files to use kiam on EKS/Fargate

agent.json

{
  "CN": "kiam-agent",
  "key": {
    "algo": "ecdsa",
    "size": 256
  },
  "names": [
    {
      "C": "JP",
      "L": "Tokyo",
      "O": "Juju-62q",
      "OU": "Juju-62q"
    }
  ]
}

ca.json

{
  "CN": "kiam-ca",
  "key": {
    "algo": "ecdsa",
    "size": 256
  },
  "names": [
    {
      "C": "JP",
      "L": "Tokyo",
      "O": "Juju-62q",
      "OU": "Juju-62q"
    }
  ],
  "ca": {
    "expiry": "262800h"
  }
}

cluster.yaml

apiVersion: eksctl.io/v1alpha5
kind: ClusterConfig
nodeGroups:
  - name: worker
    instanceType: t3.large
    desiredCapacity: 2
    minSize: 2
    maxSize: 2
    privateNetworking: true
metadata:
  name: kiam-fargate
  region: ap-northeast-1
fargateProfiles:
  - name: kiam
    selectors:
      - namespace: kiam
iam:
  withOIDC: true
  serviceAccounts:
  - metadata:
      name: kiam-server
      namespace: kiam
    attachPolicyARNs:
    - "arn:aws:iam::${ACCOUNT_ID}:policy/kiam-server"

kaim-server.yaml

apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRole
metadata:
  name: kiam-read
  namespace: kiam
rules:
- apiGroups:
  - ""
  resources:
  - namespaces
  - pods
  verbs:
  - watch
  - get
  - list
---
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
  name: kiam-server
  namespace: kiam
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: kiam-read
subjects:
- kind: ServiceAccount
  name: kiam-server
  namespace: kiam
---
apiVersion: v1
data:
  ca.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUI3ekNDQVpTZ0F3SUJBZ0lVWXh5bEFWV3JLTTU0czN6TS81YzlJRkF2akZBd0NnWUlLb1pJemowRUF3SXcKVlRFTE1Ba0dBMVVFQmhNQ1NsQXhEakFNQmdOVkJBY1RCVlJ2YTNsdk1SRXdEd1lEVlFRS0V3aEtkV3AxTFRZeQpjVEVSTUE4R0ExVUVDeE1JU25WcWRTMDJNbkV4RURBT0JnTlZCQU1UQjJ0cFlXMHRZMkV3SGhjTk1Ua3hNakE0Ck1UWXhOREF3V2hjTk5Ea3hNVE13TVRZeE5EQXdXakJWTVFzd0NRWURWUVFHRXdKS1VERU9NQXdHQTFVRUJ4TUYKVkc5cmVXOHhFVEFQQmdOVkJBb1RDRXAxYW5VdE5qSnhNUkV3RHdZRFZRUUxFd2hLZFdwMUxUWXljVEVRTUE0RwpBMVVFQXhNSGEybGhiUzFqWVRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkRQUHM0VWo3QVB1Cng0UVhmZGF3ZjREQ0lLdENkSElZbFVpaWVDalFKUVZ2UEFUZXp5T0dBWnNRcFgyUERpRU9CcFJKbFlnSzlabDcKemdtcEVBREhqUHFqUWpCQU1BNEdBMVVkRHdFQi93UUVBd0lCQmpBUEJnTlZIUk1CQWY4RUJUQURBUUgvTUIwRwpBMVVkRGdRV0JCU2lMejUxN2JKNlVoYWhtVU9hVDhwL1BvbFFzVEFLQmdncWhrak9QUVFEQWdOSkFEQkdBaUVBCjdlM2pKOFBueDhROHBRQ1lRRWc0dHliaTNxVlpoTmFRSXlqemhicXpWbHNDSVFEeFFxSlVydnJVWkduSXpJNjAKMkNxUElWSGVlbVVTSlJVQTlwV3RtT2NiMmc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
  server.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUN1akNDQW1DZ0F3SUJBZ0lVVnFoRkd4Yk1jRGRJR2ZnS1MwcncwSm9IT05Fd0NnWUlLb1pJemowRUF3SXcKVlRFTE1Ba0dBMVVFQmhNQ1NsQXhEakFNQmdOVkJBY1RCVlJ2YTNsdk1SRXdEd1lEVlFRS0V3aEtkV3AxTFRZeQpjVEVSTUE4R0ExVUVDeE1JU25WcWRTMDJNbkV4RURBT0JnTlZCQU1UQjJ0cFlXMHRZMkV3SGhjTk1Ua3hNakE0Ck1UY3pNakF3V2hjTk1qQXhNakEzTVRjek1qQXdXakJaTVFzd0NRWURWUVFHRXdKS1VERU9NQXdHQTFVRUJ4TUYKVkc5cmVXOHhFVEFQQmdOVkJBb1RDRXAxYW5VdE5qSnhNUkV3RHdZRFZRUUxFd2hLZFdwMUxUWXljVEVVTUJJRwpBMVVFQXhNTGEybGhiUzF6WlhKMlpYSXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CQndOQ0FBUmx2L3ZDCk5mRzdpUWpiNHByZTFIODlxNmR3dHZCRHJRQVhsL254UEhwTWdvOStCTVZVOUp4bnVwbFVCcW56SEpVTk1NSTYKTisvMnZJajA5WDA4MGtxZG80SUJDRENDQVFRd0RnWURWUjBQQVFIL0JBUURBZ1dnTUIwR0ExVWRKUVFXTUJRRwpDQ3NHQVFVRkJ3TUJCZ2dyQmdFRkJRY0RBakFNQmdOVkhSTUJBZjhFQWpBQU1CMEdBMVVkRGdRV0JCU2JVMmdBCmFXVmg3RDNVV0piQUhqQXRnVUROZGpBZkJnTlZIU01FR0RBV2dCU2lMejUxN2JKNlVoYWhtVU9hVDhwL1BvbFEKc1RDQmhBWURWUjBSQkgwd2U0SVFhMmxoYlMxelpYSjJaWEl1YTJsaGJZSVVhMmxoYlMxelpYSjJaWEl1YTJsaApiUzV6ZG1PQ0hHdHBZVzB0YzJWeWRtVnlMbXRwWVcwdWMzWmpMbU5zZFhOMFpYS0NJbXRwWVcwdGMyVnlkbVZ5CkxtdHBZVzB1YzNaakxtTnNkWE4wWlhJdWJHOWpZV3lDQ1d4dlkyRnNhRzl6ZEljRWZ3QUFBVEFLQmdncWhrak8KUFFRREFnTklBREJGQWlFQWxGYmwwajhzY1h0M0VTWG51Wk1CMkcvcGsvUTM1MTMwTzNoNWx1Y0t6SWNDSUdqQwpUUy91Vm1uSUhqNFArSW5NOUdvek5YRWlWVm5ncDNvUjA0M0QwOFZnCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
  server-key.pem: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSU5hVllMTFRDZ1RlNU9MNFl2TDMzOVU4Y3lzbEFMRndxcEVucnpneEpWUzNvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFWmIvN3dqWHh1NGtJMitLYTN0Ui9QYXVuY0xid1E2MEFGNWY1OFR4NlRJS1BmZ1RGVlBTYwpaN3FaVkFhcDh4eVZEVERDT2pmdjlyeUk5UFY5UE5KS25RPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
kind: Secret
metadata:
  name: kiam-server-tls
  namespace: kiam
type: Opaque
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: kiam-server
  namespace: kiam
spec:
  replicas: 3
  selector:
    matchLabels:
      app: kiam
      role: server
  template:
    metadata:
      labels:
        app: kiam
        role: server
    spec:
      serviceAccountName: kiam-server
      volumes:
        - name: tls
          secret:
            secretName: kiam-server-tls
      containers:
        - name: kiam
          image: quay.io/uswitch/kiam:b4a4891b136469511b3b011d38147cc1640b152e
          imagePullPolicy: Always
          resources:
            requests:
              cpu: 250m
              memory: 512Mi
          lifecycle:
            postStart:
              exec:
                command:
                  - "/bin/sh"
                  - "-c"
                  - "apk update && apk add --no-cache ca-certificates && update-ca-certificates"
          command:
            - /kiam
          args:
            - server
            - --json-log
            - --level=warn
            - --bind=0.0.0.0:443
            - --cert=/etc/kiam/tls/server.pem
            - --key=/etc/kiam/tls/server-key.pem
            - --ca=/etc/kiam/tls/ca.pem
            - --role-base-arn=arn:aws:iam::${ACCOUNT_ID}:role/
            - --sync=1m
          env:
            - name: SSL_CERT_FILE
              value: /etc/ssl/certs/ca-certificates.crt
            - name: SSL_CERT_DIR
              value: /etc/ssl/certs
          volumeMounts:
            - name: tls
              mountPath: /etc/kiam/tls
          livenessProbe:
            exec:
              command:
              - /kiam
              - health
              - --cert=/etc/kiam/tls/server.pem
              - --key=/etc/kiam/tls/server-key.pem
              - --ca=/etc/kiam/tls/ca.pem
              - --server-address=127.0.0.1:443
              - --gateway-timeout-creation=1s
              - --timeout=5s
            initialDelaySeconds: 10
            periodSeconds: 10
            timeoutSeconds: 10
          readinessProbe:
            exec:
              command:
              - /kiam
              - health
              - --cert=/etc/kiam/tls/server.pem
              - --key=/etc/kiam/tls/server-key.pem
              - --ca=/etc/kiam/tls/ca.pem
              - --server-address=127.0.0.1:443
              - --gateway-timeout-creation=1s
              - --timeout=5s
            initialDelaySeconds: 3
            periodSeconds: 10
            timeoutSeconds: 10
---
apiVersion: v1
kind: Service
metadata:
  name: kiam-server
  namespace: kiam
spec:
  clusterIP: None
  selector:
    app: kiam
    role: server
  ports:
  - name: grpclb
    port: 443
    targetPort: 443
    protocol: TCP

kiam-agent.yaml

apiVersion: v1
data:
  agent-key.pem: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUFjeU9FbzMwSlZGMkEwbHl5S0YyRGJUVG5WcmppUUUxR1BiWEFkdlFHZ0JvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFR0YwQ2N4aTZyU3JlbWxIUzFsSEorZEdtV0hObGQyS2ZUWW1XMFlPWVNXNUdzMUlBOEZuUwpFaFBZVmFBLzB0cUZlemVIdWRoZEpHN2VGUU9vWFNZVTlnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo=
  agent.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNMVENDQWRTZ0F3SUJBZ0lVYWlFNE1sQTlBeCtGekx5T3ZaeUlGNWZBdDRjd0NnWUlLb1pJemowRUF3SXcKVlRFTE1Ba0dBMVVFQmhNQ1NsQXhEakFNQmdOVkJBY1RCVlJ2YTNsdk1SRXdEd1lEVlFRS0V3aEtkV3AxTFRZeQpjVEVSTUE4R0ExVUVDeE1JU25WcWRTMDJNbkV4RURBT0JnTlZCQU1UQjJ0cFlXMHRZMkV3SGhjTk1Ua3hNakE0Ck1UWXhOREF3V2hjTk1qQXhNakEzTVRZeE5EQXdXakJZTVFzd0NRWURWUVFHRXdKS1VERU9NQXdHQTFVRUJ4TUYKVkc5cmVXOHhFVEFQQmdOVkJBb1RDRXAxYW5VdE5qSnhNUkV3RHdZRFZRUUxFd2hLZFdwMUxUWXljVEVUTUJFRwpBMVVFQXhNS2EybGhiUzFoWjJWdWREQlpNQk1HQnlxR1NNNDlBZ0VHQ0NxR1NNNDlBd0VIQTBJQUJCaGRBbk1ZCnVxMHEzcHBSMHRaUnlmblJwbGh6WlhkaW4wMkpsdEdEbUVsdVJyTlNBUEJaMGhJVDJGV2dQOUxhaFhzM2g3blkKWFNSdTNoVURxRjBtRlBhamZ6QjlNQTRHQTFVZER3RUIvd1FFQXdJRm9EQWRCZ05WSFNVRUZqQVVCZ2dyQmdFRgpCUWNEQVFZSUt3WUJCUVVIQXdJd0RBWURWUjBUQVFIL0JBSXdBREFkQmdOVkhRNEVGZ1FVWExoVjV2WWMzUUU0Ci9LZklnVkFQd3RHdm1zY3dId1lEVlIwakJCZ3dGb0FVb2k4K2RlMnllbElXb1psRG1rL0tmejZKVUxFd0NnWUkKS29aSXpqMEVBd0lEUndBd1JBSWdWSDJKVGwrZXR2cVdBQURSUUV3WUtpSkJRenl2eURXamJZRHd2NzRNRGYwQwpJQkd5SEs1ZnhRQXpNK2JtWTlWVVQ3WCtwZjJDUDhhb0lKd0xHbXd2MjY2OAotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
  ca.pem: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUI3ekNDQVpTZ0F3SUJBZ0lVWXh5bEFWV3JLTTU0czN6TS81YzlJRkF2akZBd0NnWUlLb1pJemowRUF3SXcKVlRFTE1Ba0dBMVVFQmhNQ1NsQXhEakFNQmdOVkJBY1RCVlJ2YTNsdk1SRXdEd1lEVlFRS0V3aEtkV3AxTFRZeQpjVEVSTUE4R0ExVUVDeE1JU25WcWRTMDJNbkV4RURBT0JnTlZCQU1UQjJ0cFlXMHRZMkV3SGhjTk1Ua3hNakE0Ck1UWXhOREF3V2hjTk5Ea3hNVE13TVRZeE5EQXdXakJWTVFzd0NRWURWUVFHRXdKS1VERU9NQXdHQTFVRUJ4TUYKVkc5cmVXOHhFVEFQQmdOVkJBb1RDRXAxYW5VdE5qSnhNUkV3RHdZRFZRUUxFd2hLZFdwMUxUWXljVEVRTUE0RwpBMVVFQXhNSGEybGhiUzFqWVRCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkRQUHM0VWo3QVB1Cng0UVhmZGF3ZjREQ0lLdENkSElZbFVpaWVDalFKUVZ2UEFUZXp5T0dBWnNRcFgyUERpRU9CcFJKbFlnSzlabDcKemdtcEVBREhqUHFqUWpCQU1BNEdBMVVkRHdFQi93UUVBd0lCQmpBUEJnTlZIUk1CQWY4RUJUQURBUUgvTUIwRwpBMVVkRGdRV0JCU2lMejUxN2JKNlVoYWhtVU9hVDhwL1BvbFFzVEFLQmdncWhrak9QUVFEQWdOSkFEQkdBaUVBCjdlM2pKOFBueDhROHBRQ1lRRWc0dHliaTNxVlpoTmFRSXlqemhicXpWbHNDSVFEeFFxSlVydnJVWkduSXpJNjAKMkNxUElWSGVlbVVTSlJVQTlwV3RtT2NiMmc9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
kind: Secret
metadata:
  name: kiam-agent-tls
  namespace: kube-system
type: Opaque
---
apiVersion: extensions/v1beta1
kind: DaemonSet
metadata:
  name: kiam-agent
  namespace: kube-system
spec:
  updateStrategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
  template:
    metadata:
      labels:
        app: kiam
        role: agent
    spec:
      hostNetwork: true
      dnsPolicy: ClusterFirstWithHostNet
      volumes:
        - name: ssl-certs
          hostPath:
            path: /etc/pki/ca-trust/extracted/pem/
        - name: tls
          secret:
            secretName: kiam-agent-tls
        - name: xtables
          hostPath:
            path: /run/xtables.lock
            type: FileOrCreate
      containers:
        - name: kiam
          securityContext:
            capabilities:
              add: ["NET_ADMIN"]
          image: quay.io/uswitch/kiam:v3.4
          imagePullPolicy: Always
          command:
            - /kiam
          args:
            - agent
            - --iptables
            - --host-interface=eni+
            - --json-log
            - --port=8181
            - --cert=/etc/kiam/tls/agent.pem
            - --key=/etc/kiam/tls/agent-key.pem
            - --ca=/etc/kiam/tls/ca.pem
            - --server-address=kiam-server.kiam:443
            - --gateway-timeout-creation=1s
          env:
            - name: HOST_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.podIP
          volumeMounts:
            - mountPath: /etc/ssl/certs
              name: ssl-certs
            - mountPath: /etc/kiam/tls
              name: tls
            - mountPath: /var/run/xtables.lock
              name: xtables
          livenessProbe:
            httpGet:
              path: /ping
              port: 8181
            initialDelaySeconds: 3
            periodSeconds: 3

kiam-server.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sts:AssumeRole"
      ],
      "Resource": "*"
    }
  ]
}

kiam-test.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "${ARN_OF_CREATED_IAM_ROLE_BY_EKSCTL}"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

kiam-test.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: default
  annotations:
    iam.amazonaws.com/permitted: ".*"
---
apiVersion: v1
kind: Pod
metadata:
  name: kiam-test
  labels:
    name: kiam-test
  annotations:
    iam.amazonaws.com/role: "kiam-test"
spec:
  containers:
  - image: debian
    command: [ "/bin/bash", "-c", "--" ]
    args: [ "while true; do sleep 30; done;" ]
    name: kiam-test

namespace.yaml

apiVersion: v1
kind: Namespace
metadata:
  name: kiam

server.json

{
  "CN": "kiam-server",
  "hosts": [
    "kiam-server.kiam",
    "kiam-server.kiam.svc",
    "kiam-server.kiam.svc.cluster",
    "kiam-server.kiam.svc.cluster.local",
    "127.0.0.1",
    "localhost"
  ],
  "key": {
    "algo": "ecdsa",
    "size": 256
  },
  "names": [
    {
      "C": "JP",
      "L": "Tokyo",
      "O": "Juju-62q",
      "OU": "Juju-62q"
    }
  ]
}