The AWS Workload Identity is a feature designed to enhance security and streamline access management for Control Plane managed Kubernetes clusters. This feature enables Pods running on Kubernetes clusters to assume an AWS IAM Role. By leveraging these IAM Roles, Pods can securely access AWS resources, adhering to the permissions defined in the corresponding IAM policies.
A key application of this feature is in scenarios where a Pod needs to interact with AWS services. For instance, a Pod requiring access to an S3 bucket can assume an IAM Role with the necessary permissions to perform actions on that bucket.
Enable AWS Workload Identity when secure access to AWS resources from Pods on the cluster is required.
The AWS Workload Identity
add-on can be enabled for your Kubernetes cluster either during the cluster creation process or at any time thereafter. The following sections outline the methods for enabling the add-on:
Through Cluster Manifest: Add the following snippet to your cluster manifest when creating the cluster:
Using the Console: If you’re creating the cluster through the console, navigate to Add-ons
, find the AWS Workload Identity
add-on in the list of available add-ons, and toggle it on.
If the AWS Workload Identity
add-on was not enabled during the cluster creation, you can still enable it using either of the following methods:
Under spec.addOns
in the YAML manifest of the cluster, you can edit it either by navigating to the cluster in the Console and using the Edit & Apply
option for the cluster, or by applying the entire manifest using the cpln apply >_
option in the upper right corner or by using the cpln
CLI.
Add the following:
Kubernetes
in the left sidebar panel and click on the Kubernetes cluster for which you want to enable the dashboard.Add-ons
and locate the AWS Workload Identity
add-on from the list of available add-ons, then toggle it on.After enabling AWS Workload Identity, an OIDC Identity Provider for each cluster must be created in your AWS account before it can be used.
The oidcProviderUrl
for the OIDC Identity Provider is in the status of the cluster.
Create OIDC Identity Provider in AWS
Retrieve the cluster’s oidcProviderUrl:
CLI
UI
From the Managed Kubernetes cluster in the UI, select View
from the Actions
drop down in the upper right corner.
A new window will open sowing the content of the Managed Kubernetes object in the Control Plane API.
Toggle the Slim
button so it is turned off.
The providerUrl
is shown in the object at .status.addOns.awsWorkloadIdentity.oidcProviderConfig
Access the AWS console and navigate to IAM. In the left panel, under Access management
, select Identity providers
and then click Add provider
.
Select OpenID Connect
, paste the Provider URL
obtained in the previous step, and click Get thumbprint
.
In the Audience
field, enter sts.amazonaws.com
.
After enabling AWS Workload Identity, your Managed Kubernetes cluster becomes an identity provider for your Pods.
To grant a Pod access, ensure it uses a Kubernetes Service Account with the annotation: eks.amazonaws.com/role-arn: "arn:aws:iam::<ACCOUNT_ID>:role/IAM-ROLE-HERE"
. This setup is compatible with all Kubernetes Workloads, as they ultimately provision Pods.
Follow these steps below to configure.
Retrieve and Save the Trust Policy JSON
example-trust-policy.json
. Then, modify the trust policy by replacing
<SERVICE_ACCOUNT>
and <NAMESPACE>
with the appropriate values:
<NAMESPACE>
, use default
.<SERVICE_ACCOUNT>
, use mk8s-identity-example
.Create an IAM Role
default-trust-policy.json
Create Kubernetes Service Account and a Pod
Create the Kubernetes Service Account and a Pod in your Managed Kubernetes cluster. For guidance on accessing your cluster, refer to the documentation page of your Provider.
Replace <ACCOUNT_ID>
with your AWS Account ID in the following YAML configuration:
The Pod identity-example
can now access AWS resources using the IAM role arn:aws:iam::<ACCOUNT_ID>:role/mk8s-identity-example
.