Skip to content

Commit 3798c81

Browse files
nmarukovichnmarukovich
authored
Blog: How to Use IAM Roles for Service Accounts (IRSA) with Percona Operator for MongoDB on AWS (#946)
1 parent f00dcc4 commit 3798c81

File tree

3 files changed

+199
-0
lines changed

3 files changed

+199
-0
lines changed

Diff for: ‎assets/blog/authors/natalia_marukovich.jpg

19.6 KB
Loading

Diff for: ‎content/authors/natalia_marukovich/index.md

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
name: natalia_marukovich
3+
name_pronunciation: natalia_marukovich
4+
fullname: Natalia Marukovich
5+
fullname_pronounciation: Natalia Marukovich
6+
tagline:
7+
social:
8+
website:
9+
facebook:
10+
twitter:
11+
github:
12+
linkedin: https://www.linkedin.com/in/natalia-marukovich-86555239/
13+
images:
14+
- blog/authors/natalia_marukovich.jpeg
15+
---
16+
17+
Software Engineer at Percona

Diff for: ‎content/blog/2025/2025-02-20-using-irsa-psmdb-operator.md

+182
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,182 @@
1+
---
2+
title: "How to Use IAM Roles for Service Accounts (IRSA) with Percona Operator for MongoDB on AWS"
3+
date: "2025-02-20T00:00:00+00:00"
4+
tags: ['Percona', 'opensource', 'Kubernetes', 'MongoDB']
5+
authors:
6+
- natalia_marukovich
7+
---
8+
9+
Introduction
10+
=====
11+
12+
[Percona Operator for MongoDB](https://docs.percona.com/percona-operator-for-mongodb/index.html) is an open-source solution designed to streamline and automate database operations within Kubernetes. It allows users to effortlessly deploy and manage highly available, enterprise-grade MongoDB clusters.  The operator simplifies both initial deployment and setup, as well as ongoing management tasks like backups, restores, scaling, and upgrades, ensuring seamless database lifecycle management.
13+
14+
When running database workloads on Amazon EKS (Elastic Kubernetes Service), backup and restore processes often require access to AWS services like S3 for storage. A key challenge is ensuring these operations have secure, least-privileged access to AWS resources without relying on static credentials. Properly managing these permissions is crucial to maintaining data integrity, security, and compliance in automated backup and restore workflows.
15+
16+
[IAM Roles for Service Accounts (IRSA)](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) is the recommended approach to solve this problem. IRSA allows Kubernetes pods to securely assume IAM roles, eliminating the need for hardcoded credentials, long-lived AWS keys, or excessive permissions. Instead, it leverages OpenID Connect (OIDC) authentication, ensuring that only the right workloads get access to AWS services.\
17+
By implementing IRSA, you enhance the security posture of your Kubernetes workloads while simplifying IAM management. In this article, we'll walk through how IRSA works, why it's beneficial, and how to configure it properly for the Percona Operator for MongoDB in EKS clusters.
18+
19+
IRSA Installation and Configuration for Percona Operator for MongoDB
20+
====================================================================
21+
22+
1. IRSA requires an OpenID Connect (OIDC) provider associated with your EKS cluster.\
23+
So, you should [create an OIDC provider for your EKS cluster](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html#:~:text=To%20create%20a%20provider%2C%20choose,com%20and%20choose%20Add%20provider.). 
24+
25+
Creating an OIDC provider for your EKS cluster involves several steps. This setup allows your EKS cluster to use IAM roles for service accounts, which makes it possible to grant fine-grained IAM permissions to pods.
26+
27+
```shell
28+
# Check if OIDC is already set up:
29+
30+
aws eks describe-cluster --name <cluster_name> --query "cluster.identity.oidc.issuer" --output text
31+
32+
https://oidc.eks.eu-west-3.amazonaws.com/id/7AA1C67941083331A80382E464EB2F1F
33+
34+
# If it is not already set up, create an OIDC provider:
35+
36+
eksctl utils associate-iam-oidc-provider --region <region> --cluster <cluster-name> --approve
37+
```
38+
39+
Here oidc-id is 7AA1C67941083331A80382E464EB2F1F. We will use it under role creation.
40+
41+
2. Create an IAM Policy to access s3 buckets.  Substitute <s3_bucket> with your correct bucket name:
42+
```shell
43+
# Define the required permissions in an IAM policy JSON file:
44+
45+
46+
cat s3-bucket-policy.json
47+
48+
{
49+
"Version": "2012-10-17",
50+
"Statement": [
51+
{
52+
"Effect": "Allow",
53+
"Action": [
54+
"s3:*"
55+
],
56+
"Resource": [
57+
"arn:aws:s3:::<s3_bucket>",
58+
"arn:aws:s3:::<s3_bucket>/*"
59+
]
60+
}
61+
]
62+
}
63+
64+
# Create the IAM policy:
65+
66+
aws iam create-policy --policy-name <policy name> --policy-document file://s3-bucket-policy.json
67+
```
68+
69+
3. Create an IAM Role and Attach the Policy:
70+
71+
```shell
72+
# Role example. Replace <account-id> with account id and <oidc-id> with cluster’s OIDC ID
73+
74+
75+
cat role-trust-policy.json
76+
77+
78+
79+
{
80+
"Version": "2012-10-17",
81+
"Statement": [
82+
{
83+
"Effect": "Allow",
84+
"Principal": {
85+
"Federated": "arn:aws:iam::<account-id>:oidc-provider/oidc.eks.<region>.amazonaws.com/id/<oidc-id>"
86+
},
87+
"Action": "sts:AssumeRoleWithWebIdentity",
88+
"Condition": {
89+
"StringEquals": {
90+
"oidc.eks.<region>.amazonaws.com/id/<oidc-id>:aud": "sts.amazonaws.com"
91+
}
92+
}
93+
}
94+
]
95+
}
96+
97+
# Create role:
98+
99+
aws iam create-role --role-name <role_name> --assume-role-policy-document file://role-trust-policy.json --description "Allow access to s3 bucket"
100+
101+
102+
103+
```
104+
4. Attach the policy to the role.
105+
106+
```shell
107+
# Please update <role-name>, <account-id> and <policy-name> with the corresponding values.
108+
109+
aws iam attach-role-policy --role-name <role-name> --policy-arn arn:aws:iam::<account-id>:policy/<policy-name>
110+
```
111+
112+
5. [Install the operator and deploy Percona Server for MongoDB](https://docs.percona.com/percona-operator-for-mongodb/eks.html#install-the-operator-and-deploy-your-mongodb-cluster) in your EKS cluster (skip this step if you already have the operator and the database cluster installed).
113+
114+
6. To ensure proper functionality, we need to annotate both the operator service account (default: percona-server-mongodb-operator) and the cluster service account (default: default).
115+
116+
🔴 Warning: The cluster and operator  won't restart automatically; therefore, a manual restart is necessary to apply the changes.
117+
118+
```shell
119+
# Get service accounts:
120+
121+
$ kubectl get sa -n <namespace>
122+
NAME SECRETS AGE
123+
default 0 25m
124+
percona-server-mongodb-operator 0 25m
125+
126+
127+
# Get role_arn:
128+
129+
aws iam get-role --role-name <role-name> --query "Role.Arn" --output text
130+
131+
# Annotate service account. Please update role_arn with appropriate value.
132+
133+
kubectl annotate serviceaccount default \
134+
eks.amazonaws.com/role-arn="<role_arn>"
135+
136+
kubectl annotate serviceaccount percona-server-mongodb-operator \
137+
eks.amazonaws.com/role-arn="<role_arn>"
138+
```
139+
140+
7. To verify that the settings have been applied, inspect service accounts and the environment variables in both the operator and replica set (RS/Config) pods. The variable AWS_ROLE_ARN should be properly set.
141+
```shell
142+
# Check annotation in service account
143+
144+
$ kubectl get sa -n <namespace> percona-server-mongodb-operator -o yaml
145+
146+
$ kubectl get sa -n <namespace> default -o yaml
147+
148+
149+
# Check the variable inside container
150+
151+
$ kubectl exec -ti <percona-server-mongodb-operator-container> -n <operator_namespace> bash
152+
153+
bash-5.1$ printenv | grep 'AWS_ROLE_ARN'
154+
AWS_ROLE_ARN=arn:aws:iam::1111111111111:role/some-name-psmdb-access-s3-bucket
155+
156+
157+
$ kubectl exec -ti <rs0-0_pod> -n <namespace> bash
158+
159+
[mongodb@some-name-rs0-0 db]$ printenv | grep 'AWS_ROLE_ARN'
160+
AWS_ROLE_ARN=arn:aws:iam::1111111111111:role/some-name-psmdb-access-s3-bucket
161+
```
162+
163+
8. Configure the backup/restore settings as usual, but do not provide s3.credentialsSecret for the storage in deploy/cr.yaml. For detailed instructions  please refer to [Configure storage for backups](https://docs.percona.com/percona-operator-for-mongodb/backups-storage.html).
164+
165+
```shell
166+
# backup section in cr.yaml example
167+
storages:
168+
aws-s3:
169+
type: s3
170+
s3:
171+
region: <region>
172+
bucket: <bucket>
173+
174+
```
175+
176+
---
177+
Conclusion
178+
==============
179+
180+
Using IAM Roles for Service Accounts (IRSA) in an Amazon EKS cluster is a best practice when running [database operators](https://docs.percona.com/percona-operators/) in Kubernetes. By integrating IRSA, database operators---such as the[ Percona Server for MongoDB Operator](https://docs.percona.com/percona-operator-for-mongodb/index.html)---can securely access AWS services like S3 for backups without relying on static credentials.
181+
182+
IRSA enhances security by enforcing the principle of least privilege, ensuring that database operators in EKS have access only to the specific AWS resources they require. This approach reduces the risk of unauthorized access while also improving manageability by eliminating the need to store and rotate AWS credentials within Kubernetes secrets. By adopting IRSA in [Percona Server for MongoDB Operator](https://docs.percona.com/percona-operator-for-mongodb/index.html) , organizations can create a more secure, scalable, and automated environment for managing MongoDB databases.

0 commit comments

Comments
 (0)