Amazon EKS Dynamic Secrets

You can create a dynamic Amazon Elastic Kubernetes Service (EKS) secret to allow users to receive dynamic access tokens to an Amazon EKS cluster.

Prerequisites

• An Akeyless Gateway

• An EKS Target

• AWS IAM principal (role or user)

To use a dynamic Amazon EKS secret, you need an AWS IAM principal (for example, a role or user) with the permissions to be given to users. That IAM principal will serve as the user for each individual connection, with access tokens that will last for 15 minutes.

The AWS IAM principal must be part of the aws-auth ConfigMap that is used for authorization to the Kubernetes cluster (learn more about using the aws-auth ConfigMap). The Kubernetes role to which the AWS IAM principal in the aws-auth ConfigMap is bound will be the same Kubernetes role that tokens generated by the Amazon EKS Dynamic Secret will get.

The AWS IAM principal must have at least the following ClusterRoleBinding in the underlying Kubernetes RBAC:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: my-cluster-role-binding
subjects:
  - kind: Group
    name: my-group-name
    apiGroup: rbac.authorization.k8s.io
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: system:auth-delegator

For more information about Kubernetes RBAC, see the Kubernetes documentation.

Create an Amazon EKS Dynamic Secret with the CLI

To create an Amazon EKS Dynamic Secret with the CLI using an existing Target, run the following command:

akeyless dynamic-secret create eks \
--name <Dynamic Secret Name> \
--target-name <Target Name> \
--gateway-url 'https://<Your-Akeyless-GW-URL>:8000' \
--eks-assume-role <Role ARN>

Where:

• name: A unique name of the dynamic secret. The name can include the path to the virtual folder where you want to create the new dynamic secret, using slash / separators. If the folder does not exist, it will be created together with the dynamic secret.

• target-name: A name of the target that enables connection to the Amazon EKS cluster. The name can include the path to the virtual folder where this target resides.

• gateway-url: Akeyless Gateway URL (port 8000).

• eks-assume-role: The role to assume when connecting to the Amazon EKS cluster with provided credentials.

You can find the complete list of parameters for this command in the CLI Reference - Dynamic Secrets section.

Use the Amazon EKS Dynamic Secret With the Akeyless CLI

If the Akeyless CLI is installed on the same host as the kubectl, you can define a kubeconfig file to automatically run the get-dynamic-secret-value command and fetch new access tokens as required.

You need to either download the kubeconfig file directly from the Akeyless Console by selecting the Dynamic Secret item and copying the file from the Dynamic Secret Description, or generate the file manually as follows:

apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: <base 64 encoding of the cluster's certificate>
    server: <cluster DNS/IP address>
  name: <cluster name>
contexts:
- context:
    cluster: <cluster name>
    user: <some user name>
  name: <cluster context name>
current-context: <cluster context name>
kind: Config
preferences: {}
users:
- name: <some user name>
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1
      args:
        - get-dynamic-secret-value
        - --name
        - <dynamic secret item name>
        - --profile
        - <some profile> 
      command: akeyless
      interactiveMode: IfAvailable

For every new Amazon EKS cluster, you must update the kubeconfig file accordingly.

When you run kubectl, the Akeyless get-dynamic-secret-value command will fetch a new access token for you.

For more information regarding kubectl and the kubeconfig file, see the kubectl installation manual.

Use an Amazon EKS Dynamic Secret With the Akeyless CLI Running on a Remote Host

If the Akeyless CLI is installed on a different host as the kubectl, you can get a service account token from Akeyless separately, and then manually update the kubeconfig file that uses the token.

First, let's generate the kubeconfig file manually as described above, with the following change:

users:
- name: <some user name>
  user:
    token: < Dynamic Secret Value goes here >

To get the Amazon EKS Dynamic Secret value with the CLI, you should run the following command:

akeyless dynamic-secret get-value --name <Path to the dynamic secret>

Then on the kubeconfig you need to replace the <Dynamic Secret Value goes here > with the response token exactly as you received it.