search

caktus / ansible-role-django-k8s

Ansible role with sane defaults to deploy a Django app to Kubernetes.
BSD 3-Clause "New" or "Revised" License
3 stars 1 forks source link

Amazon S3: buckets with IAM role for K8s service accounts #27

Closed copelco closed 4 years ago

copelco commented 4 years ago

Add optional support for enabling a Kubernetes service account and associated IAM role that defines the access to public and private S3 buckets for each environment. This provides similar functionality of EC2 instance profiles within Kubernetes namespaces.

At a high level, the process is:

  1. Create environment-specific public and private S3 buckets
  2. Enable IAM roles for cluster service accounts
    • Requirement: eksctl must be installed
  3. Create an IAM role with a trust relatinoship and S3 policy for a service account
  4. Annotate the service account with the ARN of the IAM role
  5. Pods have read/write access to buckets w/o access keys

The securityContext also had to be updated so that non-root users could access the token on the filesystem in the container per this solution.

I debated whether or not this should exist here or within ansible-role-k8s-web-cluster. I ended up settling on here due to the re-use of environment-specific variables. However, it certainly touches on both projects and am open to suggestions.