Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update IRSA doc to point to the working commit and image tag #1771

Merged
merged 2 commits into from
Apr 11, 2022
Merged

Update IRSA doc to point to the working commit and image tag #1771

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2c22538
Update IRSA doc to point to the working commit and image tag
mrajashree Apr 6, 2022
f338aca
Update docs/content/en/docs/reference/clusterspec/irsa.md
mrajashree Apr 7, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion docs/content/en/docs/reference/clusterspec/irsa.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,7 +96,13 @@ Set the remaining fields in [cluster spec](https://anywhere.eks.amazonaws.com/do

1. After hosting the service account public signing key and OIDC discovery documents, the applications running in pods can start accessing the desired AWS resources, as long as the pod is mounted with the right service account tokens. This part of configuring the pods with the right service account tokens and env vars is automated by the [amazon pod identity webhook](https://github.com/aws/amazon-eks-pod-identity-webhook). Once the webhook is deployed, it mutates any pods launched using service accounts annotated with `eks.amazonaws.com/role-arn`

1. Follow the [in-cluster installation steps](https://github.com/aws/amazon-eks-pod-identity-webhook#in-cluster) for amazon-eks-pod-identity-webhook. While running the make target, make sure the $KUBECONFIG env var is set to the path of the EKS Anywhere cluster.
1. Check out [this commit](https://github.com/aws/amazon-eks-pod-identity-webhook/commit/a65cc3d9c61cf6fc43f0f985818c474e0867d786) of the amazon-eks-pod-identity-webhook.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can't get them to fix this?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is an open issue in that repo, I've also opened up this PR to address it. But till it gets reviewed and merged we will have to point our docs to a commit that works.


1. Set the $KUBECONFIG env var to the path of the EKS Anywhere cluster. Run the following command:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this two separate steps? If so, you could write it something like this:

Suggested change
1. Set the $KUBECONFIG env var to the path of the EKS Anywhere cluster. Run the following command:
1. Set the $KUBECONFIG env var to the path of the EKS Anywhere cluster.
1. Run the following command:

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, I wondered if there is other information that a user would need from the installation instructions that you are missing now. For example, the need to install cert-manager as a pre-requisite and where to get the Makefile.

Copy link
Contributor Author

@mrajashree mrajashree Apr 7, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@chrisnegus EKS-A already installs cert-manager so we don't need to add this instruction. Since we're asking them to checkout that commit, Makefile will be available to them


```bash
make cluster-up IMAGE=amazon/amazon-eks-pod-identity-webhook:a65cc3d
```


#### Configure the trust relationship for the OIDC provider's IAM Role
Expand Down