[EKS][Feature Request]: Automatically remove IAM Roles from “Access Entries”
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
We wish EKS to remove from “Access Entries” the IAM Role of Managed Node Group that do not exist anymore.
**Which service(s) is this request for?**
EKS
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
In the past we created one Managed Node Group in our EKS cluster. The worker nodes (EC2s) of that Managed Node Group, could join successfully the EKS cluster using the EKS API method. At some point in time, we decided to delete this Managed Node Group from our EKS cluster. The deletion of Managed Node Group from EKS was completed with success however, the IAM Role used by that Managed Node Group was never removed from the “Access Entries”. Later, when we re-provisioned the same Managed Node Group we could verify that couldn't be created successfully due to the fact that the worker nodes could not join the EKS cluster. After manual deletion of old IAM Role from “Access Entries” the worker nodes could successfully register. The IAM Roles are added automatically by AWS into “Access Entries”. We expected that removal should be also done automatically.
**Are you currently working around this issue?**
How are you currently solving this problem?
We delete manually the IAM Role from “Access Entries".
**Additional context**
Anything else we should know?
We opened an internal ticket to AWS Support with ID 172780501600814.
Contributor guide
Research direction
No files, tests, or implementation entry points are named because this is a request for EKS behavior. Start by reviewing the described Managed Node Group and Access Entries lifecycle, including AWS Support ticket 172780501600814. Done would mean obsolete IAM roles are removed from Access Entries when their Managed Node Group is deleted.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, kubernetes
- Domain
- authorization, cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100