Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update aws.md for guidance on latest EKS Auto Mode #5074

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Update aws.md for guidance on latest EKS Auto Mode #5074

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions docs/tutorials/aws.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -339,6 +339,8 @@ kubectl patch serviceaccount "external-dns" --namespace ${EXTERNALDNS_NS:-"defau
"{\"metadata\": { \"annotations\": { \"eks.amazonaws.com/role-arn\": \"$ROLE_ARN\" }}}"
```

> NOTE: For AWS EKS clusters with auto-mode enabled where the [authentication mode](https://www.eksworkshop.com/docs/security/cluster-access-management/managing) is `API` (recommended), the condition on `trust.json` on `$OIDC_PROVIDER:sub` will cause the external-dns pods to error with: "Not authorized to perform sts:AssumeRoleWithWebIdentity". Simply remove that condition and rely just on the `$OIDC_PROVIDER:aud` condition. This is because `API` authentication mode does not leverage RBAC configuration.

If any part of this step is misconfigured, such as the role with incorrect namespace configured in the trust relationship, annotation pointing the the wrong role, etc., you will see errors like `WebIdentityErr: failed to retrieve credentials`. Check the configuration and make corrections.

When the service account annotations are updated, then the current running pods will have to be terminated, so that new pod(s) with proper configuration (environment variables) will be created automatically.
Expand Down