Support EKS Pod Identity

[csantanapr]

Summary

EKS released in Nov/2023 EKS Pod Identity, this is an alternative to IAM roles for service accounts (IRSA)

Motivation

Have additional options on how ArgoCD authenticates with AWS other than using IRSA.

Proposal

To support EKS Pod Identity the change is transparent if your using the aws-sdk, the version of the sdk needs to be updated to a recent version that supports EKS Pod Identity.

[csantanapr]

The PR that bumps the aws-sdk version is #17063

A follow up PR will have the docs on how to configure ArgoCD to leverage the EKS Pod Identity

[todaywasawesome]

@csantanapr leaving this open until the docs are done

[csantanapr]

Sounds good @csantanapr I will be working on docs

[csantanapr]

@daniel-codefresh I was trying to work on docs but they were broken to build and preview, here is a fix #17313

[tybook]

Hey @csantanapr do you have a branch with your in-progress docs? Or generally any rough guidance on how to configure ArgoCD to use EKS Pod Identity?

[isikdos]

Hey @csantanapr do you have a branch with your in-progress docs? Or generally any rough guidance on how to configure ArgoCD to use EKS Pod Identity?

I'm not him obvi, but the solution is to just use a more recent release of argo-cd. The only necessary changes to support EKS Pod Identity are to have a more recent version of the AWS SDK running. If you are asking how to configure EKS Pod Identity in general, this guide has a bunch of information: https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html

[tybook]

Hey @csantanapr do you have a branch with your in-progress docs? Or generally any rough guidance on how to configure ArgoCD to use EKS Pod Identity?

I'm not him obvi, but the solution is to just use a more recent release of argo-cd. The only necessary changes to support EKS Pod Identity are to have a more recent version of the AWS SDK running. If you are asking how to configure EKS Pod Identity in general, this guide has a bunch of information: https://docs.aws.amazon.com/eks/latest/userguide/pod-identities.html

I'm wondering specifically about how to configure an EKS cluster secret such that ArgoCD can authenticate with it via EKS Pod Identity instead of IRSA. The existing instructions at https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/#eks assume the use of IRSA.

[AnubhavSabharwa]

Does argocd cluster secret support EKS Pod Identity

[magic-madrigal]

I've been trying to find a way to get it work for the past day and a half and haven't been successful.

I feel I'm going to revert to IRSA, and then perhaps try using eksctl's migration command to see what it suggests.

[AnubhavSabharwa]

@magic-madrigal We install argocd via another argocd as helm based application.
We are not allowed to save any token on the repository.
I have been trying this setup but at the end getting below error

getting credentials: exec: executable argocd-k8s-auth failed with exit code 20

Would you mind suggesting something here? IRSA

[isikdos]

• Have an IAM role that is granted EKS Pod identity with an EKS Pod Identity Association https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/eks_pod_identity_association and don't forget the principal
• Have an IAM role that is given api access to the cluster that you want administrated by EKS Pod Identity. Make sure this can be assumed by the prior role.
• fill out the Argo auth brick for secret-type = cluster : https://argo-cd.readthedocs.io/en/stable/operator-manual/applicationset/Generators-Cluster/
• For the above, include the AWS Auth config from here https://argo-cd.readthedocs.io/en/stable/operator-manual/declarative-setup/
• Also make sure that you have the tlsclientConfig set properly

If you do all of that, it should work happily, I don't think I've forgotten any steps. You can always make sure of different components by looking at the pod running in EKS and seeing if it has the hallmark signs of using EKS pod identity, and also you can check the logs on the pod identity daemon to see what's going on

Remember to kick pods after updating their configuration for EKS pod identity, as this whole process works when the pod is coming up, not when the pod is already up