From 0e76fd2d59e6597216439551cd5a53326dfb5eb5 Mon Sep 17 00:00:00 2001 From: Michal Jura Date: Thu, 7 Mar 2024 17:56:04 +0100 Subject: [PATCH] Update eks cluster configuration (#1048) * Update eks cluster configuration Issue: https://github.com/rancher/eks-operator/issues/301 Update eks cluster configuration with section about: - Launching self-managed Amazon Linux nodes - IAM roles for service accounts * Apply suggestions from code review * Apply suggestions from code review * fixed bad link * versioning --------- Co-authored-by: Marty Hernandez Avedon --- .../eks-cluster-configuration.md | 21 ++++++++++++++++++- .../eks-cluster-configuration.md | 19 +++++++++++++++++ 2 files changed, 39 insertions(+), 1 deletion(-) diff --git a/docs/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md b/docs/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md index c7936942596..dd3bf822712 100644 --- a/docs/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md +++ b/docs/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md @@ -1,5 +1,5 @@ --- -title: EKS Cluster Configuration Reference | 2.6 +title: EKS Cluster Configuration Reference --- @@ -147,6 +147,25 @@ The following settings are also configurable. All of these except for the "Node | Labels | Kubernetes labels applied to the nodes in the managed node group. | | Tags | These are tags for the managed node group and do not propagate to any of the associated resources. | +### Self-managed Amazon Linux Nodes + +You can register an EKS cluster containing self-managed Amazon Linux nodes. You must configure this type of cluster according to the instructions in the official AWS documentation for [launching self-managed Amazon Linux nodes](https://docs.aws.amazon.com/eks/latest/userguide/launch-workers.html). EKS clusters containing self-managed Amazon Linux nodes are usually operated by the [Karpenter](https://karpenter.sh/docs/) project. After you provision an EKS cluster containing self-managed Amazon Linux nodes, [register the cluster](../../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/register-existing-clusters.md) so it can be managed by Rancher. However, the nodes won't be visible in the Rancher UI. + +### IAM Roles for Service Accounts + +An Applications Deployment running on an EKS cluster can make requests to AWS services via IAM permissions. These applications must sign their requests with AWS credentials. IAM roles for service accounts manage these credentials using an AWS OIDC endpoint. Rather than distributing AWS credentials to containers or relying on an EC2 instance's role, you can link an [IAM role to a Kubernetes service account](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) and configure your Pods to use this account. + +:::note + +Linking to an IAM role is not supported for Rancher pods in an EKS cluster. + +::: + +To enable IAM roles for service accounts: +1. [Create an IAM OIDC provider for your cluster](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html) +1. [Configure a Kubernetes service account to assume an IAM role](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) +1. [Configure Pods to use a Kubernetes service account](https://docs.aws.amazon.com/eks/latest/userguide/pod-configuration.html) +1. [Use a supported AWS SDK](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-minimum-sdk.html) ### Configuring the Refresh Interval diff --git a/versioned_docs/version-2.8/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md b/versioned_docs/version-2.8/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md index a67d997b6c1..cce47910f3d 100644 --- a/versioned_docs/version-2.8/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md +++ b/versioned_docs/version-2.8/reference-guides/cluster-configuration/rancher-server-configuration/eks-cluster-configuration.md @@ -146,6 +146,25 @@ The following settings are also configurable. All of these except for the "Node | Labels | Kubernetes labels applied to the nodes in the managed node group. | | Tags | These are tags for the managed node group and do not propagate to any of the associated resources. | +### Self-managed Amazon Linux Nodes + +You can register an EKS cluster containing self-managed Amazon Linux nodes. You must configure this type of cluster according to the instructions in the official AWS documentation for [launching self-managed Amazon Linux nodes](https://docs.aws.amazon.com/eks/latest/userguide/launch-workers.html). EKS clusters containing self-managed Amazon Linux nodes are usually operated by the [Karpenter](https://karpenter.sh/docs/) project. After you provision an EKS cluster containing self-managed Amazon Linux nodes, [register the cluster](../../../how-to-guides/new-user-guides/kubernetes-clusters-in-rancher-setup/register-existing-clusters.md) so it can be managed by Rancher. However, the nodes won't be visible in the Rancher UI. + +### IAM Roles for Service Accounts + +An Applications Deployment running on an EKS cluster can make requests to AWS services via IAM permissions. These applications must sign their requests with AWS credentials. IAM roles for service accounts manage these credentials using an AWS OIDC endpoint. Rather than distributing AWS credentials to containers or relying on an EC2 instance's role, you can link an [IAM role to a Kubernetes service account](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html) and configure your Pods to use this account. + +:::note + +Linking to an IAM role is not supported for Rancher pods in an EKS cluster. + +::: + +To enable IAM roles for service accounts: +1. [Create an IAM OIDC provider for your cluster](https://docs.aws.amazon.com/eks/latest/userguide/enable-iam-roles-for-service-accounts.html) +1. [Configure a Kubernetes service account to assume an IAM role](https://docs.aws.amazon.com/eks/latest/userguide/associate-service-account-role.html) +1. [Configure Pods to use a Kubernetes service account](https://docs.aws.amazon.com/eks/latest/userguide/pod-configuration.html) +1. [Use a supported AWS SDK](https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-minimum-sdk.html) ### Configuring the Refresh Interval