Security

Deployment Manifest -> Service Acccount -> IAM Role -> Policies

IAM OIDC Provider (Cluster Level) -> AWS Identity and IAM

• IAM Role is all about specific implementation (AWS in this case)

Pods need Kubernetes Cluster access as well

• ClusterRoles grant access to cluster-specific resources
• Create/Delete/List/etc. Nodes
• Create/Delete/List/etc. Pods
• Create/Delete/List/etc. Namespaces
• etc.

kubectl get clusterrole
kubectl describe clusterrole admin
kubectl describe clusterrole view

Role vs ClusterRule

Both Role and ClusterRole represent set of permissions - A Role sets permission within a particular namespace - have to specify namespace - ClusterRole is non-namespaced

Types of security

• For application

• For users (humans)

RBAC

Give access to users in EKS

Admin

Edit aws-auth

kubectl edit -n kube-system configmap/aws-auth

Add the config

  mapUsers: |
    - userarn: arn:aws:iam::123456789012:user/adminuser
      username: adminuser
      groups:
        - system:masters

Granular Access

1. apply role rule
2. This will give access ONLY to monitoring namespace

kubectl apply -f files/monitoring-user-rolebinding.yaml

Edit aws-auth

kubectl edit -n kube-system configmap/aws-auth

Add the config

  mapUsers: |
    - userarn: arn:aws:iam::111111111111:user/k8s-test-user
      username: k8s-test-user
      groups:
        - monitoring-role

Login as k8s-test-user

kubectl get pods -n kube-system
kubectl get pods -n monitoring