Creating an Ignition Service account on EKS using IRSA

When running on EKS, you can associate IAM roles with the service account that Ignition runs with. This can give Ignition capabilities to access other AWS services in your account.

Setup

Let's start by defining a few environment variables for our cluster, region, and desired IAM Policy attachments.

# Replace the values below and then export these variables to your shell.
export AWS_REGION=<your-aws-region>
export CLUSTER_NAME=<your-eks-cluster-name>
# arn:aws:iam::aws:policy/AWSMarketplaceMeteringFullAccess
export POLICY_ARN=<iam-policy-arn-to-attach>
export IGNITION_NAMESPACE=ignition
export IGNITION_SERVICE_ACCOUNT_NAME=ignition

Creating an Ignition Service Account

In this example, we'll use IAM Roles for Service Accounts (IRSA) to associate an IAM role and attached policies with the Ignition service account.

First, let's create the Ignition namespace:

# Create the Ignition namespace
kubectl create namespace $IGNITION_NAMESPACE
# Set the current kubectl context to use that namespace by default
kubectl config set-context --current --namespace=$IGNITION_NAMESPACE

eksctl

# Create the IAM service account
eksctl create iamserviceaccount \
  --name $IGNITION_SERVICE_ACCOUNT_NAME \
  --namespace $IGNITION_NAMESPACE \
  --cluster $CLUSTER_NAME \
  --region $AWS_REGION \
  --attach-policy-arn $POLICY_ARN
# NOTE: you may need to re-run with `--approve` to finalize the creation

AWS CLI

Creating the IAM role and associated policy using the AWS CLI involves several steps.

1. Record your AWS account ID and OIDC provider URL into shell variables that will be used later on.

   account_id=$(aws sts get-caller-identity --query "Account" --output text)
   oidc_provider=$(aws eks describe-cluster --name $CLUSTER_NAME --region $AWS_REGION \
     --query "cluster.identity.oidc.issuer" --output text | sed -e "s/^https:\/\///" \
   )

2. Define a trust policy to determine which service account can assume the role. The command below will output a trust-policy.json file that you'll use when creating the IAM role.

   cat << EOF > trust-policy.json
   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "Federated": "arn:aws:iam::${account_id:?required}:oidc-provider/${oidc_provider:?required}"
               },
               "Action": "sts:AssumeRoleWithWebIdentity",
               "Condition": {
                   "StringEquals": {
                       "${oidc_provider}:aud": "sts.amazonaws.com",
                   "${oidc_provider}:sub": "system:serviceaccount:${IGNITION_NAMESPACE:?required}:$    {IGNITION_SERVICE_ACCOUNT_NAME:?required}"
                   }
               }
           }
       ]
   }
   EOF

3. Create the IAM role and define the trusted entities with the file you created above.

   role_name="${CLUSTER_NAME:?required}-${IGNITION_SERVICE_ACCOUNT_NAME:?required}-svcacct-role"
   aws iam create-role \
     --role-name "${role_name}" \
     --assume-role-policy-document file://trust-policy.json \
     --description "IAM role for Ignition to submit AWS Marketplace Metering records"

4. Attach the AWSMarketplaceMeteringFullAccess policy to the role.

   aws iam attach-role-policy \
     --role-name "${role_name:?required}" \
     --policy-arn arn:aws:iam::aws:policy/AWSMarketplaceMeteringFullAccess

5. Finally, create the Kubernetes service account and annotate it with the IAM role ARN.

   kubectl create serviceaccount -n $IGNITION_NAMESPACE \
     $IGNITION_SERVICE_ACCOUNT_NAME && \
   kubectl annotate serviceaccount -n $IGNITION_NAMESPACE \
     $IGNITION_SERVICE_ACCOUNT_NAME \
     eks.amazonaws.com/role-arn=arn:aws:iam::$account_id:role/$role_name

Service Account in Helm Chart Values

We don't want the Helm Chart to attempt to create the service account on our behalf since we're managing it externally. Use the following value overrides to specify the service account name and disable automatic creation:

Helm Chart Value Overrides

serviceAccount:
  create: false
  # set the name to be the IGNITION_SERVICE_ACCOUNT_NAME used above
  name: "ignition"