EKS Pod Identity AddOns

#eks #kubernetes

Recently a new EKS addons introduced an addon feature Pod Identities. Basically if the pod want to communicate with other AWS services it will happen through the IAM Roles for service account (IRSA) where the IAM role will be configured as service account and attached to pods and a switch happens between EKS and IAM. Now with Pod Identity addons we can provide granular permissions for the pods.

You can install the addons and verify if it is added to the cluster

aws eks --region ap-south-1 list-addons --cluster-name demo

{
    "addons": [
        "coredns",
        "eks-pod-identity-agent",
        "kube-proxy",
        "vpc-cni"
    ]
}

You can verify the addons running as daemonset in the cluster

kubectl get daemonset -A


NAMESPACE     NAME                     DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
kube-system   aws-node                 2         2         2       2            2           <none>          51m
kube-system   eks-pod-identity-agent   2         2         2       2            2           <none>          48m
kube-system   kube-proxy               2         2         2       2            2           <none>          51m

Let us break down and see how exactly it works, we will try to access S3 bucket from the pod using pod identity.

Step 1. Create test S3 bucket name test-884.
Step 2. Create an IAM role pod-identity-s3-demo choose trusted entity EKS and EKS pod identity.
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8fwfyfwcs6tn5hqdnzqc.png
Step 3. Click next and you could see a trust policy added to the role

Step 4. Click next and create the role.
Step 5. After creating a role we can add inline policy with the bucket name specified as below

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "s3:GetObject",
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::test-884/*",
      "Sid": "PodIdentity"
    }
  ]
}