aws / aws/containers-roadmap

[EKS] [request]: Allow EKS Pod identities for fluent-bit addon

Open
#2,827 1 comment 1 reaction 0 assignees View on GitHub
EKS EKS Add-Ons Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**

What do you want us to build?
Enable EKS Pod identities for the Fluent Bit community addon.

**Which service(s) is this request for?**
EKS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
We would like to migrate to EKS Pod Identities across the board. However, when I attempt to configure the Fluent Bit addon with an EKS Pod identity, it results in an error:

```
An error occurred (InvalidParameterException) when calling the UpdateAddon operation: Pod Identity feature is not supported for addon version: null
```

I believe this is because the addon version metadata says `"requiresIamPermissions": false`. However the docs for the fluent-bit addon allude to the fact that you may need to attach custom permissions:
> However, you may need to grant this add-on IAM permissions if you configure an AWS output location. For more information, see [Use Pod Identities to assign an IAM role to an Amazon EKS add-on](https://docs.aws.amazon.com/eks/latest/userguide/update-addon-role.html).

And in fact we do need to attach custom permissions to allow Fluent Bit to access a Kinesis stream.

**Are you currently working around this issue?**
We're using an IRSA role for fluent-bit, which seems to work.

There's also a little confusion here because running `aws eks describe-addon` correctly shows a `"serviceAccountRoleArn"` attribute on the addon, but in the EKS Addon console says "IAM role for service account (IRSA): Not required", i.e. it refuses to display the role, I'm guessing again due to the `requiresIamPermissions` metadata.

**Additional context**
Anything else we should know?

**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the EKS add-on behavior described in the issue, especially the requiresIamPermissions metadata and the update-addon-role documentation. Compare how aws eks describe-addon and the EKS Addon console report the IAM role. Done means Fluent Bit accepts an EKS Pod Identity with custom Kinesis permissions and the metadata and console no longer say IAM is unnecessary.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes
Domain
authorization, cloud, devops
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.