Share EKS Cluster

This guide will walk you through granting other users access to your EKS cluster.

What You’ll Need

  • An existing EKS cluster.
  • The account ID of your AWS account.
  • The name of the IAM user or role you want to grant access to.

Procedure

  1. Edit the aws-auth ConfigMap in the kube-system namespace:

    root@rok-tools:~# kubectl edit configmap aws-auth -n kube-system

  2. Add an entry under the data field for each IAM user or IAM role you wish to grant access to. Choose one of the following options based on whether you want to grant access to a user or an IAM role.

    IAM user

    IAM role

    data: mapUsers: | - userarn: arn:aws:iam::<AWS_ACCOUNT_ID>:user/<AWS_IAM_USER> username: <AWS_IAM_USER> groups: - system:masters

    Replace <AWS_ACCOUNT_ID> with the account ID of the user you wish to grant access to your clsuter and <AWS_IAM_USER> with their username.

    data: mapRoles: | - rolearn: arn:aws:iam::<AWS_ACCOUNT_ID>:role/<AWS_IAM_ROLE> username: system:node:{{EC2PrivateDNSName}} groups: - system:masters

    Replace <AWS_ACCOUNT_ID> with the account ID of the IAM role you wish to grant access to your clsuter and <AWS_IAM_ROLE> with the name of the role.

    Note

    If the aws-auth ConfigMap does not exist in your cluster, there is an example one in your GitOps repository under rok/eks/aws-auth.yaml that you can edit and apply directly.

    See also

  3. Ensure that the user has sufficient permissions on EKS resources.

    Note

    You can give the necessary permissions to the user by creting a new group with the AmazonEKSAdminPolicy, for example, and adding the user to the group.

    See also

  4. Ask the user to follow the Configure AWS CLI guide so that they can access AWS resources with aws.

  5. Ask the user to follow the Access EKS Cluster guide so that they can access Kubernetes with kubectl.

    Important

    In case the Kubernetes API server is firewalled ask the user to connect from a trusted source, for example, via a trusted VPN.

Summary

You have successfully granted other users access to your EKS cluster.

What’s Next

Check out the rest of the maintenance operations that you can perform on your cluster.

PreviousNext