[EKS] [request]: EKS authentication rolearn wildcard support aka AWS Identity Center SSO integration with EKS access entry API
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
**Tell us about your request**
Support basic glob wildcard rolearn matching for aws-auth configmap that controls iam role eks auth.
**Which service(s) is this request for?**
EKS
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
Trying to avoid hardcoding _lots_ of IAM role arns into the aws-auth configmap. It would be useful if basic glob wildcard matching worked in the `rolearn` field of each role mapping:
```
apiVersion: v1
kind: ConfigMap
metadata:
name: aws-auth
namespace: kube-system
data:
mapRoles: |
- groups: [AcmeCorp]
rolearn: arn:aws:iam::111122223333:role/teams/*
username: AcmeCorp
```
**Are you currently working around this issue?**
Individually specifying each rolearn and updating the configmap everytime these roles change:
```
apiVersion: v1
kind: ConfigMap
metadata:
name: aws-auth
namespace: kube-system
data:
mapRoles: |
- groups: [AcmeCorp]
rolearn: arn:aws:iam::111122223333:role/teams/SomeTeam
username: SomeTeam
- groups: [AcmeCorp]
rolearn: arn:aws:iam::111122223333:role/teams/AnotherTeam
username: AnotherTeam
```
**Additional context**
I tried using a `*` on a working `rolearn` field and the role became unable to authenticate with the api server. EKS version (Im not sure what component handles this auth delegation, so I dont know of another relevant version to check for that):
```
$ kubectl version
Client Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.1", GitCommit:"4485c6f18cee9a5d3c3b4e523bd27972b1b53892", GitTreeState:"clean", BuildDate:"2019-07-18T14:25:20Z", GoVersion:"go1.12.7", Compiler:"gc", Platform:"darwin/amd64"}
Server Version: version.Info{Major:"1", Minor:"13+", GitVersion:"v1.13.10-eks-5ac0f1", GitCommit:"5ac0f1d9ab2c254ea2b0ce3534fd72932094c6e1", GitTreeState:"clean", BuildDate:"2019-08-20T22:39:46Z", GoVersion:"go1.11.13", Compiler:"gc", Platform:"linux/amd64"}
```
Contributor guide
Assessment
This issue has not been assessed yet.