Can I not add an IAM group to my ConfigMap?

[mrichman]

I have an IAM user named Alice, and she's a member of the IAM group eks-admin.

The following configuration works, but when I remove Alice from mapUsers, kubectl commands give me the error error: You must be logged in to the server (Unauthorized).

Can't I add an IAM group to this ConfigMap, just like I can add a user or role?

aws sts get-caller-identity 
{
    "Account": "123456789012", 
    "UserId": "AIDAxxxxxxxxxxxxxxx", 
    "Arn": "arn:aws:iam::123456789012:user/Alice"
}

apiVersion: v1
data:
  mapRoles: |
    - rolearn: arn:aws:iam::123456789012:role/EKS-WorkerNodes-NodeInstanceRole-1R46GDBD928V5
      username: system:node:{{EC2PrivateDNSName}}
      groups: 
        - system:bootstrappers
        - system:nodes
  mapUsers: |
    - userarn: arn:aws:iam::123456789012:user/Alice
      username: alice
      groups: 
        - system:masters
    - userarn: arn:aws:iam::123456789012:group/eks-admin
      username: eks-admin
      groups: 
        - system:masters

[luthes]

Didn't read, you can only add roles and users.

I think this is a duplicate of # 157 (which is probably a duplicate of another, honestly)

[cschiewek]

Can we re-open this as a feature request? Managing permissions would be significantly improved if we could add groups.

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[alexppg]

/remove-lifecycle stale

[jclynny]

Is there any progress on this one? This is significant functionality for managing access to EKS for larger Engineering groups, right now this is requiring me to list out a bunch of users and adding to the list every time someone new needs access.

[alexppg]

With terraform 12 this can be easily workarounded, thanks to the for loop. A very improbable code:

locals {
  k8s_admins = [
    for user in data.terraform_remote_state.iam.outputs.admin_members[0] :
    {
      user_arn = join("", ["arn:aws:iam::whatever:user/", user])
      username = user
      group    = "system:masters"
    }
  ]

  k8s_developers = [
    for user in data.terraform_remote_state.iam.outputs.developers_members[0] :
    {
      user_arn = join("", ["arn:aws:iam::whatever:user/", user])
      username = user
      group    = "system:developers-write"
    }
  ]
  k8s_map_users = concat(local.k8s_admins, local.k8s_developers)
}

[casey-robertson]

Is there any progress on this one? This is significant functionality for managing access to EKS for larger Engineering groups, right now this is requiring me to list out a bunch of users and adding to the list every time someone new needs access.

It's even more fun when you don't have IAM users and everybody accesses an assumed role session via Okta.

[adeakrvbd]

With terraform 12 this can be easily workarounded, thanks to the for loop. A very improbable code:

locals {
  k8s_admins = [
    for user in data.terraform_remote_state.iam.outputs.admin_members[0] :
    {
      user_arn = join("", ["arn:aws:iam::whatever:user/", user])
      username = user
      group    = "system:masters"
    }
  ]

  k8s_developers = [
    for user in data.terraform_remote_state.iam.outputs.developers_members[0] :
    {
      user_arn = join("", ["arn:aws:iam::whatever:user/", user])
      username = user
      group    = "system:developers-write"
    }
  ]
  k8s_map_users = concat(local.k8s_admins, local.k8s_developers)
}

I'm struggling to put the k8s_admins generated here into the configmap to apply later in automation, how did you manage to do that?

[selslack]

/remove-lifecycle stale

[mazay]

With terraform 12 this can be easily workarounded, thanks to the for loop. A very improbable code:

locals {
  k8s_admins = [
    for user in data.terraform_remote_state.iam.outputs.admin_members[0] :
    {
      user_arn = join("", ["arn:aws:iam::whatever:user/", user])
      username = user
      group    = "system:masters"
    }
  ]

  k8s_developers = [
    for user in data.terraform_remote_state.iam.outputs.developers_members[0] :
    {
      user_arn = join("", ["arn:aws:iam::whatever:user/", user])
      username = user
      group    = "system:developers-write"
    }
  ]
  k8s_map_users = concat(local.k8s_admins, local.k8s_developers)
}

I'm struggling to put the k8s_admins generated here into the configmap to apply later in automation, how did you manage to do that?

probably using jsonencode(local.k8s_admins)

[jclynny]

I would also like to see adeakrvbd's question answered above. +1