Use Amazon Secrets and Configuration Provider CSI with Pod Identity for Amazon EKS

To install the Pod Identity Agent

• Install the Pod Identity Agent add-on on your cluster.

  Replace the default placeholder text with your own values:

  eksctl create addon \
    --name eks-pod-identity-agent \
    --cluster clusterName \
    --region region 

1. Create a permissions policy that grants ssm:GetParameters and ssm:DescribeParameters permission to the parameters that the Pod needs to access.

2. Create an IAM role that can be assumed by the Amazon EKS service principal for Pod Identity:

   {
       "Version": "2012-10-17",
       "Statement": [
         {
           "Effect": "Allow",
           "Principal": {
             "Service": "pods.eks.amazonaws.com"
           },
           "Action": [
             "sts:AssumeRole",
             "sts:TagSession"
           ]
         }
       ]
     }

   Attach the IAM policy to the role.

   Replace the default placeholder text with your own values:

   aws iam attach-role-policy \
     --role-name MY_ROLE \
     --policy-arn POLICY_ARN

3. Create a Pod Identity association. For an example, see Create a Pod Identity association in the Amazon EKS User Guide

4. Create the SecretProviderClass that specifies which parameters or secrets to mount in the Pod:

   kubectl apply -f kubectl apply -f https://raw.githubusercontent.com/aws/secrets-store-csi-driver-provider-aws/main/examples/ExampleSecretProviderClass-PodIdentity.yaml

   The key difference in SecretProviderClass between IRSA and Pod Identity is the optional parameter usePodIdentity. It is an optional field that determines the authentication approach. When not specified, it defaults to using IAM Roles for Service Accounts (IRSA).

   • To use EKS Pod Identity, use any of these values: "true", "True", "TRUE", "t", "T".

   • To explicitly use IRSA, set to any of these values: "false", "False", "FALSE", "f", or "F".

5. Deploy the Pod that mounts the parameters or secrets under /mnt/secrets-store:

   kubectl apply -f kubectl apply -f https://raw.githubusercontent.com/aws/secrets-store-csi-driver-provider-aws/main/examples/ExampleDeployment-PodIdentity.yaml

6. If you use a private Amazon EKS cluster, make sure that the VPC that the cluster is in has an Amazon STS endpoint. For information about creating an endpoint, see Interface VPC endpoints in the Amazon Identity and Access Management User Guide.

To set up Amazon EKS Pod Identity to access to parameters in Parameter Store

1. Create a permissions policy that grants ssm:GetParameters and ssm:DescribeParameters permission to the parameters that the Pod needs to access.

2. Create a parameter in Parameter Store, if you do not already have one. For information, see Creating Parameter Store parameters in Systems Manager.

To see error messages for your container

1. Get a list of Pod names with the following command. If you aren't using the default namespace, use -n namespace.

   kubectl get pods

2. To describe the Pod, in the following command, for pod-id use the Pod ID from the Pods you found in the previous step. If you aren't using the default namespace, use -n NAMESPACE.

   kubectl describe pod/pod-id

To see errors for the ASCP

• To find more information in the provider logs, in the following command, for PODID use the ID of the csi-secrets-store-provider-aws Pod.

  kubectl -n kube-system get pods
  kubectl -n kube-system logs pod/pod-id