[EKS] [Feature Request]: Allow a mechanism for EKS linux containers to authenticate via AWS managed AD
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
If running other windows workloads (such as MSSQL Server) on EC2 it's typically best practice to only allow windows authentication in this space. In order to allow this best practice to continue a feature allowing linux based EKS containers to authenticate using the AWS managed AD (perhaps via IAM) would be extremely useful
**Which service(s) is this request for?**
EKS
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
Ultimately we would like to have linux containers on EKS using windows authentication to authenticate to existing workloads such as MSSQL running on EC2 in a managed way.
The current approaches seem to either branch into allowing additional de-centralised logins (e.g. workload specific logins) to be allowed and used, or approaches such as this for ECS (https://aws.amazon.com/blogs/containers/using-windows-authentication-with-linux-containers-on-amazon-ecs/) that rely on adding a sidecar container which requires a quite elevated AD account.
For keeping security best practice and straight forwards centralised management this would be very beneficial.
**Are you currently working around this issue?**
Either allowing app-specific credentials and building further controls around them or modifying https://aws.amazon.com/blogs/containers/using-windows-authentication-with-linux-containers-on-amazon-ecs/ for EKS.
**Additional context**
I believe this feature is possible in other cloud providers so would be nice to have within this space.
Contributor guide
Research direction
No repository file or test is identified. Start by reviewing the linked ECS Windows-authentication approach and the EKS and AWS managed AD context described in the issue. Done would require a defined, maintainer-approved mechanism for Linux EKS containers to authenticate to existing workloads through AWS managed AD.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, kubernetes, linux
- Domain
- authentication, cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100