Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

argocd-k8s-auth aws command dont have flag for region-code #11207

Closed
Ryu-Z opened this issue Nov 6, 2022 · 2 comments
Closed

argocd-k8s-auth aws command dont have flag for region-code #11207

Ryu-Z opened this issue Nov 6, 2022 · 2 comments
Labels
enhancement New feature or request

Comments

@Ryu-Z
Copy link

Ryu-Z commented Nov 6, 2022

Summary

we have six eks clusters, and we have a ops eks cluster, deploy argocd in the ops eks cluster.
use an iam role sts assume for other aws accounts role to mange eks cluster

Motivation

my argocd serviceaccount have an iam role for sts assume to other accounts

apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::[aws-account-id]:role/[ops-eks-cluster-role]
  labels:
    app.kubernetes.io/component: repo-server
    app.kubernetes.io/name: argocd-repo-server
    app.kubernetes.io/part-of: argocd
  name: argocd-repo-server
  namespace: argocd

can argocd-k8s-auth aws command have the region-code flag set?
like this

{
  "tlsClientConfig": {
    "insecure": false,
    "caData": "LS0...=="
  },
  "execProviderConfig": {
    "command": "aws",
    "args": [
      "--region",
      "ap-northeast-1",
      "eks",
      "get-token",
      "--cluster-name",
      "[eks-cluster-name]",
      "--role",
      "arn:aws:iam::[aws-account-id]:role/[role-name]"
    ],
    "env": null,
    "apiVersion": "client.authentication.k8s.io/v1beta1",
    "installHint": "aws dont exist"
  }
}

Proposal

https://aws.amazon.com/premiumsupport/knowledge-center/amazon-eks-cluster-access/?nc1=h_ls
i use this docs to configure my eks clusters
i want have a region field in the awsAuthConfig configuration and a sts assume configuration,
this can use the arocd container identity role to aussme other aws role
like this:

{
    ...
    "awsAuthConfig": {
        "region": "us-east-1",
        "clusterName": "[eks-cluster-name]",
        "assumeRoleARN": "arn:aws:iam::[aws-account-id]:role/[role-name]"
    },
    ....
}
@blakepettersson
Copy link
Member

Can you show something which indicates that managing clusters in regions other than where Argo CD is not working? I've been able to manage clusters across regions (and accounts) with argocd-k8s-auth without needing to set a region.

@blakepettersson
Copy link
Member

Closing for now, if this is something which doesn't work feel free to re-open this issue.

@blakepettersson blakepettersson closed this as not planned Won't fix, can't repro, duplicate, stale Oct 1, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants