DEV Community

leroykayanda
leroykayanda

Posted on

Create EKS Service Account in terraform

Set up the IAM role like so

resource "aws_iam_role" "role" {
  name = "${var.env}-${var.service}"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRoleWithWebIdentity"
        Effect = "Allow"
        Sid    = ""
        Principal = {
          Federated = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:oidc-provider/${local.eks_oidc_issuer}"
        }
      },
    ]
  })
}

resource "aws_iam_policy" "policy" {
  name = "${var.env}-${var.service}"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = [
          "s3:PutObject",
          "s3:ListBucket",
          "s3:GetObject",
          "s3:DeleteObject"
        ]
        Effect   = "Allow"
        Resource = "*"
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "attachment" {
  role       = aws_iam_role.role.name
  policy_arn = aws_iam_policy.policy.arn
}
Enter fullscreen mode Exit fullscreen mode

create the service account

resource "kubernetes_service_account" "this" {
  metadata {
    name      = var.service
    namespace = var.service
    annotations = {
      "eks.amazonaws.com/role-arn" = aws_iam_role.role.arn
    }
  }
  automount_service_account_token = true
}
Enter fullscreen mode Exit fullscreen mode

data.tf

data "aws_eks_cluster" "cluster" {
  name = "${var.cluster_env}-${var.cluster_name}"
}

data "aws_eks_cluster_auth" "auth" {
  name = "${var.cluster_env}-${var.cluster_name}"
}

data "aws_caller_identity" "current" {}

data "aws_eks_cluster" "cluster" {
  name = "${var.cluster_env}-${var.cluster_name}"
}
Enter fullscreen mode Exit fullscreen mode

locals.tf

locals {
  eks_oidc_issuer = trimprefix(data.aws_eks_cluster.cluster.identity[0].oidc[0].issuer, "https://")
}
Enter fullscreen mode Exit fullscreen mode

providers.tf

provider "kubernetes" {
  host                   = data.aws_eks_cluster.cluster.endpoint
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority[0].data)
  token                  = data.aws_eks_cluster_auth.auth.token
}
Enter fullscreen mode Exit fullscreen mode

Configure the app to use the service account

apiVersion: apps/v1
kind: Deployment
metadata:
  name: references
  namespace: references
  labels:
    app: references
spec:
  replicas: 1
  selector:
    matchLabels:
      app: references
  template:
    metadata:
      labels:
        app: references
    spec:
      serviceAccountName: references
      containers:
        - name: references
          image: nginx
          ports:
            - containerPort: 8501
Enter fullscreen mode Exit fullscreen mode

Image of Timescale

Timescale – the developer's data platform for modern apps, built on PostgreSQL

Timescale Cloud is PostgreSQL optimized for speed, scale, and performance. Over 3 million IoT, AI, crypto, and dev tool apps are powered by Timescale. Try it free today! No credit card required.

Try free

Top comments (0)

Heroku

This site is powered by Heroku

Heroku was created by developers, for developers. Get started today and find out why Heroku has been the platform of choice for brands like DEV for over a decade.

Sign Up