Skip to content

Commit 308716b

Browse files
benradstonebenradstone
authored
PCP-5305 - EKS Pod Identity authentication for AWS Accounts (#8599)
* docs: EKS Pod Identity for AWS Accounts * docs: Partials and release note * docs: Apply suggestions from Vale * docs: fix broken URLs * docs: Apply suggestion from code review
1 parent eb43f05 commit 308716b

File tree

6 files changed

+325
-2
lines changed

6 files changed

+325
-2
lines changed

‎_partials/eks-pod-identity/_eks-pod-identity-enablement.mdx‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
partial_category: eks-pod-identity
3+
partial_name: eks-pod-identity-enablement
4+
---
5+
6+
1. Log in to Palette or Palette VerteX as tenant admin.
7+
8+
2. From the left **Main Menu**, click on **Tenant Settings**.
9+
10+
3. Select **Cloud Accounts**, and click **Add AWS Account**.
11+
12+
4. In the cloud account creation wizard, enter the following information:
13+
14+
- **Account Name**: Custom name for the cloud account.
15+
- **Description**: Optional description for the cloud account.
16+
- **Partition**: **{props.partition}**
17+
- Select **EKS Pod Identity** authentication for validation.
18+
19+
5. In the AWS console, browse to the **Role Details** page for the IAM role created for Palette (for example,
20+
`SpectroCloudRole`) and copy the Amazon Resource Name (ARN).
21+
22+
6. In Palette, paste the role ARN into the **ARN** field.
23+
24+
7. (Optional) To set a
25+
[permission boundary](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html), click the
26+
**Add Permission Boundary** toggle and provide the ARN of a IAM policy or role in the **Permission Boundary ARN**
27+
field.
28+
29+
8. Click the **Validate** button to validate the credentials.
30+
31+
9. Click **Confirm** to create your AWS account.

‎_partials/eks-pod-identity/_eks-pod-identity-intro.mdx‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
partial_category: eks-pod-identity
3+
partial_name: eks-pod-identity-intro
4+
---
5+
6+
[EKS Pod Identity](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html) is a secure authentication
7+
mechanism that allows Kubernetes pods to assume IAM roles with temporary, automatically refreshed credentials. This
8+
eliminates the need for long-lived AWS credentials, addressing security concerns in highly regulated environments where
9+
organizations cannot use long-lived credentials.
10+
11+
:::info
12+
13+
This authentication method is only available for
14+
[self-hosted Palette](/enterprise-version/) or [Palette VerteX](/vertex/)
15+
instances deployed on Amazon EKS clusters.
16+
17+
:::

‎_partials/eks-pod-identity/_eks-pod-identity-prerequisites.mdx‎

Lines changed: 196 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,196 @@
1+
---
2+
partial_category: eks-pod-identity
3+
partial_name: eks-pod-identity-prerequisites
4+
---
5+
6+
- Self-hosted Palette or Palette VerteX deployed on an Amazon EKS cluster with Kubernetes version 1.24 or later.
7+
8+
- The Palette or Palette VerteX stack must be deployed on
9+
[managed node groups](https://docs.aws.amazon.com/eks/latest/userguide/managed-node-groups.html), and not
10+
self-managed nodes. This is required to obtain the cluster name using Instance Metadata Service (IMDS).
11+
12+
- The EKS Pod Identity Agent must be enabled on the Amazon EKS cluster. Refer to the
13+
[Set up the Amazon EKS Pod Identity Agent](https://docs.aws.amazon.com/eks/latest/userguide/pod-id-agent-setup.html)
14+
guide for more information.
15+
16+
- Access to the Amazon EKS cluster's kubeconfig file. You must be able to use `kubectl` to perform validation steps on
17+
the cluster.
18+
19+
- A Palette account with [tenant admin](/tenant-settings/) access.
20+
21+
- Three [IAM roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html) must be created for
22+
Palette. This includes Palette itself and two of its services. The following table lists the IAM roles that must be
23+
created.
24+
25+
| Service | IAM Role Name Example |
26+
| ------------------------ | -------------------------- |
27+
| Palette | `SpectroCloudRole` |
28+
| Palette Hubble service | `SpectroCloudHubbleRole` |
29+
| Palette identity service | `SpectroCloudIdentityRole` |
30+
31+
- The following trust policy must be assigned to all of the IAM roles created for Palette and the two services. This
32+
trust policy is the same as outlined in the
33+
[Amazon EKS documentation](https://docs.aws.amazon.com/eks/latest/userguide/pod-id-association.html#pod-id-association-create).
34+
35+
```json
36+
{
37+
"Version": "2012-10-17",
38+
"Statement": [
39+
{
40+
"Sid": "AllowEksAuthToAssumeRoleForPodIdentity",
41+
"Effect": "Allow",
42+
"Principal": {
43+
"Service": "pods.eks.amazonaws.com"
44+
},
45+
"Action": ["sts:AssumeRole", "sts:TagSession"]
46+
}
47+
]
48+
}
49+
```
50+
51+
- The [required IAM policies](/clusters/public-cloud/aws/required-iam-policies/) must be assigned to the IAM role created for Palette (for
52+
example, `SpectroCloudRole`).
53+
54+
- The following policies must be assigned to the IAM role created for the Palette Hubble service (for example,
55+
`SpectroCloudHubbleRole`).
56+
57+
```json
58+
{
59+
"Version": "2012-10-17",
60+
"Statement": [
61+
{
62+
"Sid": "AllowIAMValidation",
63+
"Effect": "Allow",
64+
"Action": [
65+
"iam:GetRole",
66+
"iam:ListAttachedRolePolicies",
67+
"iam:ListRolePolicies",
68+
"iam:GetRolePolicy",
69+
"iam:GetPolicy",
70+
"iam:GetPolicyVersion"
71+
],
72+
"Resource": "*"
73+
},
74+
{
75+
"Sid": "AllowEC2Describe",
76+
"Effect": "Allow",
77+
"Action": [
78+
"ec2:DescribeRegions",
79+
"ec2:DescribeAvailabilityZones",
80+
"ec2:DescribeVpcs",
81+
"ec2:DescribeSubnets",
82+
"ec2:DescribeRouteTables",
83+
"ec2:DescribeKeyPairs"
84+
],
85+
"Resource": "*"
86+
},
87+
{
88+
"Sid": "AllowEKSDescribe",
89+
"Effect": "Allow",
90+
"Action": [
91+
"eks:DescribeCluster",
92+
"eks:ListClusters",
93+
"eks:DescribeNodegroup",
94+
"eks:ListNodegroups",
95+
"eks:DescribeAddon",
96+
"eks:ListAddons"
97+
],
98+
"Resource": "*"
99+
},
100+
{
101+
"Sid": "AllowKMSRead",
102+
"Effect": "Allow",
103+
"Action": [
104+
"kms:ListKeys",
105+
"kms:ListAliases",
106+
"kms:DescribeKey",
107+
"kms:GetKeyPolicy",
108+
"kms:GetKeyRotationStatus"
109+
],
110+
"Resource": "*"
111+
}
112+
]
113+
}
114+
```
115+
116+
- The following policies must be assigned to the IAM role created for the Palette identity service (for example,
117+
`SpectroCloudIdentityRole`).
118+
119+
- Replace `<role-name-for-palette-iam-role>` with the name of the IAM role created for Palette (for example,
120+
`SpectroCloudRole`).
121+
122+
<br />
123+
124+
```json
125+
{
126+
"Version": "2012-10-17",
127+
"Statement": [
128+
{
129+
"Sid": "EKS Pod Identity Management",
130+
"Effect": "Allow",
131+
"Action": [
132+
"eks:ListPodIdentityAssociations",
133+
"eks:CreatePodIdentityAssociation",
134+
"eks:DeletePodIdentityAssociation"
135+
],
136+
"Resource": ["arn:aws:eks:*:*:cluster/*"]
137+
},
138+
{
139+
"Sid": "IAM PassRole for Pod Identity",
140+
"Effect": "Allow",
141+
"Action": ["iam:PassRole"],
142+
"Resource": ["arn:aws:iam::*:role/<role-name-for-palette-iam-role>"],
143+
"Condition": {
144+
"StringLike": {
145+
"iam:PassedToService": "eks.amazonaws.com"
146+
}
147+
}
148+
}
149+
]
150+
}
151+
```
152+
153+
- The IAM roles created for the Palette Hubble service and Palette identity service must have pod identity associations
154+
with the following Kubernetes service accounts.
155+
156+
| **Palette Service** | **Kubernetes Namespace** | **Kubernetes Service Account** |
157+
| ------------------- | ------------------------ | ------------------------------ |
158+
| Hubble | `hubble-system` | `spectro-hubble` |
159+
| Identity service | `palette-identity` | `palette-identity` |
160+
161+
<details>
162+
163+
<summary> Click to display example AWS CLI commands to create pod identity associations </summary>
164+
165+
Use the following AWS CLI command to create a pod identity association for the Palette Hubble service. Replace
166+
`<eks-cluster-name>` with the name of your Amazon EKS cluster, `<aws-account-id>` with your AWS account ID, and
167+
`<hubble-service-iam-role>` with the name of the IAM role created for the Palette Hubble service (for example,
168+
`SpectroCloudHubbleRole`).
169+
170+
```bash
171+
aws eks create-pod-identity-association \
172+
--cluster-name <eks-cluster-name> \
173+
--namespace hubble-system \
174+
--service-account spectro-hubble \
175+
--role-arn arn:aws:iam::<aws-account-id>:role/<hubble-service-iam-role>
176+
```
177+
178+
Similarly, use the following AWS CLI command to create a pod identity association for the Palette identity service.
179+
Replace `<eks-cluster-name>` with the name of your Amazon EKS cluster, `<aws-account-id>` with your AWS account ID,
180+
and `<identity-service-iam-role>` with the name of the IAM role created for the Palette identity service (for example,
181+
`SpectroCloudIdentityRole`).
182+
183+
```bash
184+
aws eks create-pod-identity-association \
185+
--cluster-name <eks-cluster-name> \
186+
--namespace palette-identity \
187+
--service-account palette-identity \
188+
--role-arn arn:aws:iam::<aws-account-id>:role/<identity-service-iam-role>
189+
```
190+
191+
</details>
192+
193+
- (Optional) If you need your Kubernetes clusters to access AWS resources in different AWS accounts to the one where
194+
Palette is deployed, you must configure role chaining for EKS Pod Identity. For more information, refer to the
195+
[Access AWS Resources using EKS Pod Identity Target IAM Roles](https://docs.aws.amazon.com/eks/latest/userguide/pod-id-assign-target-role.html)
196+
guide.

‎_partials/eks-pod-identity/_eks-pod-identity-validate.mdx‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
---
2+
partial_category: eks-pod-identity
3+
partial_name: eks-pod-identity-validate
4+
---
5+
6+
1. Log in to Palette or Palette VerteX as tenant admin.
7+
8+
2. From the left main menu, click on **Tenant Settings**.
9+
10+
3. Ensure **Cloud Accounts** is selected. Your newly added AWS cloud account is listed under the AWS section.
11+
12+
4. Open a terminal session and ensure you have access to the kubeconfig file for the Amazon EKS cluster where Palette or
13+
Palette VerteX is deployed. Set the `KUBECONFIG` environment variable to point to the file.
14+
15+
```bash
16+
export KUBECONFIG=/path/to/kubeconfig/file
17+
```
18+
19+
5. Issue the following `kubectl` commands to verify that EKS Pod Identity has set the required environment variables for the `spectro-hubble`
20+
and `palette-identity` pods.
21+
22+
```bash
23+
kubectl get pods --namespace hubble-system --selector app=spectro-hubble -ojsonpath='{.items[0].spec.containers[0].env[*].name}' | tr ' ' '\n' | grep AWS_CONTAINER
24+
```
25+
26+
```bash
27+
kubectl get pods --namespace palette-identity --selector app=palette-identity -ojsonpath='{.items[0].spec.containers[0].env[*].name}' | tr ' ' '\n' | grep AWS_CONTAINER
28+
```
29+
30+
The output from both commands should include the following environment variables indicating that Amazon EKS has
31+
injected the
32+
[necessary configuration for EKS Pod Identity](https://docs.aws.amazon.com/sdkref/latest/guide/feature-container-credentials.html).
33+
34+
```shell hideClipboard
35+
AWS_CONTAINER_CREDENTIALS_FULL_URI
36+
AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE
37+
```

‎docs/docs-content/clusters/public-cloud/aws/add-aws-accounts.md‎

Lines changed: 37 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,11 +16,13 @@ an AWS cloud account in Palette. You can use any of the following authentication
1616

1717
- [Static Access Credentials](#static-access-credentials)
1818
- [Dynamic Access Credentials](#dynamic-access-credentials)
19+
- [EKS Pod Identity](#eks-pod-identity)
1920

2021
- AWS GovCloud (US)
2122

2223
- [Static Access Credentials](#static-access-credentials-1)
2324
- [Dynamic Access Credentials](#dynamic-access-credentials-1)
25+
- [EKS Pod Identity](#eks-pod-identity-1)
2426

2527
- AWS Secret Cloud (SC2S) (US)
2628

@@ -29,7 +31,8 @@ an AWS cloud account in Palette. You can use any of the following authentication
2931

3032
## AWS Account
3133

32-
This section provides guidance on creating an AWS account that uses static or dynamic access credentials.
34+
This section provides guidance on creating an AWS account that uses static or dynamic access credentials as well as EKS
35+
Pod Identity.
3336

3437
### Static Access Credentials
3538

@@ -112,12 +115,28 @@ You can verify that the account is available in Palette by reviewing the list of
112115
cloud accounts, navigate to the left **Main Menu**. Click on **Tenant Settings**. Next, click on **Cloud Accounts**.
113116
Your newly added AWS cloud account is listed under the AWS section.
114117

118+
### EKS Pod Identity
119+
120+
<PartialsComponent category="eks-pod-identity" name="eks-pod-identity-intro" partition="AWS" />
121+
122+
#### Prerequisites
123+
124+
<PartialsComponent category="eks-pod-identity" name="eks-pod-identity-prerequisites" partition="AWS" />
125+
126+
#### Enablement
127+
128+
<PartialsComponent category="eks-pod-identity" name="eks-pod-identity-enablement" partition="AWS" />
129+
130+
#### Validate
131+
132+
<PartialsComponent category="eks-pod-identity" name="eks-pod-identity-validate" partition="AWS" />
133+
115134
## AWS GovCloud Account (US)
116135

117136
Palette supports integration with
118137
[AWS GovCloud (US)](https://aws.amazon.com/govcloud-us/?whats-new-ess.sort-by=item.additionalFields.postDateTime&whats-new-ess.sort-order=desc).
119138
Using Palette, you can deploy Kubernetes clusters to your AWS GovCloud account. This section provides guidance on
120-
creating an AWS GovCloud account that uses static or dynamic access credentials.
139+
creating an AWS GovCloud account that uses static or dynamic access credentials as well as EKS Pod Identity.
121140

122141
### Static Access Credentials
123142

@@ -224,6 +243,22 @@ You can verify that the account is available in Palette by reviewing the list of
224243
cloud accounts, navigate to the left **Main Menu**. Click on **Tenant Settings**. Next, click on **Cloud Accounts**.
225244
Your newly added AWS cloud account is listed under the AWS section.
226245

246+
### EKS Pod Identity
247+
248+
<PartialsComponent category="eks-pod-identity" name="eks-pod-identity-intro" partition="AWS US Gov" />
249+
250+
#### Prerequisites
251+
252+
<PartialsComponent category="eks-pod-identity" name="eks-pod-identity-prerequisites" partition="AWS US Gov" />
253+
254+
#### Enablement
255+
256+
<PartialsComponent category="eks-pod-identity" name="eks-pod-identity-enablement" partition="AWS US Gov" />
257+
258+
#### Validate
259+
260+
<PartialsComponent category="eks-pod-identity" name="eks-pod-identity-validate" partition="AWS US Gov" />
261+
227262
## AWS Secret Cloud Account (US)
228263

229264
You can configure [AWS Secret Cloud](https://aws.amazon.com/federal/secret-cloud/) accounts in

‎docs/docs-content/release-notes/release-notes.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,13 @@ tags: ["release-notes"]
3232

3333
#### Features
3434

35+
- [EKS Pod Identity](https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html) is now a supported
36+
authentication method for AWS cloud accounts. This secure authentication mechanism allows Kubernetes pods to assume
37+
IAM roles with temporary, automatically refreshed credentials, eliminating the need for long-lived AWS credentials.
38+
39+
This method is only available for self-hosted Palette and Palette VerteX instances deployed on Amazon EKS clusters.
40+
Refer to the [Add AWS Accounts](../clusters/public-cloud/aws/add-aws-accounts.md) guide for more information.
41+
3542
- [Cluster profile variables](../profiles/cluster-profiles/create-cluster-profiles/define-profile-variables/create-cluster-profile-variables.md)
3643
now support the multiline input type and the Base64 format. This improvement allows users to leverage cluster profile
3744
variables for use cases such as saving multiline YAML specifications and storing encoded keys for use during cluster

0 commit comments

Comments
 (0)