07-IAM.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<center> \n",
    "    <h3><b> Adnan Rashid </b></h3>\n",
    "    <nav>\n",
    "    | <a href=\"00-Contents-Setup.ipynb\"> Home Page </a> | \n",
    "    <a href=\"http://bit.ly/cka_notes_original\"> Kubernetes Notes </a> |\n",
    "    <a href=\"https://adnan.study\"> Website </a> |\n",
    "    <a href=\"https://www.instagram.com/adnans_techie_studies/\"> Instagram </a> |\n",
    "    <a href=\"https://www.linkedin.com/in/adnanrashid1/\"> LinkedIn </a> |\n",
    "    </nav>\n",
    "\n",
    "</center>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<center><h1 style=\"background:black\"><code style=\"background:black;color:white\">IAM Groups to Manage Kuberetes Cluster Access</code></h1></center>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<div class=\"alert alert-block alert-warning\">\n",
    "<font style=\"color:black\">\n",
    "<center> In this section we will learn how to simplify access to different parts of the kubernetes clusters depending on IAM Groups \n",
    "</center>\n",
    "</font>\n",
    "</div>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<center><img src=\"https://adnanstudyimages.s3-eu-west-1.amazonaws.com/17.jpg\" width=\"40%\" height=\"40%\" border=5/></center>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* [Kubernetes Authentication](#kubeauth) \n",
    "* [Create IAM Roles](#iamroles) \n",
    "* [Create IAM Groups](#iamgroups) \n",
    "* [Create IAM Users](#iamusers) \n",
    "* [Configure Kubernetes RBAC](#kuberbac)\n",
    "* [Configure Kubernetes Role Access](#kuberoleaccess) \n",
    "* [Test EKS Access](#testeksaccess)\n",
    "* [Cleanup](#groupscleanup) "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<br><br>\n",
    "<blockquote>In the intro we have seen how we can give access to individual users to Kubernetes <br><br>\n",
    "If you have different teams which needs different kind of cluster access, it would be difficult to manually add or remove access for each EKS cluster you want to give them or remove access from.<br><br>\n",
    "\n",
    "We can leverage AWS IAM Groups to easily add or remove users and give them permission to whole cluster, or just part of it depending on which groups they belong to. "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Pre-requisite"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Check your variables are loaded"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%store"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Load in variable store"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%store -r "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Load variables into notebook"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%env AWS_PROFILE=$AWS_PROFILE\n",
    "%env AWS_DEFAULT_REGION=$AWS_DEFAULT_REGION\n",
    "%env ACCOUNT_ID=$ACCOUNT_ID"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Check identity "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws sts get-caller-identity"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<br>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "---\n",
    "---"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<br>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## <br><br>Creating IAM Roles"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Create 3 Roles\n",
    "\n",
    "* **k8sAdmin** role which will have admin rights in our EKS cluster\n",
    "* **k8sDev** role which will gives access to developers namespace in our EKS cluster\n",
    "* **k8sInteg** role which will gives access to integration namespace our EKS cluster"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash\n",
    "\n",
    "POLICY=$(echo -n '{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::'; echo -n \"$ACCOUNT_ID\"; echo -n ':root\"},\"Action\":\"sts:AssumeRole\",\"Condition\":{}}]}')\n",
    "echo POLICY=$POLICY\n",
    "\n",
    "aws iam create-role \\\n",
    "  --role-name k8sAdmin \\\n",
    "  --description \"Kubernetes administrator role (for AWS IAM Authenticator for Kubernetes).\" \\\n",
    "  --assume-role-policy-document \"$POLICY\" \\\n",
    "  --output text \\\n",
    "  --query 'Role.Arn'\n",
    "\n",
    "aws iam create-role \\\n",
    "  --role-name k8sDev \\\n",
    "  --description \"Kubernetes developer role (for AWS IAM Authenticator for Kubernetes).\" \\\n",
    "  --assume-role-policy-document \"$POLICY\" \\\n",
    "  --output text \\\n",
    "  --query 'Role.Arn'\n",
    "  \n",
    "aws iam create-role \\\n",
    "  --role-name k8sInteg \\\n",
    "  --description \"Kubernetes role for integration namespace in quick cluster.\" \\\n",
    "  --assume-role-policy-document \"$POLICY\" \\\n",
    "  --output text \\\n",
    "  --query 'Role.Arn'"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<br><br>\n",
    "<blockquote>\n",
    "In this example, the assume-role-policy allows the root account to assume the role. \n",
    "\n",
    "* We are going to allow specific groups to also be able to assume those roles \n",
    "\n",
    "Because the above roles are only used to authenticate within the k8s cluster, they don't necessarily need to have AWS permissions \n",
    "\n",
    "* We will only use them to allow some IAM groups to assume this role in order to have access to EKS kubernetes cluster. "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## <br><br>Create IAM Groups"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<blockquote>We want to have different IAM users which will be added to specific IAM groups in order to have different rights in the kubernetes cluster \n",
    "\n",
    "* We will define 3 groups \n",
    "    * **k8sAdmin** - users from this group will have admin rights on the kubernetes cluster\n",
    "    * **k8sDev** - users from this group will have full access only in the development namespace of the cluster\n",
    "    * **k8sInteg** - users from this group will have access to integration namespace.<br>\n",
    "    \n",
    "\n",
    "The users from **k8sDev** and **k8sInteg** groups will only have access to namespaces where we will define kubernetes RBAC access for their associated kubernetes role. \n",
    "\n",
    "We'll see this but first, let's create the groups. "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### <br><br>Create k8sAdmin IAM Group"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* The <b>k8sAdmin</b> group will be allowed to assume the <b>k8sAdmin</b> IAM Role "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws iam create-group --group-name k8sAdmin"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Lets add a policy on our group which will allow users from this group to assume our <b>k8sAdmin</b> role "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash \n",
    "\n",
    "ADMIN_GROUP_POLICY=$(echo -n '{\n",
    "  \"Version\": \"2012-10-17\",\n",
    "  \"Statement\": [\n",
    "    {\n",
    "      \"Sid\": \"AllowAssumeOrganizationAccountRole\",\n",
    "      \"Effect\": \"Allow\",\n",
    "      \"Action\": \"sts:AssumeRole\",\n",
    "      \"Resource\": \"arn:aws:iam::'; echo -n \"$ACCOUNT_ID\"; echo -n ':role/k8sAdmin\"\n",
    "    }\n",
    "  ]\n",
    "}')\n",
    "echo ADMIN_GROUP_POLICY=$ADMIN_GROUP_POLICY\n",
    "\n",
    "aws iam put-group-policy \\\n",
    "--group-name k8sAdmin \\\n",
    "--policy-name k8sAdmin-policy \\\n",
    "--policy-document \"$ADMIN_GROUP_POLICY\""
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### <br><br>Create k8sDev IAM Group"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* The <b>k8sDev</b> Group will be allowed to assume the <b>k8sDev</b> IAM Role"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws iam create-group --group-name k8sDev"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Let's add a Policy on our group which will allow users from this group to assume our <b>k8sDev</b> Role "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash \n",
    "\n",
    "DEV_GROUP_POLICY=$(echo -n '{\n",
    "  \"Version\": \"2012-10-17\",\n",
    "  \"Statement\": [\n",
    "    {\n",
    "      \"Sid\": \"AllowAssumeOrganizationAccountRole\",\n",
    "      \"Effect\": \"Allow\",\n",
    "      \"Action\": \"sts:AssumeRole\",\n",
    "      \"Resource\": \"arn:aws:iam::'; echo -n \"$ACCOUNT_ID\"; echo -n ':role/k8sDev\"\n",
    "    }\n",
    "  ]\n",
    "}')\n",
    "echo DEV_GROUP_POLICY=$DEV_GROUP_POLICY\n",
    "\n",
    "aws iam put-group-policy \\\n",
    "--group-name k8sDev \\\n",
    "--policy-name k8sDev-policy \\\n",
    "--policy-document \"$DEV_GROUP_POLICY\""
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### <br><br>Create k8sInteg IAM Group"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws iam create-group --group-name k8sInteg"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Lets add a Policy on our group which will allow users from this group to assume our <b>k8sInteg</b> role"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash \n",
    "\n",
    "INTEG_GROUP_POLICY=$(echo -n '{\n",
    "  \"Version\": \"2012-10-17\",\n",
    "  \"Statement\": [\n",
    "    {\n",
    "      \"Sid\": \"AllowAssumeOrganizationAccountRole\",\n",
    "      \"Effect\": \"Allow\",\n",
    "      \"Action\": \"sts:AssumeRole\",\n",
    "      \"Resource\": \"arn:aws:iam::'; echo -n \"$ACCOUNT_ID\"; echo -n ':role/k8sInteg\"\n",
    "    }\n",
    "  ]\n",
    "}')\n",
    "echo INTEG_GROUP_POLICY=$INTEG_GROUP_POLICY\n",
    "\n",
    "aws iam put-group-policy \\\n",
    "--group-name k8sInteg \\\n",
    "--policy-name k8sInteg-policy \\\n",
    "--policy-document \"$INTEG_GROUP_POLICY\""
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* We should have 3 groups now, lets check"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws iam list-groups"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## <br><br>Create IAM Users "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* In order to test our scenarios, we will create 3 users, one for each groups we created "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws iam create-user --user-name PaulAdmin\n",
    "!aws iam create-user --user-name JeanDev\n",
    "!aws iam create-user --user-name PierreInteg"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Add users to associated groups"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws iam add-user-to-group --group-name k8sAdmin --user-name PaulAdmin\n",
    "!aws iam add-user-to-group --group-name k8sDev --user-name JeanDev\n",
    "!aws iam add-user-to-group --group-name k8sInteg --user-name PierreInteg"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Check users are correctly added in their groups"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws iam get-group --group-name k8sAdmin\n",
    "!aws iam get-group --group-name k8sDev\n",
    "!aws iam get-group --group-name k8sInteg"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Create Some access keys so we can toggle between the users <br>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<div class=\"alert alert-block alert-info\">\n",
    "<font style=\"color:black\">\n",
    "<center>Saving in the temp directory belows makes it easier to clean up at the end\n",
    "</center>\n",
    "</font>\n",
    "</div>"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws iam create-access-key --user-name PaulAdmin | tee temp/PaulAdmin.json\n",
    "!aws iam create-access-key --user-name JeanDev | tee temp/JeanDev.json\n",
    "!aws iam create-access-key --user-name PierreInteg | tee temp/PierreInteg.json"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<br><br>So far we have done the following \n",
    "\n",
    "* <b> PaulAdmin </b> is in the <b> k8sAdmin </b> group and will be able to assume the <b> k8sAdmin </b> role \n",
    "* <b> JeanDev </b> is in <b> k8sDev </b> Group and will be able to assume IAM role <b> k8sDev </b>\n",
    "* <b> PierreInteg </b> is in <b> k8sInteg </b> group and will be able to assume IAM role <b> k8sInteg </b> "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## <br><br>Configure Kubernetes RBAC"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Create Kubernetes namespaces "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* <b> development </b> namespace will be accessible for IAM users from <b> k8sDev </b> group \n",
    "* <b> integration </b> namespace will be accessible for IAM users from <b> k8sInteg </b> group "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!kubectl create namespace integration \n",
    "!kubectl create namespace development "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### <br><br>Configuring access to development namespace"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* We create a kubernetes <i> role </i> and <i> rolebinding </i> in the development namespace giving full access to the kubernetes user <b> dev-user </b> "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash\n",
    "\n",
    "cat << EOF | kubectl apply -f - -n development\n",
    "kind: Role\n",
    "apiVersion: rbac.authorization.k8s.io/v1beta1\n",
    "metadata:\n",
    "  name: dev-role\n",
    "rules:\n",
    "  - apiGroups:\n",
    "      - \"\"\n",
    "      - \"apps\"\n",
    "      - \"batch\"\n",
    "      - \"extensions\"\n",
    "    resources:\n",
    "      - \"configmaps\"\n",
    "      - \"cronjobs\"\n",
    "      - \"deployments\"\n",
    "      - \"events\"\n",
    "      - \"ingresses\"\n",
    "      - \"jobs\"\n",
    "      - \"pods\"\n",
    "      - \"pods/attach\"\n",
    "      - \"pods/exec\"\n",
    "      - \"pods/log\"\n",
    "      - \"pods/portforward\"\n",
    "      - \"secrets\"\n",
    "      - \"services\"\n",
    "    verbs:\n",
    "      - \"create\"\n",
    "      - \"delete\"\n",
    "      - \"describe\"\n",
    "      - \"get\"\n",
    "      - \"list\"\n",
    "      - \"patch\"\n",
    "      - \"update\"\n",
    "---\n",
    "kind: RoleBinding\n",
    "apiVersion: rbac.authorization.k8s.io/v1beta1\n",
    "metadata:\n",
    "  name: dev-role-binding\n",
    "subjects:\n",
    "- kind: User\n",
    "  name: dev-user\n",
    "roleRef:\n",
    "  kind: Role\n",
    "  name: dev-role\n",
    "  apiGroup: rbac.authorization.k8s.io\n",
    "EOF"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<br><br>The role we define will give full access to everything in that namespace. \n",
    "\n",
    "It is a Role, and not a ClusterRole, so it is going ot be applied only in the <b> development </b> namespace "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### <br><br>Configuring Access to Integration Namespace"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* We create a kubernetes <i> role</i> and <i> rolebinding </i> in the integration namespace for full access with the kubernetes user <b> integ-user</b> "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash\n",
    "\n",
    "cat << EOF | kubectl apply -f - -n integration\n",
    "kind: Role\n",
    "apiVersion: rbac.authorization.k8s.io/v1beta1\n",
    "metadata:\n",
    "  name: integ-role\n",
    "rules:\n",
    "  - apiGroups:\n",
    "      - \"\"\n",
    "      - \"apps\"\n",
    "      - \"batch\"\n",
    "      - \"extensions\"\n",
    "    resources:\n",
    "      - \"configmaps\"\n",
    "      - \"cronjobs\"\n",
    "      - \"deployments\"\n",
    "      - \"events\"\n",
    "      - \"ingresses\"\n",
    "      - \"jobs\"\n",
    "      - \"pods\"\n",
    "      - \"pods/attach\"\n",
    "      - \"pods/exec\"\n",
    "      - \"pods/log\"\n",
    "      - \"pods/portforward\"\n",
    "      - \"secrets\"\n",
    "      - \"services\"\n",
    "    verbs:\n",
    "      - \"create\"\n",
    "      - \"delete\"\n",
    "      - \"describe\"\n",
    "      - \"get\"\n",
    "      - \"list\"\n",
    "      - \"patch\"\n",
    "      - \"update\"\n",
    "---\n",
    "kind: RoleBinding\n",
    "apiVersion: rbac.authorization.k8s.io/v1beta1\n",
    "metadata:\n",
    "  name: integ-role-binding\n",
    "subjects:\n",
    "- kind: User\n",
    "  name: integ-user\n",
    "roleRef:\n",
    "  kind: Role\n",
    "  name: integ-role\n",
    "  apiGroup: rbac.authorization.k8s.io\n",
    "EOF"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<br><br>The role we define will give full access to everything in that namespace. \n",
    "\n",
    "It is a <i> Role</i> and not a <i> ClusterRole </i>, so it is going to be applied only in the <b> integration </b> namespace "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## <br><br>Configure Kubernetes Role Access "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Give Access to our IAM Roles to EKS Cluster "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<br>In order to give access to the IAM Roles we defined previously to our EKS cluster, we need to add specific <b> mapRoles </b> to the <i> aws-auth</i> ConfigMap\n",
    "\n",
    "The Advantage of using Role to access the cluster instead of specifying directly IAM users is that it will be easier to manage \n",
    "* We dont have to update the ConfigMap each time we want to add or remove users \n",
    "* We will just need to add or remove users from the IAM Group and we just configure the ConfigMap to allow the IAM Role associated to the IAM Group"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### <br><br>Update the aws-auth ConfigMap to allow our IAM roles"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<br>The <b> aws-auth </b> ConfigMap from the kube-system namespace must be edited in order to allow new arn Groups. \n",
    "\n",
    "This file makes the mapping between IAM role and k8S RBAC rights. \n",
    "\n",
    "* We can edit it using eksctl "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!eksctl create iamidentitymapping --cluster eksworkshop-eksctl --arn arn:aws:iam::$ACCOUNT_ID:role/k8sDev --username dev-user \n",
    "!eksctl create iamidentitymapping --cluster eksworkshop-eksctl --arn arn:aws:iam::$ACCOUNT_ID:role/k8sInteg --username integ-user \n",
    "!eksctl create iamidentitymapping --cluster eksworkshop-eksctl --arn arn:aws:iam::$ACCOUNT_ID:role/k8sAdmin --username admin --group system:masters"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Check the config map"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!kubectl get cm -n kube-system aws-auth -o yaml"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* We can leverage eksctl to get a list of all identity managed in our cluster "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!eksctl get iamidentitymapping --cluster eksworkshop-eksctl"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<br><br>Here we have created:\n",
    "\n",
    "* a RBAC role for K8sAdmin, that we map to admin user and give access to <b>system:masters</b> kubernetes Groups (so that it has Full Admin rights)\n",
    "* a RBAC role for k8sDev that we map on dev-user in development namespace\n",
    "* a RBAC role for k8sInteg that we map on integ-user in integration namespace\n",
    "\n",
    "We will see on next section how we can test it."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## <br><br> Test EKS Access"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### Automate assumerole with awscli "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "It is possible to automate the retrival of temporary credentials for the assumed role by configuring the awscli using .aws/config and .aws/credentials"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<b>Note:</b> The following few commands will wipe your default config, so back it up first "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* add in ~/.aws/config"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash\n",
    "\n",
    "if [ ! -d ~/.aws ]; then\n",
    "  mkdir ~/.aws\n",
    "fi\n",
    "\n",
    "cat << EoF >> ~/.aws/config\n",
    "[profile admin]\n",
    "role_arn=arn:aws:iam::${ACCOUNT_ID}:role/k8sAdmin\n",
    "source_profile=eksAdmin\n",
    "\n",
    "[profile dev]\n",
    "role_arn=arn:aws:iam::${ACCOUNT_ID}:role/k8sDev\n",
    "source_profile=eksDev\n",
    "\n",
    "[profile integ]\n",
    "role_arn=arn:aws:iam::${ACCOUNT_ID}:role/k8sInteg\n",
    "source_profile=eksInteg\n",
    "\n",
    "EoF"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### create ~/.aws/credentials"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Use the credentials we generated previously here"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash \n",
    "\n",
    "cat << EoF > ~/.aws/credentials\n",
    "\n",
    "\n",
    "[eksAdmin]\n",
    "aws_access_key_id=$(jq -r .AccessKey.AccessKeyId temp/PaulAdmin.json)\n",
    "aws_secret_access_key=$(jq -r .AccessKey.SecretAccessKey temp/PaulAdmin.json)\n",
    "\n",
    "\n",
    "[eksDev]\n",
    "aws_access_key_id=$(jq -r .AccessKey.AccessKeyId temp/JeanDev.json)\n",
    "aws_secret_access_key=$(jq -r .AccessKey.SecretAccessKey temp/JeanDev.json)\n",
    "\n",
    "\n",
    "[eksInteg]\n",
    "aws_access_key_id=$(jq -r .AccessKey.AccessKeyId temp/PierreInteg.json)\n",
    "aws_secret_access_key=$(jq -r .AccessKey.SecretAccessKey temp/PierreInteg.json)\n",
    "\n",
    "EoF"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### <br><br> Test this with dev/admin/integ profile"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* We should see k8sDev in the Arn"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws sts get-caller-identity --profile dev"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws sts get-caller-identity --profile admin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws sts get-caller-identity --profile integ"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "### <br><br> Using AWS profiles with Kubectl config file"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* It is also possible to specify the AWS_PROFILE to use with the aws-iam-authenticator in the .kube/config file, so that it will use the appropriate profile"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### <br><br>Dev Profile "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Edit the file in /temp/kubeconfig-dev such that the username is all 'dev' as per the below\n",
    "\n",
    "You can just do a 'find' and 'replace' "
   ]
  },
  {
   "cell_type": "raw",
   "metadata": {},
   "source": [
    "    server: \n",
    "  name: eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "contexts:\n",
    "- context:\n",
    "    cluster: eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "    user: dev@eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "  name: dev@eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "current-context: dev@eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "kind: Config\n",
    "preferences: {}\n",
    "users:\n",
    "- name: dev@eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "  user:\n",
    "    exec:\n",
    "      apiVersion: client.authentication.k8s.io/v1alpha1\n",
    "      args:\n",
    "      - token\n",
    "      - -i\n",
    "      - eksworkshop-eksctl\n",
    "      command: aws-iam-authenticator\n",
    "      env:\n",
    "      - name: AWS_STS_REGIONAL_ENDPOINTS\n",
    "        value: regional\n",
    "      - name: AWS_DEFAULT_REGION\n",
    "        value: eu-west-1"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<br>We added the **--profile dev** parameter to our kubectl config file, so that this will ask kubectl to use our IAM role associated to our dev profile, and we rename this context using suffix **-dev**\n",
    "\n",
    "With this configuration we should be able to interract with the <b> development </b> namespace, because it is as our RBAC role defined"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%env AWS_PROFILE=dev\n",
    "%env KUBECONFIG=temp/kubeconfig-dev"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!eksctl utils write-kubeconfig eksworkshop-eksctl"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Check your identity"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws sts get-caller-identity"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Lets create a pod "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!kubectl run --generator=run-pod/v1 nginx-dev --image=nginx -n development"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* List the pods"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!kubectl get pods -n development"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<br><br>However we cannot list pods in the other namespace (Integration)\n",
    "\n",
    "* If you find that this works, it could be that you are still not assuming the correct user and instead your original administrator one."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!kubectl get pods -n integration"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<br>We should get <b> error </b>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### <br><br>Test with Integ Profile "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Edit the temp/kubeconfig-dev file to add the following content and set the current context to be integ"
   ]
  },
  {
   "cell_type": "raw",
   "metadata": {},
   "source": [
    "- context:\n",
    "    cluster: eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "    user: integ@eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "  name: integ@eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "current-context: integ@eksworkshop-eksctl.eu-west-1.eksctl.io"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Overall the context section should look like this"
   ]
  },
  {
   "cell_type": "raw",
   "metadata": {},
   "source": [
    "contexts:\n",
    "- context:\n",
    "    cluster: eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "    user: dev@eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "  name: dev@eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "- context:\n",
    "    cluster: eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "    user: <admin profile>@eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "  name: <admin profile>@eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "- context:\n",
    "    cluster: eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "    user: integ@eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "  name: integ@eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "current-context: integ@eksworkshop-eksctl.eu-west-1.eksctl.io"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Then to the temp/kubeconfig-dev file add integ to the users block "
   ]
  },
  {
   "cell_type": "raw",
   "metadata": {},
   "source": [
    "- name: integ@eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "  user:\n",
    "    exec:\n",
    "      apiVersion: client.authentication.k8s.io/v1alpha1\n",
    "      args:\n",
    "      - token\n",
    "      - -i\n",
    "      - eksworkshop-eksctl\n",
    "      command: aws-iam-authenticator\n",
    "      env:\n",
    "      - name: AWS_STS_REGIONAL_ENDPOINTS\n",
    "        value: regional\n",
    "      - name: AWS_DEFAULT_REGION\n",
    "        value: eu-west-1"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Set your AWS Profile to be the integ"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%env AWS_PROFILE=integ"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!kubectl run --generator=run-pod/v1 nginx-integ --image=nginx -n integration"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* We can list the pods"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!kubectl get pods -n integration"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* However this time the development namespace is not accessible"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!kubectl get pods -n development"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<br> We expect an <b>error</b> here "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### <br><br>Test with admin profile"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Edit the temp/kubeconfig-dev file to add the following content and set the current context to be admin"
   ]
  },
  {
   "cell_type": "raw",
   "metadata": {},
   "source": [
    "- context:\n",
    "    cluster: eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "    user: admin@eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "  name: admin@eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "current-context: admin@eksworkshop-eksctl.eu-west-1.eksctl.io"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Overall the context section should look like this"
   ]
  },
  {
   "cell_type": "raw",
   "metadata": {},
   "source": [
    "contexts:\n",
    "- context:\n",
    "    cluster: eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "    user: dev@eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "  name: dev@eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "- context:\n",
    "    cluster: eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "    user: <admin profile>@eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "  name: <admin profile>@eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "- context:\n",
    "    cluster: eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "    user: integ@eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "  name: integ@eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "- context:\n",
    "    cluster: eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "    user: admin@eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "  name: admin@eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "current-context: admin@eksworkshop-eksctl.eu-west-1.eksctl.io"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Then to the temp/kubeconfig-dev file add integ to the users block "
   ]
  },
  {
   "cell_type": "raw",
   "metadata": {},
   "source": [
    "- name: admin@eksworkshop-eksctl.eu-west-1.eksctl.io\n",
    "  user:\n",
    "    exec:\n",
    "      apiVersion: client.authentication.k8s.io/v1alpha1\n",
    "      args:\n",
    "      - token\n",
    "      - -i\n",
    "      - eksworkshop-eksctl\n",
    "      command: aws-iam-authenticator\n",
    "      env:\n",
    "      - name: AWS_STS_REGIONAL_ENDPOINTS\n",
    "        value: regional\n",
    "      - name: AWS_DEFAULT_REGION\n",
    "        value: eu-west-1"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Set AWS Profile to be admin "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%env AWS_PROFILE=admin"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* lets create a pod in the default namespace "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!kubectl run --generator=run-pod/v1 nginx-admin --image=nginx"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* we can list ALL pods in the namespace"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!kubectl get pods -A"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## <br><br> Switching between different contexts"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "It is possible to merge several kubernetes API access in the same KUBECONFIG file, or just tell kubectl several file to lookup at once\n",
    "\n",
    "In the above we used the same file but it could have been seperate files and we set that each time "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Kubectx can quiickly list and switch context run the following on a terminal "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<p style=\"background:black\">\n",
    "<code style=\"background:black;color:white\">> curl -sSLO https://raw.githubusercontent.com/ahmetb/kubectx/master/kubectx && chmod 755 kubectx && sudo mv kubectx /usr/local/bin\n",
    "</code>\n",
    "</p>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## <br><br> Conclusion "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "In this module we configured EKS to provide finer access to users combining IAM Groups and Kubernetes RBAC \n",
    "You are able to create different groups depending on needs\n",
    "\n",
    "Configure their associated RBAC access in your cluster and simply add or remove users from the group to remove them access to your cluster \n",
    "\n",
    "Users will only have to configure their awscli in order to automatically retrive their associated rights in your cluster"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## <br><br> Cleanup"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Set AWS Profile by to main admin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "%env AWS_PROFILE=$AWS_PROFILE\n",
    "%env KUBECONFIG="
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!kubectl delete namespace development integration\n",
    "!kubectl delete pod nginx-admin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!eksctl delete iamidentitymapping --cluster eksworkshop-eksctl --arn arn:aws:iam::$ACCOUNT_ID:role/k8sAdmin\n",
    "!eksctl delete iamidentitymapping --cluster eksworkshop-eksctl --arn arn:aws:iam::$ACCOUNT_ID:role/k8sDev\n",
    "!eksctl delete iamidentitymapping --cluster eksworkshop-eksctl --arn arn:aws:iam::$ACCOUNT_ID:role/k8sInteg"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws iam remove-user-from-group --group-name k8sAdmin --user-name PaulAdmin\n",
    "!aws iam remove-user-from-group --group-name k8sDev --user-name JeanDev\n",
    "!aws iam remove-user-from-group --group-name k8sInteg --user-name PierreInteg"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws iam delete-group-policy --group-name k8sAdmin --policy-name k8sAdmin-policy \n",
    "!aws iam delete-group-policy --group-name k8sDev --policy-name k8sDev-policy \n",
    "!aws iam delete-group-policy --group-name k8sInteg --policy-name k8sInteg-policy "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws iam delete-group --group-name k8sAdmin\n",
    "!aws iam delete-group --group-name k8sDev\n",
    "!aws iam delete-group --group-name k8sInteg"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws iam delete-access-key --user-name JeanDev --access-key-id=$(jq -r .AccessKey.AccessKeyId temp/JeanDev.json)\n",
    "!aws iam delete-access-key --user-name PaulAdmin --access-key-id=$(jq -r .AccessKey.AccessKeyId temp/PaulAdmin.json)\n",
    "!aws iam delete-access-key --user-name PierreInteg --access-key-id=$(jq -r .AccessKey.AccessKeyId temp/PierreInteg.json)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws iam delete-user --user-name PaulAdmin\n",
    "!aws iam delete-user --user-name JeanDev\n",
    "!aws iam delete-user --user-name PierreInteg"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws iam delete-role --role-name k8sAdmin\n",
    "!aws iam delete-role --role-name k8sDev\n",
    "!aws iam delete-role --role-name k8sInteg"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Remove credentials and kubeconfig and all credentials saved "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!rm temp/JeanDev.json\n",
    "!rm temp/PaulAdmin.json\n",
    "!rm temp/PierreInteg.json"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Reset aws credentials and config file"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!rm ~/.aws/{config,credentials}\n",
    "!aws configure set default.region ${AWS_REGION}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!cat ~/.aws/config\n",
    "!cat ~/.aws/credential"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Set kubeconfig back to original location"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws eks update-kubeconfig --name eksworkshop-eksctl --region $AWS_DEFAULT_REGION --profile $AWS_PROFILE"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Delete nginx-admin"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 113,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "pod \"nginx-admin\" deleted\n"
     ]
    }
   ],
   "source": [
    "!kubectl delete pod nginx-admin"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<center><h1 style=\"background:black\"><code style=\"background:black;color:white\">IAM Roles for Service Accounts</code></h1></center>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<div class=\"alert alert-block alert-warning\">\n",
    "<font style=\"color:black\">\n",
    "<center> In this section we will create an OIDC identity provider, an IAM Role for Service account and deploy a sample pod\n",
    "</center>\n",
    "</font>\n",
    "</div>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<center><img src=\"https://adnanstudyimages.s3-eu-west-1.amazonaws.com/18.jpg\" width=\"40%\" height=\"40%\" border=5/></center>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Fine-Grained IAM Roles for Service Accounts"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* In Kubernetes version 1.12, support was added for a new <b> ProjectedServiceAccountToken </b> feature, which is an OIDC JSON web token that also contains the service account identity, and supports a configurable audience. \n",
    "* Amazon EKS now hosts a public OIDC discovery endpoint per cluster containing the signing keys for the ProjectedServiceAccountToken JSON web tokens so external systems, like IAM, can validate and accept the Kubernetes-issued OIDC tokens. \n",
    "* OIDC federation access allows you to assume IAM roles via the Secure Tokens Service (STS), enabling authentication with OIDC provider, receiving a JSON Web Token (JWT), which in turn can be used to assume an IAM role. \n",
    "* Kubernetes, on the other hand, can issue so-called projected service account tokens, which happen to be valid OIDC JWTs for pods. \n",
    "\n",
    "* Our setup equips each pod with a cryptographically-signed token that can be verified by STS against the OIDC provider of your choice to establish the pod's identity. \n",
    "\n",
    "new credential provider <b>\"sts:AssumeRoleWithWebIdentity\"</b>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## <br><br>Preparation"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### <br><br> Enabling IAM Roles for Service Accounts on your Cluster"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* The IAM roles for service accounts feature is available on new Amazon EKS Kubernetes version 1.14 clusters and clusters that were updated to versions 1.14 or 1.13 on or after September 3rd, 2019. \n",
    "\n",
    "\n",
    "<table>\n",
    "<thead>\n",
    "<tr><th>1.14</th><th>1.13</th></tr>\n",
    "</thead>\n",
    "<tbody>\n",
    "<tr><td>Client Version:v1.14.6-eks-5047ed</td><td>v1.13.7</td>\n",
    "<tr><td>Server Version: v1.14.6-eks-5047ed</td><td>v1.13.10-eks-5ac0f1</td>\n",
    "</tbody>\n",
    "</table>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "You must use at least version 1.18.15 of the AWS CLI to recieve the proper output from this command"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws --version"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Retrieve OpenID Connect issuer URL"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws eks describe-cluster --name eksworkshop-eksctl --query cluster.identity.oidc.issuer --output text"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## <br><br> Create an OIDC Identity Provider"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### <br><br> To create an IAM OIDC identity provider for your cluster with eksctl "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "To use IAM roles for service accounts in your cluster, you must create an OIDC identity provider in the IAM console\n",
    "\n",
    "* Check eksctl is at least version 0.5.1"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!eksctl version"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    " * Create your OIDC identity provider for your cluster "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!eksctl utils associate-iam-oidc-provider --cluster eksworkshop-eksctl --approve "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<br><Br>If you go to IAM Console, you will see OIDC provider has created for your cluster. "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## <br><br> Creating an IAM Role for Service Account "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### <br><br> To create an IAM role for your service accounts with eksctl "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "You must create an IAM policy that specifies the permissions that you would like the containers in your pod to have \n",
    "\n",
    "In this workshop we will use AWS managed policy named <b> 'AmazonS3ReadOnlyAccess' </b> which allow get and list for all S3 resources. \n",
    "\n",
    "You must also create a role for your service accounts to use before you associate it with a service account. \n",
    "\n",
    "Then you can then attach a specific IAM policy to the role that gives the containers in your pods the permissions you desire."
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Get ARN for AmazonS3ReadOnlyAccess"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws iam list-policies --query 'Policies[?PolicyName==`AmazonS3ReadOnlyAccess`].Arn'"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Create an IAM role for your service accounts"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!eksctl create iamserviceaccount --name iam-test --namespace default --cluster eksworkshop-eksctl --attach-policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess --approve --override-existing-serviceaccounts"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<br><br>The following deploys out a stack called **'eksctl-eksworkshop-eksctl-addon-iamserviceaccount-default-iam-test'** and has created a role for your service accont"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## <br><br> Specifying an IAM Role for Service Account"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "#### <br><br> Specifying an IAM role for your Service Account"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "In the previous step, we created the IAM role that associated with a service account named <b> iam-test </b> in the cluster and this has already been done for you with the service account you specified when creating the role "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Be sure your service account iam-test exists"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!kubectl get sa"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!kubectl describe sa iam-test "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## <br><br> Deploy Sample Pod  "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Now that we have completed all the necessary configuration to run a Pod with IAM role \n",
    "* We will deploy sample Pod to the cluster, and run a test command to see whether it works correctly or not. "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!kubectl apply -f oidc/iam-pod.yaml"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Make sure your pod is in Running status "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!kubectl get pod"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Get into the pod (run these in terminal) "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<p style=\"background:black\">\n",
    "<code style=\"background:black;color:white\">> kubectl exec -it eks-iam-test-5f88448558-fnvgl /bin/bash\n",
    "</code>\n",
    "</p>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Call sts:AssumeRoleWithWebIdentity, and you will see AccessKeyId and SecretAccessKey information if configuration is set appropriately \n"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<p style=\"background:black\">\n",
    "<code style=\"background:black;color:white\">> aws sts assume-role-with-web-identity \\\n",
    "--role-arn $AWS_ROLE_ARN \\\n",
    "--role-session-name mh9test \\\n",
    "--web-identity-token file://$AWS_WEB_IDENTITY_TOKEN_FILE \\\n",
    "--duration-seconds 1000</code></p>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Run awscli to see if it retrieves list of S3 buckets "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<p style=\"background:black\">\n",
    "<code style=\"background:black;color:white\">> aws s3 ls \n",
    "</code></p>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Run awscli to see if it retrieves list of Amazon Ec2 instances which does not have privileged in the allocated IAM policy "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<p style=\"background:black\">\n",
    "<code style=\"background:black;color:white\">> aws ec2 describe-instances --region us-west-2 \n",
    "</code></p>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* We should get an error message "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "<p style=\"background:black\">\n",
    "<code style=\"background:black;color:white\">> An error occurred (UnauthorizedOperation) when calling the DescribeInstances operation: You are not authorized to perform this operation.\n",
    "</code>\n",
    "</p>"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## <br><br> Cleanup "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Remove sample application "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!kubectl delete -f oidc/iam-pod.yaml "
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Remove IAM role and Service Account stack from cloudformation"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!eksctl delete iamserviceaccount --name iam-test --namespace default --cluster eksworkshop-eksctl"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "* Remove OIDC Integration"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws eks describe-cluster --name eksworkshop-eksctl --output json | jq -r .cluster.identity.oidc.issuer | sed -e \"s*https://**\""
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "metadata": {},
   "outputs": [],
   "source": [
    "!aws iam delete-open-id-connect-provider --open-id-connect-provider-arn arn:aws:iam::$ACCOUNT_ID:oidc-provider/oidc.eks.eu-west-1.amazonaws.com/id/272A2E290EB7870EE3BF406E63F6507E"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.3"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}