DEV Community

leroykayanda
leroykayanda

Posted on

Create EKS Service Account in terraform

Set up the IAM role like so

resource "aws_iam_role" "role" { name = "${var.env}-${var.service}" assume_role_policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = "sts:AssumeRoleWithWebIdentity" Effect = "Allow" Sid = "" Principal = { Federated = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:oidc-provider/${local.eks_oidc_issuer}" } }, ] }) } resource "aws_iam_policy" "policy" { name = "${var.env}-${var.service}" policy = jsonencode({ Version = "2012-10-17" Statement = [ { Action = [ "s3:PutObject", "s3:ListBucket", "s3:GetObject", "s3:DeleteObject" ] Effect = "Allow" Resource = "*" } ] }) } resource "aws_iam_role_policy_attachment" "attachment" { role = aws_iam_role.role.name policy_arn = aws_iam_policy.policy.arn }
Enter fullscreen mode Exit fullscreen mode

create the service account

resource "kubernetes_service_account" "this" { metadata { name = var.service namespace = var.service annotations = { "eks.amazonaws.com/role-arn" = aws_iam_role.role.arn } } automount_service_account_token = true }
Enter fullscreen mode Exit fullscreen mode

data.tf

data "aws_eks_cluster" "cluster" { name = "${var.cluster_env}-${var.cluster_name}" } data "aws_eks_cluster_auth" "auth" { name = "${var.cluster_env}-${var.cluster_name}" } data "aws_caller_identity" "current" {} data "aws_eks_cluster" "cluster" { name = "${var.cluster_env}-${var.cluster_name}" }
Enter fullscreen mode Exit fullscreen mode

locals.tf

locals { eks_oidc_issuer = trimprefix(data.aws_eks_cluster.cluster.identity[0].oidc[0].issuer, "https://") }
Enter fullscreen mode Exit fullscreen mode

providers.tf

provider "kubernetes" { host = data.aws_eks_cluster.cluster.endpoint cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data) token = data.aws_eks_cluster_auth.auth.token }
Enter fullscreen mode Exit fullscreen mode

Configure the app to use the service account

apiVersion: apps/v1 kind: Deployment metadata: name: references namespace: references labels: app: references spec: replicas: 1 selector: matchLabels: app: references template: metadata: labels: app: references spec: serviceAccountName: references containers: - name: references image: nginx ports: - containerPort: 8501
Enter fullscreen mode Exit fullscreen mode

Top comments (0)