aws-samples / aws-samples/eks-multi-cluster-gitops

[FEATURE] Add support for multi-account

Open
#93 0 comments 1 reaction 0 assignees View on GitHub
Dominant language
Python
Stars
234
Forks
58
Avg merge
15m
Merged PRs (30d)
11

Description

As of now, all the workload clusters provisioned by the solution lands on the same account where the management cluster resides. This issue for adding support for multi-cluster.

**Changes:**
Workload clusters can be provisioned in different accounts by following the steps below:
1. Create an additional `ProviderConfig` that points to the account where you want to deploy the workload cluster. Original `ProviderConfig` can be found at: https://github.com/aws-samples/eks-multi-cluster-gitops/blob/main/repos/gitops-system/tools/crossplane/crossplane-aws-provider-config/aws-providerconfig.yaml. The new `ProviderConfig` will be a bit different from the original one; a role in the workload cluster account has to be assumed -- refer to the following sample for guidance: https://github.com/crossplane-contrib/provider-aws/blob/master/AUTHENTICATION.md#using-assumerole.
2. Change the EKS composition to parameterise `providerConfigRef`.
3. Pass the name of the new `ProviderConfig` created at step 1 in the claim of the new cluster at: https://github.com/aws-samples/eks-multi-cluster-gitops/blob/main/repos/gitops-system/clusters-config/template/def/eks-cluster.yaml.

**NOTE:** the steps above are based on the community AWS provider -- it needs to be validated for the official Upbound AWS providers.

You will have to create an IAM role in the workload cluster account with trust policy that allows assuming it from the IAM role in the management account used for running Crossplane AWS provider; it should have the required IAM permissions for creating EKS clusters, and its dependencies.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.