Set up an EKS cluster with EKS Pod Identity

Create an EKS cluster named mbranca-dev using eksctl:

eksctl create cluster mbranca-dev --region eu-north-1

Get the kubectl config:

aws eks update-kubeconfig --name mbranca-dev --region eu-north-1

Set up an EKS Pod Identity Agent using the EKS' Addons. See https://docs.aws.amazon.com/eks/latest/userguide/pod-id-agent-setup.html for additional info.

pick the correct addon version according to the cluster version; see https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html#pod-id-cluster-versions
install the Addon named "Amazon EKS Pod Identity Agent"

Check that the is running EKS Pod Identity Agent:

$ kubectl get pods -n kube-system | grep 'eks-pod-identity-agent'
eks-pod-identity-agent-8dcbn   1/1     Running   0          19s
eks-pod-identity-agent-8hxnw   1/1     Running   0          19s

Create an IAM role with the permissions needed to collect logs and metrics (TODO: apply the least-privilege principle to the policy).

cat >my-policy.json <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "VisualEditor0",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:DescribeRegions",
        "cloudwatch:GetMetricData",
        "cloudwatch:ListMetrics",
        "iam:ListAccountAliases",
        "rds:DescribeDBInstances",
        "rds:ListTagsForResource",
        "s3:*",
        "sns:ListTopics",
        "sqs:ChangeMessageVisibility",
        "sqs:DeleteMessage",
        "sqs:ListQueues",
        "sqs:ReceiveMessage",
        "sts:AssumeRole",
        "sts:GetCallerIdentity",
        "tag:GetResources",
        "logs:*"
      ],
      "Resource": "*"
    }
  ]
}
EOF

Create the IAM policy:

aws iam create-policy --policy-name my-policy --policy-document file://my-policy.json

Define a service account for the Elastic Agent (it's the standard service account from the quick start)

cat >my-service-account.yaml <<EOF
apiVersion: v1
kind: ServiceAccount
metadata:
  name: elastic-agent
  namespace: kube-system
  labels:
    k8s-app: elastic-agent
EOF

kubectl apply -f my-service-account.yaml

Run the following command to create a trust policy file for the IAM role.

cat >trust-relationship.json <<EOF
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowEksAuthToAssumeRoleForPodIdentity",
            "Effect": "Allow",
            "Principal": {
                "Service": "pods.eks.amazonaws.com"
            },
            "Action": [
                "sts:AssumeRole",
                "sts:TagSession"
            ]
        }
    ]
}
EOF

aws iam create-role --role-name my-role --assume-role-policy-document file://trust-relationship.json --description "my-role-description"

aws iam attach-role-policy --role-name my-role --policy-arn=arn:aws:iam::111222333444:policy/my-policy

Finally, we assign an IAM role to a Kubernetes service account.

aws eks create-pod-identity-association --cluster-name mbranca-dev \
  --role-arn arn:aws:iam::111222333444:role/my-role \
  --namespace kube-system \
  --service-account elastic-agent \
  --region eu-north-1

Inspect the configuration we created to double-check that we're getting everything.

aws iam get-role --role-name my-role --query Role.AssumeRolePolicyDocument
aws iam list-attached-role-policies --role-name my-role --query AttachedPolicies --output text

export policy_arn=arn:aws:iam::111222333444:policy/my-policy
aws iam get-policy --policy-arn $policy_arn

# There could be multiple versions if you tweaked the policy from the AWS console.
aws iam get-policy-version --policy-arn $policy_arn --version-id v1
aws iam get-policy-version --policy-arn $policy_arn --version-id v2
aws iam get-policy-version --policy-arn $policy_arn --version-id v3

Deploy the Elastic Agent:

# From the enroll a new Elastic Agent in Fleet
kubectl apply -f elastic-agent-managed-kubernetes.yml

$ kubectl get pods -n kube-system | grep elastic-agent
elastic-agent-5vmlf            1/1     Running   0          93s
elastic-agent-6t2zd            1/1     Running   0          93s

Double-check that AWS injected additional env vars:

kubectl describe pod elastic-agent-5vmlf -n kube-system | grep AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE:
      AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE:  /var/run/secrets/pods.eks.amazonaws.com/serviceaccount/eks-pod-identity-token

kubectl describe deployment elastic-agent -n kube-system | grep "Service Account"

Enter the pod and install the AWS CLI to verify the EKS Pod Identity config is in place and I can use AWS services .

kubectl exec -it elastic-agent-5vmlf  -n kube-system -- /bin/bash

apt update
apt install python3-pip
pip3 install awscli

$ aws sts get-caller-identity
{
    "UserId": "AROAWC3A256YBIEFUZMHG:eks-mbranca-de-elastic-ag-bd932bdf-40f5-42e3-b15e-0b0437f6f3e3",
    "Account": "111222333444",
    "Arn": "arn:aws:sts::111222333444:assumed-role/my-role/eks-mbranca-de-elastic-ag-bd932bdf-40f5-42e3-b15e-0b0437f6f3e3"
}

[AWS] Test EKS Pod Identity support #41587

Description

zmoogopenedon Nov 11, 2024

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

zmoog
openedon Nov 11, 2024