Recently a new EKS addons introduced an addon feature Pod Identities. Basically if the pod want to communicate with other AWS services it will happen through the IAM Roles for service account (IRSA) where the IAM role will be configured as service account and attached to pods and a switch happens between EKS and IAM. Now with Pod Identity addons we can provide granular permissions for the pods.
You can install the addons and verify if it is added to the cluster
aws eks --region ap-south-1 list-addons --cluster-name demo
{
"addons": [
"coredns",
"eks-pod-identity-agent",
"kube-proxy",
"vpc-cni"
]
}
You can verify the addons running as daemonset in the cluster
kubectl get daemonset -A
NAMESPACE NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE
kube-system aws-node 2 2 2 2 2 <none> 51m
kube-system eks-pod-identity-agent 2 2 2 2 2 <none> 48m
kube-system kube-proxy 2 2 2 2 2 <none> 51m
Let us break down and see how exactly it works, we will try to access S3 bucket from the pod using pod identity.
Step 1. Create test S3 bucket name test-884
.
Step 2. Create an IAM role pod-identity-s3-demo
choose trusted entity EKS and EKS pod identity.

wowww