-
Notifications
You must be signed in to change notification settings - Fork 4
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
3 changed files
with
105 additions
and
79 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| ## Setup for EKS | ||
|
|
||
| Define and apply an IRSASetup custom resource. | ||
|
|
||
| ```yaml | ||
| apiVersion: irsa-manager.kkb0318.github.io/v1alpha1 | ||
| kind: IRSASetup | ||
| metadata: | ||
| name: irsa-init | ||
| namespace: irsa-manager-system | ||
| spec: | ||
| mode: eks | ||
| cleanup: false | ||
| iamOIDCProvider: "oidc.eks.<region>.amazonaws.com/id/<id>" | ||
| ``` | ||
| Check the IRSASetup custom resource status to verify whether it is set to true. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| ## Setup for Self-Hosted | ||
|
|
||
|  | ||
|
|
||
| ### Define and apply an IRSASetup custom resource according to your needs. | ||
|
|
||
| ```yaml | ||
| apiVersion: irsa-manager.kkb0318.github.io/v1alpha1 | ||
| kind: IRSASetup | ||
| metadata: | ||
| name: irsa-init | ||
| namespace: irsa-manager-system | ||
| spec: | ||
| cleanup: false | ||
| discovery: | ||
| s3: | ||
| region: <region> | ||
| bucketName: <S3 bucket name> | ||
| ``` | ||
| Check the IRSASetup custom resource status to verify whether it is set to true. | ||
| > [!NOTE] | ||
| > Please ensure that only one IRSASetup resource is created. | ||
| ### Modify kube-apiserver Settings | ||
| If the IRSASetup status is true, a key file (Name: `irsa-manager-key` , Namespace: `kube-system` ) will be created. This is used for signing tokens in the kubernetes API. | ||
| Execute the following commands on the control plane server to save the public and private keys locally for Kubernetes signatures: | ||
|
|
||
| ```console | ||
| kubectl get secret -n kube-system irsa-manager-key -o jsonpath="{.data.ssh-privatekey}" | base64 --decode | sudo tee /path/to/file.key > /dev/null | ||
| kubectl get secret -n kube-system irsa-manager-key -o jsonpath="{.data.ssh-publickey}" | base64 --decode | sudo tee /path/to/file.pub > /dev/null | ||
| ``` | ||
|
|
||
| > [!NOTE] | ||
| > Path: `/path/to/file` can be any path you choose. | ||
| > If you use kubeadm, it is recommended to set `/etc/kubernetes/pki/irsa-manager.(key|pub)` | ||
|
|
||
| Then, modify the kube-apiserver settings to include the following parameters: | ||
|
|
||
| - API Audiences | ||
|
|
||
| ``` | ||
| --api-audiences=sts.amazonaws.com | ||
| ``` | ||
|
|
||
| - Service Account Issuer | ||
|
|
||
| ``` | ||
| --service-account-issuer=https://s3-<region>.amazonaws.com/<S3 bucket name> | ||
| ``` | ||
|
|
||
| > [!NOTE] | ||
| > Add this setting as the first element. | ||
| > When this flag is specified multiple times, the first is used to generate tokens and all are used to determine which issuers are accepted. | ||
|
|
||
| - Service Account Key File | ||
|
|
||
| The public key generated previously can be read by the API server. Add the path for this parameter flag: | ||
|
|
||
| ``` | ||
| --service-account-key-file=/path/to/file.pub | ||
| ``` | ||
|
|
||
| > [!NOTE] | ||
| > If you do not mount /path/to directory, you need to add the volumes field to this path. | ||
|
|
||
| - Service Account Signing Key File | ||
|
|
||
| The private key (oidc-issuer.key) generated previously can be read by the API server. Add the path for this parameter flag: | ||
|
|
||
| ``` | ||
| --service-account-signing-key-file=/path/to/file.key | ||
| ``` | ||
|
|
||
| > [!NOTE] | ||
| > Overwrite the existing settings. | ||
| > If you do not mount /path/to directory, you need to add the volumes field to this path. | ||
|
|
||
| For more details, refer to the [Kubernetes documentation](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#serviceaccount-token-volume-projection). |