Promote Sign in Sign up

Repository

k8s-iam-policies

IAM Policies what for making Kubernetes work properly on AWS

nholuongut
Repository

README

View all Roadmaps  ·  Best Practices  ·  Questions

Kubernetes IAM Policies

This repository contains IAM policies useful for running Kubernetes on AWS.

The contents of this repository is subject to changes at any time based on the
current latest and greatest version of Kubernetes, and my thinking about how
IAM policies should be best implimented for AWS. Therefore please do not
rely on the contents of this repository for your own use, rather review them
and then pull a copy into your own infrastructure as code.

master

The minimial required policy for a master node with the AWS cloud provider
enabled.

To limit the scope of the permissions K8sMasterTaggedResourcesWritable
can be restricted to nodes in your cluster by editing the tag Condition.

This depends on your EC2 nodes having the KubernetesCluster tag with
the cluster name as the value.

node

The minimial required policy for a worker node with the AWS cloud provider
enabled.

autoscaler

The required permissions required to use the Kubernetes Cluster Autoscaler.

Based on this documentation

loadbalancing

The required permissions for Kuberntes to controll ELB and NLB load ballancers.

ecr

Allows an instance to authenticate with ECR and pull images.

cni

Policy for allowing the L-IPAM daemon in the amazon-vpc-cni-k8s CNI plugin
to attach ENIs and private IPs to instances. Based on the documentation
found here.

Usage

setup.sh

A shell script for setting this stuff up quickly.

Run ./setup.sh to create Instance Profiles for K8sMaster and K8sNode.

Depends on the aws cli.

Standalone so can be downloaded and run from github:

$ curl https://raw.githubusercontent.com/errm/k8s-iam-policies/master/setup.sh -o setup.sh
$ sh -e setup.sh

Warning
No idempotency, so this will fail if you try to run it twice.

CloudFormation

e.g.:

aws cloudformation create-stack --capabilities CAPABILITY_IAM --stack-name K8sIamPolicies --template-body file://cf.yaml

The Instance Profile ARNs are outputs so you will see them once the stack has finished creating when running aws cloudformation describe-stacks

Manual

You could use the json files in this repo to create managed policies:

e.g:

aws iam create-policy --policy-name K8sMaster --policy-document file://master.json

I'm are always open to your feedback🚀

[Contact Me🇻]



ko-fi

License🇻

  • Nho Luong (c). All Rights Reserved.🌟