RedbackThomson
commented
1 year ago try to modify aws-auth configmap using kubectl (not sure which profile to use for kubeconfig).
EKS currently locks the cluster to be accessible only by the IAM User/Role that created the cluster. Whichever role you've configured to be assumed by the eks-controller, will be the one you need to use. If you're using cross account resource management, it's the role you're assuming in the target account. If you're using IRSA, it's the role attached to the service account. Or if you're using hard coded credentials, it's the role associated with those.
tomitesh
gecube
ack-bot
mikestef9
Describe the bug We have established a control cluster using terraform, which includes an active eks controller. Additionally, we have configured IRSA (IAM Roles for Service Accounts) and utilized a service account with the eks controller.
When we create a new cluster (testcluster) by generating an eks controller yaml file within the control cluster, the process successfully creates a new cluster. It is worth mentioning that I have also created nodegroups, roles, add-ons, and other related components, but these details are not pertinent to the current issue focused solely on the cluster.
By default, eks provides cluster access to the creating identity, in this case, the IRSA service account.
Could you please provide guidance on how to modify the aws-auth file immediately after creating an eks cluster using the eks controller, to grant cluster access to another user or role (specifically, the devops user/role used for logging into the AWS console)?
Steps to reproduce
Expected outcome A concise description of what you expected to happen. want to know, how can we grant additional access to cluster immediately after creating eks cluster using eks controller. I can't use kubectl in this scenario to update aws-auth
Environment dev