https://pulumi.com
Join Slack
This message was deleted.
# kubernetes
s
This message was deleted.
b
have you used OIDC before with EKS? Creating the provider is all you need to do, once you’ve got that you just need to create a service account and a related policy. There’s an example here in typescript: https://github.com/jaxxstorm/pulumi-examples/blob/main/typescript/aws/eks-platform/alb-ingress-controller/index.ts
b
Do you mean that it is not necessary to associate the created IDP?
b
this happens when you implement a service account, the UI doesn’t exactly track the API
b
ah thanks!
https://docs.aws.amazon.com/emr/latest/EMR-on-EKS-DevelopmentGuide/setting-up-enable-IAM.html#setting-up-OIDC-console so do you mean that by setting that flag to True, this step will be done entirely?
b
that command is what happens when you do 
create_oidc_provider
and then create an IAM role with 
sts:AssumeRoleWithWebIdentity
b
ok, thanks.
last question, is there any better way to do this: https://docs.aws.amazon.com/emr/latest/EMR-on-EKS-DevelopmentGuide/setting-up-cluster-access.html Now I have a yaml manifest that I apply to the new EKs cluster using 
kubernetes.yaml.ConfigFile
but looking at 
pulumi-eks
looks like maybe I can do that directly with
Copy code
creation_role_provider
?
https://pulumi-community.slack.com/archives/CRFURDVQB/p1673962852363789?thread_ts=1673958343.040869&cid=CRFURDVQB But in that AWS document, they are not doing anything related 
sts:AssumeRoleWithWebIdentity
right? did you say that thinking about the future?
b
for OIDC you do the following things: • create an OIDC provider (performed with 
create_oidc_provider
on the cluster • create an IAM role which is associated with the oidc provider: https://github.com/jaxxstorm/pulumi-examples/blob/main/typescript/aws/eks-platform/alb-ingress-controller/index.ts#L19-L39 • annotate a service account to associate the role
Now I have a yaml manifest that I apply to the new EKs cluster using kubernetes.yaml.ConfigFile but looking at pulumi-eks looks like maybe I can do that directly with
no, these are two distinct and separate steps
👍 1
b
so, related to this, do you know how can I automate the 3rd step of this document using pulumi? https://docs.aws.amazon.com/emr/latest/EMR-on-EKS-DevelopmentGuide/setting-up-cluster-access.html#setting-up-cluster-access-manual
b
I don’t have any experience with that, no
👍🏾 1
2 Views
Open in Slack
PreviousNext
Powered by

Pulumi Community

No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Powered by