Automatically annotate Kubernetes Deployments with kube2iam annotation
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
charts/iam-role-annotator
cmd
pkg
.codeclimate.yml
.gitignore
.travis.yml
Dockerfile
Gopkg.lock
Gopkg.toml
Makefile
README.md
coverage
e2e_test.sh
main.go

README.md

IAM Role Annotator Build Status

This Kubernetes controller is watching Deployment objects using the Kubernetes API. Whenever a Deployment is created or updated, the controller will check if the Deployment contains the armesto.net/iam-role-annotator annotation, and, in that case, add the iam.amazonaws.com/role annotation containing the appropiate IAM Role.

The IAM Role Annotator assumes that an IAM Role is already created for every application. The IAM Role ARN used in the annotation will be an ARN of the form arn:aws:iam::<AWS_ACCOUNT_ID>:role/<APPLICATION_NAME>, where the application name is the name of the Deployment object.

Build

We provide a Makefile that you can use to build this application

$ make

Or if you are running linux

$ make build/iam-role-annotator-linux-amd64

Tests

You can run the tests using the Makefile

$ make test

Usage

You can start the application with the following command

$ go run *.go --namespace your-namespace --aws-account-id 12345

Or using environment variables

$ NAMESPACE="your-namespace" AWS_ACCOUNT_ID="12345" go run *.go

Parameters

These are the available parameters (all parameters can be also passed as environment variables)

  • namespace: Only Deployments in this namespace will be watched
  • aws-account-id: The AWS account id used in the role's ARN
  • resync-seconds: The controller will reprocess all watched objects every resync-seconds seconds
  • kubeconfig: Kubernetes configuration file used to connect to the cluster, only used when running the controller outside the cluster

Releasing

This application is package using Docker containers that are published in this repository

$ make release