https://pulumi.com logo
Title
c

crooked-lunch-29479

04/17/2023, 2:38 PM
Folks I need suggestions for how to best automate a couple of kubernates steps I need to do for my infrastructure in pulumi: 1. Create the OIDC provider that will be associated with the EKS cluster:
eksctl utils associate-iam-oidc-provider --cluster <Name-EKS-Cluster> --approve
2. Create the
flyte-system
IAM role, attach the
AmazonS3FullAccessservice
policy to it and associate the role with a new Kubernetes service account:
eksctl create iamserviceaccount --name <my-flyte-sa> --namespace flyte --cluster <my-eks-cluster> --region <region-code> --role-name flyte-system-role \ 
--attach-policy-arn arn:aws:iam::aws:policy/AmazonS3FullAccess --approve
b

billowy-army-68599

04/17/2023, 2:53 PM
if you’re using pulumi-eks, enabling OIDC is as easy as setting this property: https://www.pulumi.com/registry/packages/eks/api-docs/cluster/#create_oidc_provider_python
creating an iam service account involves: • creating a Kubernetes service account with the correcr annotation: https://github.com/jaxxstorm/pulumi-examples/blob/main/typescript/aws/eks-platform/external-dns/index.ts#L78-L83 • creating an IAM role that references the service account: https://github.com/jaxxstorm/pulumi-examples/blob/main/typescript/aws/eks-platform/external-dns/index.ts#L17-L40 • assigning the permissions you want the service account to have that role
c

crooked-lunch-29479

04/17/2023, 3:00 PM
@billowy-army-68599 so another thing that I found was this - https://www.pulumi.com/registry/packages/aws/api-docs/eks/identityproviderconfig/ However the here we need to get the the OIDC issuer URL that I was able to get via:
aws eks describe-cluster --region <region> --name <Name-EKS-Cluster> --query "cluster.identity.oidc.issuer" --output text
The more “learning” question for me is : “What are the packages I should be looking at if I need to run the cli commands using
aws eks
,
eksctl
. I don’t want to keep bothering the folks here 😄
b

billowy-army-68599

04/17/2023, 3:01 PM
eksctl abstracts away quite a lot of EKS in a way that makes it difficult to figure out, so asking questions is fine