@@ -50,7 +50,7 @@ Before you begin, ensure you have the following:
5050

5151
## Setup
5252

53-
Follow these steps to set up IRSA on your non-EKS cluster:
53+
Follow these steps to set up IRSA on your cluster:
5454

5555
1. Set AWS Secret for IRSA Manager
5656

@@ -77,85 +77,13 @@ helm install irsa-manager kkb0318/irsa-manager -n irsa-manager-system --create-n
7777

7878
3. Create an IRSASetup Custom Resource
7979

80-
![](docs/IRSASetup-cr.png)
80+
If you're using self-hosted Kubernetes, follow this setup:
8181

82-
Define and apply an IRSASetup custom resource according to your needs.
82+
[self-hosted setup](./docs/selfhosted-setup.md)
8383

84-
```yaml
85-
apiVersion: irsa-manager.kkb0318.github.io/v1alpha1
86-
kind: IRSASetup
87-
metadata:
88-
name: irsa-init
89-
namespace: irsa-manager-system
90-
spec:
91-
cleanup: false
92-
discovery:
93-
s3:
94-
region: <region>
95-
bucketName: <S3 bucket name>
96-
```
97-
98-
Check the IRSASetup custom resource status to verify whether it is set to true.
99-
100-
> [!NOTE]
101-
> Please ensure that only one IRSASetup resource is created.
102-
103-
4. Modify kube-apiserver Settings
104-
105-
If the IRSASetup status is true, a key file (Name: `irsa-manager-key` , Namespace: `kube-system` ) will be created. This is used for signing tokens in the kubernetes API.
106-
Execute the following commands on the control plane server to save the public and private keys locally for Kubernetes signatures:
107-
108-
```console
109-
kubectl get secret -n kube-system irsa-manager-key -o jsonpath="{.data.ssh-privatekey}" | base64 --decode | sudo tee /path/to/file.key > /dev/null
110-
kubectl get secret -n kube-system irsa-manager-key -o jsonpath="{.data.ssh-publickey}" | base64 --decode | sudo tee /path/to/file.pub > /dev/null
111-
```
112-
113-
> [!NOTE]
114-
> Path: `/path/to/file` can be any path you choose.
115-
> If you use kubeadm, it is recommended to set `/etc/kubernetes/pki/irsa-manager.(key|pub)`
116-
117-
Then, modify the kube-apiserver settings to include the following parameters:
118-
119-
- API Audiences
120-
121-
```
122-
--api-audiences=sts.amazonaws.com
123-
```
124-
125-
- Service Account Issuer
126-
127-
```
128-
--service-account-issuer=https://s3-<region>.amazonaws.com/<S3 bucket name>
129-
```
130-
131-
> [!NOTE]
132-
> Add this setting as the first element.
133-
> When this flag is specified multiple times, the first is used to generate tokens and all are used to determine which issuers are accepted.
134-
135-
- Service Account Key File
136-
137-
The public key generated previously can be read by the API server. Add the path for this parameter flag:
138-
139-
```
140-
--service-account-key-file=/path/to/file.pub
141-
```
142-
143-
> [!NOTE]
144-
> If you do not mount /path/to directory, you need to add the volumes field to this path.
145-
146-
- Service Account Signing Key File
147-
148-
The private key (oidc-issuer.key) generated previously can be read by the API server. Add the path for this parameter flag:
149-
150-
```
151-
--service-account-signing-key-file=/path/to/file.key
152-
```
153-
154-
> [!NOTE]
155-
> Overwrite the existing settings.
156-
> If you do not mount /path/to directory, you need to add the volumes field to this path.
84+
If you're using EKS, follow this setup:
15785

158-
For more details, refer to the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection).
86+
[eks setup](./docs/eks-setup.md)
15987

16088
## How To Use
16189

‎docs/eks-setup.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
## Setup for EKS
2+
3+
Define and apply an IRSASetup custom resource.
4+
5+
```yaml
6+
apiVersion: irsa-manager.kkb0318.github.io/v1alpha1
7+
kind: IRSASetup
8+
metadata:
9+
name: irsa-init
10+
namespace: irsa-manager-system
11+
spec:
12+
mode: eks
13+
cleanup: false
14+
iamOIDCProvider: "oidc.eks.<region>.amazonaws.com/id/<id>"
15+
```
16+
17+
Check the IRSASetup custom resource status to verify whether it is set to true.

‎docs/selfhosted-setup.md‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
## Setup for Self-Hosted
2+
3+
![](docs/IRSASetup-cr.png)
4+
5+
### Define and apply an IRSASetup custom resource according to your needs.
6+
7+
```yaml
8+
apiVersion: irsa-manager.kkb0318.github.io/v1alpha1
9+
kind: IRSASetup
10+
metadata:
11+
name: irsa-init
12+
namespace: irsa-manager-system
13+
spec:
14+
cleanup: false
15+
discovery:
16+
s3:
17+
region: <region>
18+
bucketName: <S3 bucket name>
19+
```
20+
21+
Check the IRSASetup custom resource status to verify whether it is set to true.
22+
23+
> [!NOTE]
24+
> Please ensure that only one IRSASetup resource is created.
25+
26+
### Modify kube-apiserver Settings
27+
28+
If the IRSASetup status is true, a key file (Name: `irsa-manager-key` , Namespace: `kube-system` ) will be created. This is used for signing tokens in the kubernetes API.
29+
Execute the following commands on the control plane server to save the public and private keys locally for Kubernetes signatures:
30+
31+
```console
32+
kubectl get secret -n kube-system irsa-manager-key -o jsonpath="{.data.ssh-privatekey}" | base64 --decode | sudo tee /path/to/file.key > /dev/null
33+
kubectl get secret -n kube-system irsa-manager-key -o jsonpath="{.data.ssh-publickey}" | base64 --decode | sudo tee /path/to/file.pub > /dev/null
34+
```
35+
36+
> [!NOTE]
37+
> Path: `/path/to/file` can be any path you choose.
38+
> If you use kubeadm, it is recommended to set `/etc/kubernetes/pki/irsa-manager.(key|pub)`
39+
40+
Then, modify the kube-apiserver settings to include the following parameters:
41+
42+
- API Audiences
43+
44+
```
45+
--api-audiences=sts.amazonaws.com
46+
```
47+
48+
- Service Account Issuer
49+
50+
```
51+
--service-account-issuer=https://s3-<region>.amazonaws.com/<S3 bucket name>
52+
```
53+
54+
> [!NOTE]
55+
> Add this setting as the first element.
56+
> When this flag is specified multiple times, the first is used to generate tokens and all are used to determine which issuers are accepted.
57+
58+
- Service Account Key File
59+
60+
The public key generated previously can be read by the API server. Add the path for this parameter flag:
61+
62+
```
63+
--service-account-key-file=/path/to/file.pub
64+
```
65+
66+
> [!NOTE]
67+
> If you do not mount /path/to directory, you need to add the volumes field to this path.
68+
69+
- Service Account Signing Key File
70+
71+
The private key (oidc-issuer.key) generated previously can be read by the API server. Add the path for this parameter flag:
72+
73+
```
74+
--service-account-signing-key-file=/path/to/file.key
75+
```
76+
77+
> [!NOTE]
78+
> Overwrite the existing settings.
79+
> If you do not mount /path/to directory, you need to add the volumes field to this path.
80+
81+
For more details, refer to the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection).

0 commit comments

Comments
 (0)