Channels
announcements
automation-api
aws
azure
blog-posts
built-with-pulumi
cloudengineering
cloudengineering-support
content-share
contribex
contribute
docs
dotnet
finops
general
getting-started
gitlab
golang
google-cloud
hackathon-03-19-2020
hacktoberfest
install
java
jobs
kubernetes
learn-pulumi-events
linen
localstack
multi-language-hackathon
office-hours
oracle-cloud-infrastructure
plugin-framework
pulumi-ai
pulumi-cdk
pulumi-cloud
pulumi-crosscode
pulumi-deployments
pulumi-kubernetes-operator
pulumiverse
python
registry
status
testingtesting123
testingtesting321
typescript
welcome
workshops
yaml
Title
m
many-psychiatrist-74327
08/26/2020, 11:26 PM(Second question in separate message)
Q2. I created my EKS cluster with pulumi. It has an associated OICD provider. However, if I do
aws iam list-open-id-connect-providersc
chilly-hairdresser-56259
08/27/2020, 3:08 PMSo the ODIC provider for EKS is only the endpoint, you need to create the IAM provider for the ODIC endpoint. With that you'll need to grab the root CA thumbprint.
m
many-psychiatrist-74327
08/27/2020, 7:21 PMyou need to create the IAM provider for the ODIC endpoint.Hmm.. do you have a pointer on how to do that? Ideally I can do everything with pulumi itself
c
chilly-hairdresser-56259
08/27/2020, 9:00 PMIve never needed to do that yet in Pulumi. I know its a pain in Terraform because of the Thumbprint of the root CA. https://www.pulumi.com/docs/reference/pkg/aws/iam/openidconnectprovider/
Then on your roles for K8 to assume through the ODIC you federate with the ODIC provider to allow access.
This walks through the entire process with Terraform, so the steps you'd just reproduce with your language https://medium.com/@marcincuber/amazon-eks-with-oidc-provider-iam-roles-for-kubernetes-services-accounts-59015d15cb0c