Skip to content

The kubectl plugin which allows us to test IRSA configuration AWS sa

Notifications You must be signed in to change notification settings

TeamBion/kubectl-irsa

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

36 Commits
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

kubectl-irsa

This kubectl plugin allows us to test abilities of IAM policies which is assigned to the serviceAccount roles via AWS IAM Policy simulator service. Beside of the IAM Policy Simulator it checks the other essential parts like this;

  • Policy Simulator 🟢
  • WebIdentity Issue 🟢
  • Principal Checks 🟢
  • OIDC linking issues like non existing IdentityProvider or wrong audience .. etc 🟠
  • AdmissionController Check 🟠
  • Thumbprint Check 🟠

How to use ?

First step you have to create a simple resource and action map YAML file like this;

This yaml file contains resource list and related actions which would be possibly using by the serviceaccounts roles.

Notice: Each action simulates by the client on individual resources

resources:
  - arn:aws:s3:::my-org-cdn-bucket
actions:
  - s3:DeleteBucket

After you create this yaml file you are able to use this like this

  $ kubectl irsa -file config.yaml -sa application-service-account -namespace development

⚠️ Important

Based on the latest Kubernetes version changes especially on AWS EKS, you may face issues with authentication API versions that's why you have to upgrade your AWS CLI V2 version while authenticating via IAM to connect the cluster.

How to upgrade awscli version

ConfigurationDetails

flag Description
role Name of the role which assumed by service account which is assigned into the annotations of eks.amazonaws.com/role-arn
config Resource map configuration file

Setup

From Source;

This is a simple pip3 package so if you want to install this plugin on your cluster you just need to run this command like this;

    go build ./
    mv kubectl-irsa $PATH:/usr/local/bin

Download

You can download plugin artifact over there;

https://github.com/TeamBion/kubectl-irsa/releases

Contribution

More than welcome! please don't hesitate to open bugs, questions, pull requests