Amazon EKS Cluster Access for Cloudaware
The article instructs on how to provide access to Amazon EKS Cluster for Cloudaware to discover EKS resources automatically.
Since Amazon does not manage credentials for API inside a cluster, Cloudaware Collector IAM role needs to be manually provided with read access to Kubernetes API on a cluster level. At that point, Cloudaware will be able to retrieve EKS Nodes, Pods and other details. Read more
Cloudaware supports the following options of EKS access configuration:
Full Access
1. Ensure that the AWS credentials that kubectl
is using are already authorized for your cluster (the IAM user that created the cluster has required permissions by default). Open the aws-auth
ConfigMap:
kubectl edit -n kube-system configmap/aws-auth
2. Add CloudAware IAM role to the ConfigMap.
2.1. To locate your CloudAware IAM role ARN, log in to your Cloudaware account → Admin (under your username in the upper right corner) → Amazon accounts → locate AWS account where the access to EKS should be granted → click SEE ALL in column 'Connected Identities':
2.2. To add an IAM role: add the role details to the mapRoles
section of the ConfigMap under data
. Use the section below if it is not present in the file:
apiVersion: v1
kind: ConfigMap
metadata:
name: aws-auth
namespace: kube-system
data:
mapRoles: |
- rolearn: <CLOUDAWARE_ROLE_ARN>
username: cloudaware
groups:
- system:masters
WHERE
<CLOUDAWARE_ROLE_ARN> in rolearn
- is a placeholder that needs to be replaced by your Cluster Role ARN.
username
- the username within Kubernetes to be mapped to the IAM role (doesn't require changes).
groups
- a list of groups within Kubernetes where the role is mapped to (doesn't require changes). Check Default Roles and Role Bindings for more information.
Read-Only Access
In case you would like to grant the read-only access for Cloudaware allowing creation of ClusterRole and ClusterRole Binding in Kubernetes:
1. Create cloudaware-rbac.yaml using the section below:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: cloudaware-reader
rules:
- apiGroups: ["*"]
resources: ["*"]
verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: cloudaware-binding
subjects:
- kind: User
name: cloudaware
namespace: default
apiGroup: ""
roleRef:
kind: ClusterRole
name: cloudaware-reader
apiGroup: ""
WHERE
ClusterRole
cloudaware-reader grants read access to all resources within the cluster.
ClusterRoleBinding
cloudaware-binding maps the aforementioned cluster role to Cloudaware User.
2. Run the following command:
kubectl create -f cloudaware-rbac.yaml
3. To map IAM users and roles to Kubernetes users in the EKS cluster, define them in the aws-auth
ConfigMap which should exist after creation of your cluster. To add an IAM role to the cluster, modify this ConfigMap by adding the respective ARN and Kubernetes username value to the mapRole
property as an array item. To perform the modification, run the following command:
kubectl -n kube-system edit configmap aws-auth
See the example below:
apiVersion: v1
kind: ConfigMap
metadata:
name: aws-auth
namespace: kube-system
data:
mapRoles: |
- rolearn: <CLOUDAWARE_ROLE_ARN>
username: cloudaware
WHERE
<CLOUDAWARE_ROLE_ARN> in rolearn
is a placeholder that needs to be replaced by your Cluster Role ARN.
To locate your CloudAware IAM role ARN, log in to your Cloudaware account → Admin (under your username in the upper right corner) → Amazon accounts → locate AWS account where the access to EKS should be granted → click SEE ALL in column 'Connected Identities':
Make sure to not remove the existing mappings in mapRoles
and/or mapUsers
sections. You only need to append a role for Cloudaware.
Further Configuration
If your Amazon EKS Cluster is running in a private network, check this guide to install Cloudaware Breeze agent for secure connection.