Create a read Only cli User for EKS

Use Case: When you want to provide access to users, you must always avoid prividing admin priviledges to users. This is needed for security and audit Purpose. Kubernetes allows you to create Rbac credentials using roles and cluster roles for service accounts, users, groups.
From k8s: RBAC authorization uses the rbac.authorization.k8s.io API group to drive authorization decisions, allowing you to dynamically configure policies through the Kubernetes API.

 

1. Lets First Create the cluster role and group

Create file cluster-role-and-binding.yml

---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: eks-readonly-group-binding
subjects:
- kind: Group
  name: eks-readonly-group
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: eks-readonly-group-cluster-role
  apiGroup: rbac.authorization.k8s.io

---
kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: eks-readonly-group-cluster-role
rules:
- apiGroups:
  - ""
  resources:
  - '*'
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - extensions
  resources:
  - '*'
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - apps
  resources:
  - '*'
  verbs:
  - get
  - list
  - watch

Now Apply all the changes 

 kubectl apply -f cluster-role-and-binding.yml 

Note: This is only required once

2. Create a Iam user with the below Policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "eks:DescribeNodegroup",
                "eks:ListNodegroups",
                "eks:DescribeCluster",
                "eks:ListClusters",
                "eks:AccessKubernetesApi",
                "ssm:GetParameter",
                "eks:ListUpdates",
                "eks:ListFargateProfiles"
            ],
            "Resource": "*"
        }
    ]
}

3. Allow user access in EKS

This can be done by updating the mentioned below resource and adding the user in the group

Resource: Location: configmap/aws-auth
Namespace: kube-system
Group: eks-readonly-group

 mapUsers: |
    - userarn: arn:aws:iam::ACCOUNT_ID:user/user1
      username: user1
      groups:
        - eks-readonly-group 

4. Set up Cli access

a. Install kubectl
b. Install AWS CLI

c. Create a Accesxs key ID and Access key Secret from IAM console because it is required

AWS EKS setup on local

  # add credentials
  aws configure 
  
  # setup eks, this would show the userarn and it should be same as Step 3 config
  aws sts get-caller-identity
  
  # update region and cluster name
  aws eks --region example_region update-kubeconfig --name cluster_name
  
  # get pods using
  kubectl get pods --all-namespaces