Update IRSA doc to point to the working commit and image tag #1771
Conversation
eks-distro-bot
added
approved
size/XS
| @@ -96,7 +96,13 @@ Set the remaining fields in [cluster spec](https://anywhere.eks.amazonaws.com/do | |||
|
|
|||
| 1. After hosting the service account public signing key and OIDC discovery documents, the applications running in pods can start accessing the desired AWS resources, as long as the pod is mounted with the right service account tokens. This part of configuring the pods with the right service account tokens and env vars is automated by the [amazon pod identity webhook](https://github.com/aws/amazon-eks-pod-identity-webhook). Once the webhook is deployed, it mutates any pods launched using service accounts annotated with `eks.amazonaws.com/role-arn` | |||
|
|
|||
| 1. Follow the [in-cluster installation steps](https://github.com/aws/amazon-eks-pod-identity-webhook#in-cluster) for amazon-eks-pod-identity-webhook. While running the make target, make sure the $KUBECONFIG env var is set to the path of the EKS Anywhere cluster. | |||
| 1. Check out [this commit](https://github.com/aws/amazon-eks-pod-identity-webhook/commit/a65cc3d9c61cf6fc43f0f985818c474e0867d786) of the amazon-eks-pod-identity-webhook. | |||
There was a problem hiding this comment.
We can't get them to fix this?
There was a problem hiding this comment.
There is an open issue in that repo, I've also opened up this PR to address it. But till it gets reviewed and merged we will have to point our docs to a commit that works.
| 1. Follow the [in-cluster installation steps](https://github.com/aws/amazon-eks-pod-identity-webhook#in-cluster) for amazon-eks-pod-identity-webhook. While running the make target, make sure the $KUBECONFIG env var is set to the path of the EKS Anywhere cluster. | ||
| 1. Check out [this commit](https://github.com/aws/amazon-eks-pod-identity-webhook/commit/a65cc3d9c61cf6fc43f0f985818c474e0867d786) of the amazon-eks-pod-identity-webhook. | ||
|
|
||
| 1. Set the $KUBECONFIG env var to the path of the EKS Anywhere cluster. Run the following command: |
There was a problem hiding this comment.
Is this two separate steps? If so, you could write it something like this:
| 1. Set the $KUBECONFIG env var to the path of the EKS Anywhere cluster. Run the following command: | |
| 1. Set the $KUBECONFIG env var to the path of the EKS Anywhere cluster. | |
| 1. Run the following command: |
There was a problem hiding this comment.
Also, I wondered if there is other information that a user would need from the installation instructions that you are missing now. For example, the need to install cert-manager as a pre-requisite and where to get the Makefile.
There was a problem hiding this comment.
@chrisnegus EKS-A already installs cert-manager so we don't need to add this instruction. Since we're asking them to checkout that commit, Makefile will be available to them
Co-authored-by: Chris Negus <[email protected]>
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: chrisnegus, mrajashree The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Description of changes:
The pod identity webhook repository has some recent changes due to which its installation doesn't work. This PR updates the link of the pod identity webhook repo to an older commit that does work, and updates the image to a previous tag instead of latest.
Testing (if applicable):
Installed pod identity webhook with the updated Readme and IRSA worked as expected
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.