[EKS Auto Mode] [Request]: EKS Auto Mode incompatible with secure Service Control Policies
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
Please enable instanceProfile in the NodeClass API for EKS Auto.
**Which service(s) is this request for?**
EKS (Auto)
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
#### TLDR: Lack of ability to use pre-defined InstanceProfile is incompatible with secure multi-account security principles.
1. We utilise secure Service Control Policies in our org which block non-CD accounts from performing role-based IAM actions, e.g. AddRoleToInstanceProfile, CreateInstanceProfile, CreateRole, etc.
2. When EKS Auto was adapted from Karpenter , several features were dropped when porting EC2NodeClass to NodeClass. One of these was the ability to reference instanceProfile instead of role.
3. EKS Auto seems to want to create a dedicated instanceProfile per node-pool and then add the node role to this instance profile at run-time.
4. Our SCP forbids any "user-facing" process from changing roles. Hence we are hard-blocked from adoption right now.
**Are you currently working around this issue?**
No workaround possible.
Contributor guide
Research direction
Review the EKS Auto NodeClass API, its relationship to the earlier EC2NodeClass, and the requested instanceProfile capability. Read the stated Service Control Policy restrictions and verify that the result supports a pre-defined instance profile without runtime role or instance-profile changes; done means EKS Auto can operate under those policies.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, kubernetes
- Domain
- authorization, cloud, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100