Provider Upjet-AWS

EKS Pod Identity is an alternative to IRSA that does not require an OIDC provider. It relies on the EKS Pod Identity Agent and the pods.eks.amazonaws.com service principal.

Setup Steps:

1. Install the EKS Pod Identity Agent on your cluster.
2. Create an EKS Pod Identity association between your ServiceAccount and namespace and the target IAM role.
3. Ensure the ServiceAccount and namespace used by provider-aws match the association.

Troubleshooting:

• Verify the namespace and ServiceAccount match the association.
• Confirm the Pod Identity Agent is functional.
• Review the IAM role's trust policy for Pod Identity.

# 1. Configure ServiceAccount via DeploymentRuntimeConfig
apiVersion: pkg.crossplane.io/v1beta1
kind: DeploymentRuntimeConfig
metadata:
    name: podidentity-drc
spec:
    serviceAccountTemplate:
        metadata:
            name: provider-aws
    deploymentTemplate: {}
---
apiVersion: pkg.crossplane.io/v1
kind: Provider
metadata:
  name: upbound-provider-aws-ec2
spec:
  package: xpkg.upbound.io/upbound/provider-aws-ec2:v1.4.0
  runtimeConfigRef:
    name: podidentity-drc
---
# 2. Configure ProviderConfig
apiVersion: aws.upbound.io/v1beta1
kind: ProviderConfig
metadata:
    name: podidentity-example
spec:
    credentials:
        source: PodIdentity

To authenticate the AWS provider using access keys, you must store your credentials in a Kubernetes secret and reference that secret in a ProviderConfig object.

1. Prepare the credentials file

Create a text file (e.g., aws-credentials.txt) containing your AWS credentials in INI format:

[default]
aws_access_key_id = <aws_access_key>
aws_secret_access_key = <aws_secret_key>

2. Create a Kubernetes secret

Generate a secret from this file using kubectl:

kubectl create secret generic <secret-name> --from-file=key-file=<aws_credentials_file.txt>

3. Create a ProviderConfig

Apply a ProviderConfig that points to the secret. The spec.secretRef must include the namespace, the name of the secret, and the key (which corresponds to the Data field name used when creating the secret, e.g., key-file).

apiVersion: aws.upbound.io/v1beta1
kind: ProviderConfig
metadata:
    name: default
spec:
  credentials:
    source: Secret
    secretRef:
      namespace: default
      name: aws-secret
      key: key-file

When using IRSA, the IAM role created (e.g., via eksctl) must have its Trust relationship updated to allow the AWS provider to assume the role.

1. Identify the OIDC issuer: Use aws eks describe-cluster --name <cluster-name> --query "cluster.identity.oidc.issuer" --output text and strip the https:// prefix.
2. Construct the Condition: Use StringLike instead of StringEquals. The condition key should follow the pattern: "<oidc-issuer>:sub": "system:serviceaccount:<namespace>:provider-aws-*".
3. Apply the policy: Use aws iam update-assume-role-policy with a JSON file containing the new policy.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::000000000000:oidc-provider/oidc.eks.us-east-2.amazonaws.com/id/266A01FA1DBF8083FA1C23EB7D4736E4"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringLike": {
                    "oidc.eks.us-east-2.amazonaws.com/id/266A01FA1DBF8083FA1C23EB7D4736E4:sub": "system:serviceaccount:upbound-system:provider-aws-*"
                }
            }
        }
    ]
}

Web Identity authentication allows you to specify a Web Identity token in the ProviderConfig. This is preferred over using environment variables (AWS_WEB_IDENTITY_TOKEN_FILE and AWS_ROLE_ARN), which are now deprecated.

You can configure the token source in spec.credentials.webIdentity.tokenConfig using either a Secret or a Filesystem path.

Note: If using Filesystem, the token must be mounted into the provider pod (e.g., via DeploymentRuntimeConfig).

# Example: Using a Kubernetes Secret for the token
apiVersion: aws.upbound.io/v1beta1
kind: ProviderConfig
metadata:
  name: webidentity-example
spec:
  credentials:
    source: WebIdentity
    webIdentity:
      roleARN: arn:aws:iam::123456789012:role/providerexamplerole
      tokenConfig:
        source: Secret
        secretRef:
          key: token
          name: example-web-identity-token-secret
          namespace: upbound-system
---
# Example: Using a Filesystem path for the token
apiVersion: aws.upbound.io/v1beta1
kind: ProviderConfig
metadata:
  name: webidentity-example-fs
spec:
  credentials:
    source: WebIdentity
    webIdentity:
      roleARN: arn:aws:iam::123456789012:role/providerexamplerole
      tokenConfig:
        source: Filesystem
        fs:
          path: /path/to/token/file