What does "eksctl create iamserviceaccount" do under the hood on an EKS cluster?
Jan 28
AWS supports IAM Roles for Service Accounts (IRSA) that allows cluster operators to map AWS IAM Roles to Kubernetes Service Accounts.
To do so, one has to create an iamserviceaccount in an EKS cluster:
eksctl create iamserviceaccount \
--name <AUTOSCALER_NAME> \
--namespace kube-system \
--cluster <CLUSTER_NAME> \
--attach-policy-arn <POLICY_ARN> \
--approve \
--override-existing-serviceaccounts
The problem is that I don't want to use the above eksctl command because I want to declare my infrastructure using terraform.
Does eksctl command do anything other than creating a service account? If it only creates a service account, what is the YAML representation of it?
terraform
kubernetes1 answer
Accepted answer · original discussion
Jan 28
After Vasili Angapov's helps, now I can answer the question:
Yes It does more than just creating a service account. It does three things:
- It Creates an IAM role.
- It attaches the desired iam-policy (--attach-policy-arn <POLICY_ARN>) to the created IAM role.
- It creates a new kubernetes service account annotated with the arn of the created IAM role.
Now It's easy to declare the above steps using kubernetes and aws providers in terraform.
0 question comments
Use comments to ask for clarification. Post a solution as an answer.
No question comments on this page.