Create an identity mapping for EKS with Terraform-CodePudding

I am currently provision my EKS cluster/s using EKSCTL and I want to use Terraform to provision the cluster/s. I am using Terraform EKS module to create cluster. I have use EKSCTL to create identity mapping with following command

eksctl create iamidentitymapping -- region us-east-1 --cluster stage-cluster --arn arn:aws:iam::111222333444:role/developer --username dev-service

I want to convert this command to Terraform with following, but it is not the best way

  resource "null_resource" "eks-identity-mapping" {
  depends_on = [
    module.eks,
    aws_iam_policy_attachment.eks-policy-attachment
  ]
  provisioner "local-exec" {
    command = <<EOF
      eksctl create iamidentitymapping \
      --cluster ${var.eks_cluster_name} \
      --arn ${data.aws_iam_role.mwaa_role.arn} \
      --username ${var.mwaa_username} \
      --profile ${var.aws_profile} \
      --region ${var.mwaa_aws_region}
    EOF
  }
}

How can I use Kubernetes provider to achieve this

CodePudding user response：

I haven't found a clear matching for this particular command, but you can achieve something similar by setting the aws-auth config map in kubernetes, adding all of the users/roles and their access rights in one go.

For example we use something like the following below to supply the list of admins to our cluster:

resource "kubernetes_config_map" "aws_auth" {
  metadata {
    name      = "aws-auth"
    namespace = "kube-system"
  }

  data = {
    mapRoles = <<CONFIGMAPAWSAUTH
- rolearn: ${var.k8s-node-iam-arn}
  username: system:node:{{EC2PrivateDNSName}}
  groups:
    - system:bootstrappers
    - system:nodes
- rolearn: arn:aws:iam::111222333444:role/developer
  username: dev-service
  groups:
    - system:masters
CONFIGMAPAWSAUTH
  }
}

Note that this file contains all of the role mappings, so you should make sure var.k8s-node-iam-arn is set to the superuser of the cluster otherwise you can get locked out. Also you have to set what access these roles will get.

You can also add specific IAM users instead of roles as well:

- userarn: arn:aws:iam::1234:user/user.first
  username: user.first
  groups:
    - system:masters