Add AKS as a supported k8sMode - #333
Merged
Merged
Conversation
Add "AKS" to k8sMode (alongside EKS | ROSA | K8S) so the chart can target Azure Kubernetes Service. On AKS the agent and fluent-bit reach AWS via workload-identity federation instead of a node instance role: - Project a service account token (audience sts.amazonaws.com) at /var/run/secrets/aws/token via the aws-iam-token volume. - Set AWS_WEB_IDENTITY_TOKEN_FILE and AWS_ROLE_ARN so the AWS SDK default credential chain performs AssumeRoleWithWebIdentity. - Set RUN_IN_AKS=True on the agent for platform detection. - Expose a new top-level roleArn value, required when k8sMode is AKS. Wiring is applied to both the CloudWatchAgent custom resource and the fluent-bit DaemonSet (both use the cloudwatch-agent service account). All AKS blocks are gated behind an $isAKS conditional mirroring the existing $isROSA pattern; EKS, ROSA, and K8S render output is unchanged.
| {{- if .Values.containerLogs.enabled }} | ||
| {{- $clusterName := .Values.clusterName | required ".Values.clusterName is required." -}} | ||
| {{- $region := .Values.region | required ".Values.region is required." -}} | ||
| {{- $isAKS := eq .Values.k8sMode "AKS" -}} |
Contributor
There was a problem hiding this comment.
Missing validation for missing Role ARN similar to the CWA template
{{- $isAKS := eq $.Values.k8sMode "AKS" -}}
{{- if $isAKS }}{{- $_ := $.Values.roleArn | required ".Values.roleArn is required when k8sMode is AKS." -}}{{- end }}
Helm should render the CWA template before the fluent-bit one but helps to keep validations consistent across YAMLs
Mirror the roleArn required-guard from the CloudWatchAgent template into the fluent-bit DaemonSet. The two templates are gated by independent toggles (agent.enabled vs containerLogs.enabled), so with the agent disabled and container logs enabled the CWA guard never renders and a missing roleArn on AKS would silently emit an empty AWS_ROLE_ARN. Addresses review feedback from @mitali-salvi.
mitali-salvi
approved these changes
Jul 10, 2026
jefchien
approved these changes
Jul 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds AKS to k8sMode (EKS | ROSA | K8S | AKS). AKS has no EC2 instance role, so the agent and fluent-bit authenticate to AWS via workload-identity federation:
Testing
Requires the paired agent change that skips the oidctoken path on AKS aws/amazon-cloudwatch-agent#2183. Operator prereq: IAM OIDC provider + role trust-scoped to system:serviceaccount::cloudwatch-agent / aud=sts.amazonaws.com, passed as roleArn.
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.