Good morning How should I add an identity provider to a new

Question

Good morning How should I add an identity provider to a new EKS cluster using pulumi eks package I set the `create oidc provider` to true This creates the idp provider in the iam but it does not associate it with the cluster

billowy-army-68599 · Answer

have you used OIDC before with EKS Creating the provider is all you need to do once you ve got that you just need to create a service account and a related policy There s an example here in typescript <https github com jaxxstorm pulumi examples blob main typescript aws eks platform alb ingress controller index ts>

bland-pharmacist-96854 · Answer

Do you mean that it is not necessary to associate the created IDP

billowy-army-68599 · Answer

this happens when you implement a service account the UI doesn t exactly track the API

bland-pharmacist-96854 · Answer

ah thanks

bland-pharmacist-96854 · Answer

<https docs aws amazon com emr latest EMR on EKS DevelopmentGuide setting up enable IAM html setting up OIDC console> so do you mean that by setting that flag to True this step will be done entirely

billowy-army-68599 · Answer

that command is what happens when you do `create oidc provider` and then create an IAM role with `sts AssumeRoleWithWebIdentity`

bland-pharmacist-96854 · Answer

ok thanks

bland-pharmacist-96854 · Answer

last question is there any better way to do this <https docs aws amazon com emr latest EMR on EKS DevelopmentGuide setting up cluster access html> Now I have a yaml manifest that I apply to the new EKs cluster using `kubernetes yaml ConfigFile` but looking at `pulumi eks` looks like maybe I can do that directly with ```creation role provider```

bland-pharmacist-96854 · Answer

<https pulumi community slack com archives CRFURDVQB p1673962852363789 thread ts=1673958343 040869 amp cid=CRFURDVQB> But in that AWS document they are not doing anything related `sts AssumeRoleWithWebIdentity` right did you say that thinking about the future

billowy-army-68599 · Answer

here <https github com jaxxstorm pulumi examples blob main typescript aws eks platform alb ingress controller index ts L25>

billowy-army-68599 · Answer

for OIDC you do the following things create an OIDC provider performed with `create oidc provider` on the cluster create an IAM role which is associated with the oidc provider <https github com jaxxstorm pulumi examples blob main typescript aws eks platform alb ingress controller index ts L19 L39> annotate a service account to associate the role

billowy-army-68599 · Answer

gt Now I have a yaml manifest that I apply to the new EKs cluster using kubernetes yaml ConfigFile but looking at pulumi eks looks like maybe I can do that directly with no these are two distinct and separate steps

bland-pharmacist-96854 · Answer

so related to this do you know how can I automate the 3rd step of this document using pulumi <https docs aws amazon com emr latest EMR on EKS DevelopmentGuide setting up cluster access html setting up cluster access manual>

billowy-army-68599 · Answer

I don t have any experience with that no