davivcgarcia

EKS Cluster Access Management

This is a hot-patch for the Amazon EKS Workshop to cover leverage the recently announced Cluster Access Management API, that superseed the old method based on an integration between IAM and a in-cluster Kubernetes ConfigMap.

Steps to execute

1. Let's create an IAM User, that will be used for exercising the EKS access management.

aws iam create-user --user-name lab-user

davivcgarcia

kind: ClusterConfig
apiVersion: eksctl.io/v1alpha5
metadata:
  name: sandbox
  version: "1.21"
  region: us-east-2
cloudWatch:
  clusterLogging:
    enableTypes:
      - api

davivcgarcia

kind: ClusterConfig
apiVersion: eksctl.io/v1alpha5
metadata:
  name: sandbox
  version: "1.21"
  region: us-east-1
cloudWatch:
  clusterLogging:
    enableTypes:
      - api

davivcgarcia

#! /bin/bash
#
# About: Unified shell script to simplify AWS CloudShell/Cloud9 tooling bootstraping
# Author: Davi Garcia (davivcgarcia)
#
# Usage: $ source <(curl -sL https://bit.ly/aws-cloud-bootstrapper)
# 

#
# Creates directory structure in the persistent storage mount

davivcgarcia

Keybase proof

I hereby claim:

• I am davivcgarcia on github.
• I am davivcgarcia (https://keybase.io/davivcgarcia) on keybase.
• I have a public key whose fingerprint is C6BB 51FB 4A3E 5181 94DE 9459 BCE4 9001 8268 6C82

To claim this, I am signing this object:

davivcgarcia

apiVersion: v1
kind: Secret
metadata:
  name: redhat-pull-secret
data:
  .dockerconfigjson: ewogICJhdXRocyI6IHsKICAgICJxdWF5LmlvIjogewogICAgICAiYXV0aCI6ICJjbVZrYUdGMEszRjFZWGs2VHpneFYxTklVbE5LVWpFMFZVRmFRa3MxTkVkUlNFcFRNRkF4VmpSRFRGZEJTbFl4V0RKRE5GTkVOMHRQTlRsRFVUbE9NMUpGTVRJMk1USllWVEZJVWc9PSIsCiAgICAgICJlbWFpbCI6ICIiCiAgICB9CiAgfQp9
type: kubernetes.io/dockerconfigjson

---

davivcgarcia

#
# WARNING: This document is not a official Red Hat procedure,  and the commands will disable HA 
#          of control-plane components, turning your environment to not supported.
#

oc patch clusterversion/version --type='merge' -p "$(cat <<- EOF
spec:
  overrides:
  - group: apps/v1
    kind: Deployment

davivcgarcia

# this config file contains all config fields with comments
kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
# patch the generated kubeadm config with some extra settings
kubeadmConfigPatches:
- |
  apiVersion: kubeadm.k8s.io/v1beta1
  kind: ClusterConfiguration
  metadata:
    name: config

davivcgarcia

#
# Namespace used for sandboxing
#

---
apiVersion: v1
kind: Namespace
metadata:
  creationTimestamp: null
  name: demo-ocs-workloads

davivcgarcia

#! /bin/bash

#######################
### BASIC INIT
#######################

# Check for root access
[ `whoami` = root ] || { sudo "$0" "$@"; exit $?; }

# Set workdir