• IRSA: How to create an IAM role for a specific ServiceAccount

  2 min read

  
  

  On AWS EKS you can associate an IAM role with a Kubernetes service account. The assume role policy is going to look like this:

  {
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "",
        "Effect": "Allow",
        "Principal": {
          "Federated": "arn:aws:iam::123456789123:oidc-provider/oidc.eks.us-west-2.amazonaws.com/id/A3E2AFA46A6F0C9B37B3F4A479A00C20"
        },
        "Action": "sts:AssumeRoleWithWebIdentity",
        "Condition": {
          "StringEquals": {
            "oidc.eks.us-west-2.amazonaws.com/id/A3E2AFA46A6F0C9B37B3F4A479A00C20:sub": "system:serviceaccount:demons:demosa"
          }
        }
      }
    ]
  }
  

  Let's take a look on how to create this role using Terraform

  24/11/2021

  Read more...

• Install and configure external-DNS on AWS EKS

  3 min read

  With external DNS the DNS records for the ingress objects we have will be created automatically. We can choose between several cloud providers but we can even configure it to use the standard dynamic zone manipulation defined in RFC-2136. Let's see how to configure it on AWS EKS with Route53

  09/11/2021

  Read more...

• Terrafrom: Ignore changes on some of the managed resources

  2 min read

  Some of the resources we create using terraform might be externally changed, for example an AutoScalingGroup desired_capacity can be changed externally (not modifying terraform's state) in order to handle more traffic. That's the case for the worker's ASG on an EKS cluster, which will be usually modified by the cluster autoscaler

  (...)
  
  Note: Objects have changed outside of Terraform
  
  Terraform detected the following changes made outside of Terraform since the last "terraform apply":
  
    # module.eks.aws_autoscaling_group.workers["pet2cattle_eu-west-1a"] has been changed
    ~ resource "aws_autoscaling_group" "workers" {
        ~ desired_capacity          = 7 -> 6
          id                        = "pet2cattle_eu-west-1a2021082509502468370000000a"
          name                      = "pet2cattle_eu-west-1a2021082509502468370000000a"
          # (22 unchanged attributes hidden)
  
  
          # (16 unchanged blocks hidden)
      }
  
  Unless you have made equivalent changes to your configuration, or ignored the relevant attributes using ignore_changes, the following plan may include actions to undo or respond to these changes.
  
  (...)
  

  13/10/2021

  Read more...

• Update local kubeconfig to connect to an AWS EKS cluster

  2 min read

  If we want to connect to an AWS EKS cluster using kubectl we need to update our kubeconfig (~/.kube/config) To do se we can use awscli

  04/10/2021

  Read more...

• Kubernetes / AWS node termination handler: Drain spot instances that are about to be terminated

  3 min read

  If you are using a mixed policy on your EKS workers ASG you will want to install the AWS node termination handler to drain a node once AWS notifies that a particular spot instance is going to be reclaimed

  29/09/2021

  Read more...

More recent...