|
|
@@ -2765,6 +2765,8 @@
|
|
|
|
|
|
|
|
|
|
|
|
+
|
|
|
+
|
|
|
|
|
|
|
|
|
|
|
|
@@ -2982,82 +2984,38 @@
|
|
|
|
|
|
</li>
|
|
|
|
|
|
- <li class="md-nav__item">
|
|
|
- <a href="#aws-authentication" class="md-nav__link">
|
|
|
- <span class="md-ellipsis">
|
|
|
-
|
|
|
- AWS Authentication
|
|
|
-
|
|
|
- </span>
|
|
|
- </a>
|
|
|
+ </ul>
|
|
|
|
|
|
- <nav class="md-nav" aria-label="AWS Authentication">
|
|
|
- <ul class="md-nav__list">
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
- <a href="#controllers-pod-identity" class="md-nav__link">
|
|
|
- <span class="md-ellipsis">
|
|
|
-
|
|
|
- Controller's Pod Identity
|
|
|
+</nav>
|
|
|
|
|
|
- </span>
|
|
|
- </a>
|
|
|
+ </li>
|
|
|
|
|
|
-</li>
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
- <a href="#access-key-id-secret-access-key" class="md-nav__link">
|
|
|
- <span class="md-ellipsis">
|
|
|
-
|
|
|
- Access Key ID & Secret Access Key
|
|
|
-
|
|
|
- </span>
|
|
|
- </a>
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
|
|
|
-</li>
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
- <a href="#eks-service-account-credentials" class="md-nav__link">
|
|
|
- <span class="md-ellipsis">
|
|
|
-
|
|
|
- EKS Service Account credentials
|
|
|
-
|
|
|
- </span>
|
|
|
- </a>
|
|
|
|
|
|
-</li>
|
|
|
+
|
|
|
+
|
|
|
+ <li class="md-nav__item">
|
|
|
+ <a href="../aws-parameter-store/" class="md-nav__link">
|
|
|
|
|
|
- </ul>
|
|
|
- </nav>
|
|
|
|
|
|
-</li>
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
- <a href="#eks-pod-identity-setup" class="md-nav__link">
|
|
|
- <span class="md-ellipsis">
|
|
|
-
|
|
|
- EKS Pod Identity Setup
|
|
|
-
|
|
|
- </span>
|
|
|
- </a>
|
|
|
|
|
|
-</li>
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
- <a href="#custom-endpoints" class="md-nav__link">
|
|
|
- <span class="md-ellipsis">
|
|
|
-
|
|
|
- Custom Endpoints
|
|
|
-
|
|
|
- </span>
|
|
|
- </a>
|
|
|
+ <span class="md-ellipsis">
|
|
|
+
|
|
|
|
|
|
-</li>
|
|
|
-
|
|
|
- </ul>
|
|
|
+ AWS Parameter Store
|
|
|
|
|
|
-</nav>
|
|
|
-
|
|
|
+
|
|
|
+
|
|
|
+ </span>
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+ </a>
|
|
|
</li>
|
|
|
|
|
|
|
|
|
@@ -3070,14 +3028,14 @@
|
|
|
|
|
|
|
|
|
<li class="md-nav__item">
|
|
|
- <a href="../aws-parameter-store/" class="md-nav__link">
|
|
|
+ <a href="../aws-access/" class="md-nav__link">
|
|
|
|
|
|
|
|
|
|
|
|
<span class="md-ellipsis">
|
|
|
|
|
|
|
|
|
- AWS Parameter Store
|
|
|
+ AWS Access
|
|
|
|
|
|
|
|
|
|
|
|
@@ -4477,6 +4435,8 @@
|
|
|
|
|
|
|
|
|
|
|
|
+
|
|
|
+
|
|
|
|
|
|
|
|
|
|
|
|
@@ -4721,6 +4681,34 @@
|
|
|
|
|
|
|
|
|
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+ <li class="md-nav__item">
|
|
|
+ <a href="../../contributing/llm-policy/" class="md-nav__link">
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+ <span class="md-ellipsis">
|
|
|
+
|
|
|
+
|
|
|
+ LLM Policy
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+ </span>
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+ </a>
|
|
|
+ </li>
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
+
|
|
|
</ul>
|
|
|
</nav>
|
|
|
|
|
|
@@ -5046,78 +5034,6 @@
|
|
|
</ul>
|
|
|
</nav>
|
|
|
|
|
|
-</li>
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
- <a href="#aws-authentication" class="md-nav__link">
|
|
|
- <span class="md-ellipsis">
|
|
|
-
|
|
|
- AWS Authentication
|
|
|
-
|
|
|
- </span>
|
|
|
- </a>
|
|
|
-
|
|
|
- <nav class="md-nav" aria-label="AWS Authentication">
|
|
|
- <ul class="md-nav__list">
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
- <a href="#controllers-pod-identity" class="md-nav__link">
|
|
|
- <span class="md-ellipsis">
|
|
|
-
|
|
|
- Controller's Pod Identity
|
|
|
-
|
|
|
- </span>
|
|
|
- </a>
|
|
|
-
|
|
|
-</li>
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
- <a href="#access-key-id-secret-access-key" class="md-nav__link">
|
|
|
- <span class="md-ellipsis">
|
|
|
-
|
|
|
- Access Key ID & Secret Access Key
|
|
|
-
|
|
|
- </span>
|
|
|
- </a>
|
|
|
-
|
|
|
-</li>
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
- <a href="#eks-service-account-credentials" class="md-nav__link">
|
|
|
- <span class="md-ellipsis">
|
|
|
-
|
|
|
- EKS Service Account credentials
|
|
|
-
|
|
|
- </span>
|
|
|
- </a>
|
|
|
-
|
|
|
-</li>
|
|
|
-
|
|
|
- </ul>
|
|
|
- </nav>
|
|
|
-
|
|
|
-</li>
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
- <a href="#eks-pod-identity-setup" class="md-nav__link">
|
|
|
- <span class="md-ellipsis">
|
|
|
-
|
|
|
- EKS Pod Identity Setup
|
|
|
-
|
|
|
- </span>
|
|
|
- </a>
|
|
|
-
|
|
|
-</li>
|
|
|
-
|
|
|
- <li class="md-nav__item">
|
|
|
- <a href="#custom-endpoints" class="md-nav__link">
|
|
|
- <span class="md-ellipsis">
|
|
|
-
|
|
|
- Custom Endpoints
|
|
|
-
|
|
|
- </span>
|
|
|
- </a>
|
|
|
-
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
@@ -5480,173 +5396,6 @@ a <code>path</code> prefix or use <code>Tags</code> filter.</p>
|
|
|
<span class="w"> </span><span class="nt">key</span><span class="p">:</span><span class="w"> </span><span class="s">"production/api-key"</span>
|
|
|
<span class="w"> </span><span class="nt">version</span><span class="p">:</span><span class="w"> </span><span class="s">"uuid/123e4567-e89b-12d3-a456-426614174000"</span>
|
|
|
</code></pre></div>
|
|
|
-<h2 id="aws-authentication">AWS Authentication</h2>
|
|
|
-<h3 id="controllers-pod-identity">Controller's Pod Identity</h3>
|
|
|
-<p><img alt="Pod Identity Authentication" src="../../pictures/diagrams-provider-aws-auth-pod-identity.png" /></p>
|
|
|
-<p>Note: If you are using Parameter Store replace <code>service: SecretsManager</code> with <code>service: ParameterStore</code> in all examples below.</p>
|
|
|
-<p>This is basically a zero-configuration authentication method that inherits the credentials from the runtime environment using the <a href="https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/credentials.html#credentials-default">aws sdk default credential chain</a>.</p>
|
|
|
-<p>You can attach a role to the pod using <a href="https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html">IRSA</a>, <a href="https://github.com/uswitch/kiam">kiam</a> or <a href="https://github.com/jtblin/kube2iam">kube2iam</a>. When no other authentication method is configured in the <code>Kind=Secretstore</code> this role is used to make all API calls against AWS Secrets Manager or SSM Parameter Store.</p>
|
|
|
-<p>Based on the Pod's identity you can do a <code>sts:assumeRole</code> before fetching the secrets to limit access to certain keys in your provider. This is optional.</p>
|
|
|
-<div class="highlight"><pre><span></span><code><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">external-secrets.io/v1</span>
|
|
|
-<span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">SecretStore</span>
|
|
|
-<span class="nt">metadata</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">team-b-store</span>
|
|
|
-<span class="nt">spec</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">provider</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">aws</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">service</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">SecretsManager</span>
|
|
|
-<span class="w"> </span><span class="nt">region</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">eu-central-1</span>
|
|
|
-<span class="w"> </span><span class="c1"># optional: do a sts:assumeRole before fetching secrets</span>
|
|
|
-<span class="w"> </span><span class="nt">role</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">team-b</span>
|
|
|
-</code></pre></div>
|
|
|
-<h3 id="access-key-id-secret-access-key">Access Key ID & Secret Access Key</h3>
|
|
|
-<p><img alt="SecretRef" src="../../pictures/diagrams-provider-aws-auth-secret-ref.png" /></p>
|
|
|
-<p>You can store Access Key ID & Secret Access Key in a <code>Kind=Secret</code> and reference it from a SecretStore.</p>
|
|
|
-<div class="highlight"><pre><span></span><code><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">external-secrets.io/v1</span>
|
|
|
-<span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">SecretStore</span>
|
|
|
-<span class="nt">metadata</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">team-b-store</span>
|
|
|
-<span class="nt">spec</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">provider</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">aws</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">service</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">SecretsManager</span>
|
|
|
-<span class="w"> </span><span class="nt">region</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">eu-central-1</span>
|
|
|
-<span class="w"> </span><span class="c1"># optional: assume role before fetching secrets</span>
|
|
|
-<span class="w"> </span><span class="nt">role</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">team-b</span>
|
|
|
-<span class="w"> </span><span class="nt">auth</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">secretRef</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">accessKeyIDSecretRef</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">awssm-secret</span>
|
|
|
-<span class="w"> </span><span class="nt">key</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">access-key</span>
|
|
|
-<span class="w"> </span><span class="nt">secretAccessKeySecretRef</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">awssm-secret</span>
|
|
|
-<span class="w"> </span><span class="nt">key</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">secret-access-key</span>
|
|
|
-</code></pre></div>
|
|
|
-<p><strong>NOTE:</strong> In case of a <code>ClusterSecretStore</code>, Be sure to provide <code>namespace</code> in <code>accessKeyIDSecretRef</code>, <code>secretAccessKeySecretRef</code> with the namespaces where the secrets reside.</p>
|
|
|
-<h3 id="eks-service-account-credentials">EKS Service Account credentials</h3>
|
|
|
-<p><img alt="Service Account" src="../../pictures/diagrams-provider-aws-auth-service-account.png" /></p>
|
|
|
-<p>This feature lets you use short-lived service account tokens to authenticate with AWS.
|
|
|
-You must have <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-token-volume-projection">Service Account Volume Projection</a> enabled - it is by default on EKS. See <a href="https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-technical-overview.html">EKS guide</a> on how to set up IAM roles for service accounts.</p>
|
|
|
-<p>The big advantage of this approach is that ESO runs without any credentials.</p>
|
|
|
-<div class="highlight"><pre><span></span><code><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">v1</span>
|
|
|
-<span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">ServiceAccount</span>
|
|
|
-<span class="nt">metadata</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">annotations</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">eks.amazonaws.com/role-arn</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">arn:aws:iam::123456789012:role/team-a</span>
|
|
|
-<span class="w"> </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">my-serviceaccount</span>
|
|
|
-<span class="w"> </span><span class="nt">namespace</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">default</span>
|
|
|
-</code></pre></div>
|
|
|
-<p>Reference the service account from above in the Secret Store:</p>
|
|
|
-<div class="highlight"><pre><span></span><code><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">external-secrets.io/v1</span>
|
|
|
-<span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">SecretStore</span>
|
|
|
-<span class="nt">metadata</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">secretstore-sample</span>
|
|
|
-<span class="nt">spec</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">provider</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">aws</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">service</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">SecretsManager</span>
|
|
|
-<span class="w"> </span><span class="nt">region</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">eu-central-1</span>
|
|
|
-<span class="w"> </span><span class="nt">auth</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">jwt</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">serviceAccountRef</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">my-serviceaccount</span>
|
|
|
-</code></pre></div>
|
|
|
-<p><strong>NOTE:</strong> In case of a <code>ClusterSecretStore</code>, Be sure to provide <code>namespace</code> for <code>serviceAccountRef</code> with the namespace where the service account resides.</p>
|
|
|
-<h2 id="eks-pod-identity-setup">EKS Pod Identity Setup</h2>
|
|
|
-<p>In order to use EKS Pod Identity Agent, create a role like this:</p>
|
|
|
-<div class="highlight"><pre><span></span><code><span class="p">{</span>
|
|
|
-<span class="w"> </span><span class="nt">"Statement"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span>
|
|
|
-<span class="w"> </span><span class="p">{</span>
|
|
|
-<span class="w"> </span><span class="nt">"Action"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span>
|
|
|
-<span class="w"> </span><span class="s2">"secretsmanager:GetResourcePolicy"</span><span class="p">,</span>
|
|
|
-<span class="w"> </span><span class="s2">"secretsmanager:GetSecretValue"</span><span class="p">,</span>
|
|
|
-<span class="w"> </span><span class="s2">"secretsmanager:DescribeSecret"</span><span class="p">,</span>
|
|
|
-<span class="w"> </span><span class="s2">"secretsmanager:ListSecretVersionIds"</span>
|
|
|
-<span class="w"> </span><span class="p">],</span>
|
|
|
-<span class="w"> </span><span class="nt">"Effect"</span><span class="p">:</span><span class="w"> </span><span class="s2">"Allow"</span><span class="p">,</span>
|
|
|
-<span class="w"> </span><span class="nt">"Resource"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span>
|
|
|
-<span class="w"> </span><span class="s2">"*"</span>
|
|
|
-<span class="w"> </span><span class="p">]</span>
|
|
|
-<span class="w"> </span><span class="p">}</span>
|
|
|
-<span class="w"> </span><span class="p">],</span>
|
|
|
-<span class="w"> </span><span class="nt">"Version"</span><span class="p">:</span><span class="w"> </span><span class="s2">"2012-10-17"</span>
|
|
|
-<span class="p">}</span>
|
|
|
-</code></pre></div>
|
|
|
-<div class="highlight"><pre><span></span><code><span class="p">{</span>
|
|
|
-<span class="w"> </span><span class="nt">"Version"</span><span class="p">:</span><span class="w"> </span><span class="s2">"2012-10-17"</span><span class="p">,</span>
|
|
|
-<span class="w"> </span><span class="nt">"Statement"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span>
|
|
|
-<span class="w"> </span><span class="p">{</span>
|
|
|
-<span class="w"> </span><span class="nt">"Sid"</span><span class="p">:</span><span class="w"> </span><span class="s2">"AllowEksAuthToAssumeRoleForPodIdentity"</span><span class="p">,</span>
|
|
|
-<span class="w"> </span><span class="nt">"Effect"</span><span class="p">:</span><span class="w"> </span><span class="s2">"Allow"</span><span class="p">,</span>
|
|
|
-<span class="w"> </span><span class="nt">"Principal"</span><span class="p">:</span><span class="w"> </span><span class="p">{</span>
|
|
|
-<span class="w"> </span><span class="nt">"Service"</span><span class="p">:</span><span class="w"> </span><span class="s2">"pods.eks.amazonaws.com"</span>
|
|
|
-<span class="w"> </span><span class="p">},</span>
|
|
|
-<span class="w"> </span><span class="nt">"Action"</span><span class="p">:</span><span class="w"> </span><span class="p">[</span>
|
|
|
-<span class="w"> </span><span class="s2">"sts:AssumeRole"</span><span class="p">,</span>
|
|
|
-<span class="w"> </span><span class="s2">"sts:TagSession"</span>
|
|
|
-<span class="w"> </span><span class="p">]</span>
|
|
|
-<span class="w"> </span><span class="p">}</span>
|
|
|
-<span class="w"> </span><span class="p">]</span>
|
|
|
-<span class="p">}</span>
|
|
|
-</code></pre></div>
|
|
|
-<p>Install ESO using helm and define these values:</p>
|
|
|
-<div class="highlight"><pre><span></span><code><span class="nt">serviceAccount</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">annotations</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">external-secrets</span>
|
|
|
-</code></pre></div>
|
|
|
-<p>Create a pod association:</p>
|
|
|
-<div class="highlight"><pre><span></span><code>aws eks create-pod-identity-association --cluster-name my-cluster --role-arn arn:aws:iam::111122223333:role/my-role --namespace external-secrets --service-account external-secrets
|
|
|
-</code></pre></div>
|
|
|
-<p>Then create a secret store like this:</p>
|
|
|
-<div class="highlight"><pre><span></span><code><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">external-secrets.io/v1</span>
|
|
|
-<span class="nt">kind</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">SecretStore</span>
|
|
|
-<span class="nt">metadata</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">store</span>
|
|
|
-<span class="nt">spec</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">provider</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">aws</span><span class="p">:</span>
|
|
|
-<span class="w"> </span><span class="nt">service</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">SecretsManager</span>
|
|
|
-<span class="w"> </span><span class="nt">region</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">eu-central-1</span>
|
|
|
-</code></pre></div>
|
|
|
-<p><em>Note</em>: <code>serviceAccountRef</code> <em>cannot</em> be used together with EKS Pod Identity. That's because ESO can not impersonate
|
|
|
-service accounts which have iam roles bound using pod identity. Doing so will result in an error like this:
|
|
|
-<div class="highlight"><pre><span></span><code>unable to create session: an IAM role must be associated with service account ...
|
|
|
-</code></pre></div></p>
|
|
|
-<p><em>Note:</em> No <code>auth</code> section is defined for the SecretStore.</p>
|
|
|
-<p><em>Note:</em> For even more details you can follow this post for more setup and information using Terraform <a href="https://containscloud.com/2024/03/24/integrating-aws-secrets-manager-to-eks-using-external-secrets/">here</a>.</p>
|
|
|
-<h2 id="custom-endpoints">Custom Endpoints</h2>
|
|
|
-<p>You can define custom AWS endpoints if you want to use regional, vpc or custom endpoints. See List of endpoints for <a href="https://docs.aws.amazon.com/general/latest/gr/asm.html">Secrets Manager</a>, <a href="https://docs.aws.amazon.com/general/latest/gr/ssm.html">Secure Systems Manager</a> and <a href="https://docs.aws.amazon.com/general/latest/gr/sts.html">Security Token Service</a>.</p>
|
|
|
-<p>Use the following environment variables to point the controller to your custom endpoints. Note: All resources managed by this controller are affected.</p>
|
|
|
-<table>
|
|
|
-<thead>
|
|
|
-<tr>
|
|
|
-<th>ENV VAR</th>
|
|
|
-<th>DESCRIPTION</th>
|
|
|
-</tr>
|
|
|
-</thead>
|
|
|
-<tbody>
|
|
|
-<tr>
|
|
|
-<td>AWS_SECRETSMANAGER_ENDPOINT</td>
|
|
|
-<td>Endpoint for the Secrets Manager Service. The controller uses this endpoint to fetch secrets from AWS Secrets Manager.</td>
|
|
|
-</tr>
|
|
|
-<tr>
|
|
|
-<td>AWS_SSM_ENDPOINT</td>
|
|
|
-<td>Endpoint for the AWS Secure Systems Manager. The controller uses this endpoint to fetch secrets from SSM Parameter Store.</td>
|
|
|
-</tr>
|
|
|
-<tr>
|
|
|
-<td>AWS_STS_ENDPOINT</td>
|
|
|
-<td>Endpoint for the Security Token Service. The controller uses this endpoint when creating a session and when doing <code>assumeRole</code> or <code>assumeRoleWithWebIdentity</code> calls.</td>
|
|
|
-</tr>
|
|
|
-<tr>
|
|
|
-<td>AWS_ECR_ENDPOINT</td>
|
|
|
-<td>Endpoint for the ECR Service. The controller uses this endpoint to fetch authorization tokens from ECR.</td>
|
|
|
-</tr>
|
|
|
-<tr>
|
|
|
-<td>AWS_ECR_PUBLIC_ENDPOINT</td>
|
|
|
-<td>Endpoint for the Public ECR Service. The controller uses this endpoint to fetch authorization tokens from ECR.</td>
|
|
|
-</tr>
|
|
|
-</tbody>
|
|
|
-</table>
|
|
|
|
|
|
|
|
|
|