Configuring the Amazon VPC CNI plugin for Kubernetes to use IAM roles for service accounts (IRSA)

To create the IAM role

1. Create the IAM role. You can use eksctl or kubectl and the Amazon CLI to create your IAM role.

   eksctl

   Create an IAM role and attach the IAM policy to the role with the command that matches the IP family of your cluster. The command creates and deploys an Amazon CloudFormation stack that creates an IAM role, attaches the policy that you specify to it, and annotates the existing aws-node Kubernetes service account with the ARN of the IAM role that is created.

   • Replace my-cluster with your own value.

     eksctl create iamserviceaccount \
         --name aws-node \
         --namespace kube-system \
         --cluster my-cluster \
         --role-name AmazonEKSVPCCNIRole \
         --attach-policy-arn arn:aws-cn:iam::aws:policy/AmazonEKS_CNI_Policy \
         --override-existing-serviceaccounts \
         --approve
     

   • IPv6

     Replace my-cluster with your own value. Replace 111122223333 with your account ID and replace AmazonEKS_CNI_IPv6_Policy with the name of your IPv6 policy. If you don't have an IPv6 policy, see Create IAM policy for clusters that use the IPv6 family to create one. To use IPv6 with your cluster, it must meet several requirements. For more information, see IPv6 addresses for clusters, Pods, and services.

     eksctl create iamserviceaccount \
         --name aws-node \
         --namespace kube-system \
         --cluster my-cluster \    
         --role-name AmazonEKSVPCCNIRole \
         --attach-policy-arn arn:aws-cn:iam::111122223333:policy/AmazonEKS_CNI_IPv6_Policy \
         --override-existing-serviceaccounts \
         --approve
     

   kubectl and the Amazon CLI

   1. View your cluster's OIDC provider URL.

      aws eks describe-cluster --name my-cluster --query "cluster.identity.oidc.issuer" --output text
      

      An example output is as follows.

      https://oidc.eks.region-code.amazonaws.com.cn/id/EXAMPLED539D4633E53DE1B71EXAMPLE

      If no output is returned, then you must create an IAM OIDC provider for your cluster.

   2. Copy the following contents to a file named vpc-cni-trust-policy.json. Replace 111122223333 with your account ID and EXAMPLED539D4633E53DE1B71EXAMPLE with the output returned in the previous step. Replace region-code with the Amazon Web Services Region that your cluster is in.

      {
          "Version": "2012-10-17",
          "Statement": [
              {
                  "Effect": "Allow",
                  "Principal": {
                      "Federated": "arn:aws-cn:iam::111122223333:oidc-provider/oidc.eks.region-code.amazonaws.com.cn/id/EXAMPLED539D4633E53DE1B71EXAMPLE"
                  },
                  "Action": "sts:AssumeRoleWithWebIdentity",
                  "Condition": {
                      "StringEquals": {
                          "oidc.eks.region-code.amazonaws.com.cn/id/EXAMPLED539D4633E53DE1B71EXAMPLE:aud": "sts.amazonaws.com",
                          "oidc.eks.region-code.amazonaws.com.cn/id/EXAMPLED539D4633E53DE1B71EXAMPLE:sub": "system:serviceaccount:kube-system:aws-node"
                      }
                  }
              }
          ]
      }

   3. Create the role. You can replace AmazonEKSVPCCNIRole with any name that you choose.

      aws iam create-role \
        --role-name AmazonEKSVPCCNIRole \
        --assume-role-policy-document file://"vpc-cni-trust-policy.json"
      

   4. Attach the required IAM policy to the role.

      • IPv4

        aws iam attach-role-policy \
          --policy-arn arn:aws-cn:iam::aws:policy/AmazonEKS_CNI_Policy \
          --role-name AmazonEKSVPCCNIRole
        

      • IPv6

        Replace 111122223333 with your account ID and AmazonEKS_CNI_IPv6_Policy with the name of your IPv6 policy. If you don't have an IPv6 policy, see Create IAM policy for clusters that use the IPv6 family to create one. To use IPv6 with your cluster, it must meet several requirements. For more information, see IPv6 addresses for clusters, Pods, and services.

        aws iam attach-role-policy \
          --policy-arn arn:aws-cn:iam::111122223333:policy/AmazonEKS_CNI_IPv6_Policy \
          --role-name AmazonEKSVPCCNIRole
        

   5. Run the following command to annotate the aws-node service account with the ARN of the IAM role that you created previously. Replace the example values with your own values.

      kubectl annotate serviceaccount \
          -n kube-system aws-node \
          eks.amazonaws.com/role-arn=arn:aws-cn:iam::111122223333:role/AmazonEKSVPCCNIRole
      

2. (Optional) Configure the Amazon Security Token Service endpoint type used by your Kubernetes service account. For more information, see Configure the Amazon Security Token Service endpoint for a service account.

1. Delete and re-create any existing Pods that are associated with the service account to apply the credential environment variables. The annotation is not applied to Pods that are currently running without the annotation. The following command deletes the existing aws-node DaemonSet Pods and deploys them with the service account annotation.

   kubectl delete Pods -n kube-system -l k8s-app=aws-node
   

2. Confirm that the Pods all restarted.

   kubectl get pods -n kube-system -l k8s-app=aws-node
   

3. Describe one of the Pods and verify that the AWS_WEB_IDENTITY_TOKEN_FILE and AWS_ROLE_ARN environment variables exist. Replace cpjw7 with the name of one of your Pods returned in the output of the previous step.

   kubectl describe pod -n kube-system aws-node-cpjw7 | grep 'AWS_ROLE_ARN:\|AWS_WEB_IDENTITY_TOKEN_FILE:'
   

   An example output is as follows.

   AWS_ROLE_ARN:                 arn:aws-cn:iam::111122223333:role/AmazonEKSVPCCNIRole
         AWS_WEB_IDENTITY_TOKEN_FILE:  /var/run/secrets/eks.amazonaws.com/serviceaccount/token
         AWS_ROLE_ARN:                           arn:aws-cn:iam::111122223333:role/AmazonEKSVPCCNIRole
         AWS_WEB_IDENTITY_TOKEN_FILE:            /var/run/secrets/eks.amazonaws.com/serviceaccount/token

   Two sets of duplicate results are returned because the Pod contains two containers. Both containers have the same values.

   If your Pod is using the Amazon Web Services Regional endpoint, then the following line is also returned in the previous output.

   AWS_STS_REGIONAL_ENDPOINTS=regional

1. Copy the following text and save it to a file named vpc-cni-ipv6-policy.json.

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "ec2:AssignIpv6Addresses",
                   "ec2:DescribeInstances",
                   "ec2:DescribeTags",
                   "ec2:DescribeNetworkInterfaces",
                   "ec2:DescribeInstanceTypes"
               ],
               "Resource": "*"
           },
           {
               "Effect": "Allow",
               "Action": [
                   "ec2:CreateTags"
               ],
               "Resource": [
                   "arn:aws:ec2:*:*:network-interface/*"
               ]
           }
       ]
   }
   

2. Create the IAM policy.

   aws iam create-policy --policy-name AmazonEKS_CNI_IPv6_Policy --policy-document file://vpc-cni-ipv6-policy.json