Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(eks): cross-account support #600

Merged
merged 3 commits into from
Nov 20, 2023
Merged

Conversation

Gearheads
Copy link
Collaborator

@Gearheads Gearheads commented Nov 18, 2023

What this PR does / why we need it:
This PR will allow EKS users to leverage cross-account support. This means the feature will allow users to provide a new flag called --assume-role-arn, kconnect will login will the main credentials, and then switch to a different AWS IAM role within another AWS Account.

This is helpful for users who want to be part of a single AD group in a central AWS account, which then assumes and gives access to any EKS cluster instead of having to be in several different AD groups for each AWS account.

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

Testing:

  • make ci completed successfully
  • was able to connect to a cluster, and assume the new AWS IAM role
% ./kconnect use eks --namespace <namespace> --region us-east-1 --username *** --password *** --assume-role-arn arn:aws:iam::<AWS-account>:role/<AWS-IAM-role>
info    kconnect - the Kubernetes Connection Manager CLI        {"version": ""}
info    authenticating user     {"app": "kconnect", "provider": "saml"}
? Select AWS role Account: <AWS-account-name> (<AWS-account>) / <AWS-IAM-role>
info    requesting AWS credentials using SAML   {"provider": "saml", "sp": "aws"}
info    discovering clusters    {"app": "kconnect", "provider": "eks"}
info    discovering EKS clusters        {"app": "kconnect", "provider": "eks"}
? Select a cluster <cluster-name>
? Do you want to set an alias? No
info    Command to reconnect using this alias: kconnect to      {"app": "kconnect"}
info    setting current context {"context": "kconnect@<eks-cluster-name>"}
info    kubeconfig updated      {"path": "/path/to/KUBECONFIG"}

% ./kconnect ls | head -n 3                                                                                                                                                     
info    kconnect - the Kubernetes Connection Manager CLI        {"version": ""}
CUR   ID                           ALIAS    PROVIDER   PROVIDERID               IDENTITY   USER     TIME LEFT
>     01hffm07j9m8ck60t3w3cjr5zy            eks        arn:aws:eks:<provider>   saml       <user>   59m53s

% kubectl get nodes
Error from server (Forbidden): nodes is forbidden: User "arn:aws:iam::<AWS-assumed-account>:role/<AWS-assumed-IAM-role>" cannot list resource "nodes" in API group "" at the cluster scope

Signed-off-by: Casale, Robert <Robert.Casale@fmr.com>
This will remove the logic from the third-party submodule called saml2aws, because we are already using an outdated, and custom, version of the module, and I do not want to add more custom logic to it to cause us to be even further from the upstream code.

Signed-off-by: Casale, Robert <Robert.Casale@fmr.com>
@Gearheads Gearheads changed the title Feature/cross account support feat(eks): cross-account support Nov 18, 2023
Signed-off-by: Casale, Robert <Robert.Casale@fmr.com>
@Gearheads Gearheads merged commit aa54570 into main Nov 20, 2023
9 checks passed
@Gearheads Gearheads deleted the feature/cross-account-support branch November 20, 2023 14:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants