Project: Capsule (Orchestration & Management / Scheduling & Orchestration)
File: aws-eks.md

This is an example of how to install AWS EKS cluster and one user manged by Capsule. It is based on Create EKS cluster: ```bash export AWSDEFAULTREGION="eu-west-1" export AWSACCESSKEY_ID="xxxxx" export AWSSECRETACCESS_KEY="xxxxx" eksctl create cluster \ --name=test-k8s \ --managed \ --node-type=t3.small \ --node-volume-size=20 \ --kubeconfig=kubeconfig.conf ``` Create AWS User `alice` using CloudFormation, create AWS access files and kubeconfig for such user: ```bash cat > cf.yml << EOF Parameters: ClusterName: Type: String Resources: UserAlice: Type: AWS::IAM::User Properties: UserName: !Sub "alice-${ClusterName}" Policies: PolicyName: !Sub "alice-${ClusterName}-policy" PolicyDocument: Version: "2012-10-17" Statement: Sid: AllowAssumeOrganizationAccountRole Effect: Allow Action: sts:AssumeRole Resource: !GetAtt RoleAlice.Arn AccessKeyAlice: Type: AWS::IAM::AccessKey Properties: UserName: !Ref UserAlice RoleAlice: Type: AWS::IAM::Role Properties: Description: !Sub "IAM role for the alice-${ClusterName} user" RoleName: !Sub "alice-${ClusterName}" AssumeRolePolicyDocument: Version: 2012-10-17 Statement: Effect: Allow Principal: AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root" Action: sts:AssumeRole Outputs: RoleAliceArn: Description: The ARN of the Alice IAM Role Value: !GetAtt RoleAlice.Arn Export: Name: Fn::Sub: "${AWS::StackName}-RoleAliceArn" AccessKeyAlice: Description: The AccessKey for Alice user Value: !Ref AccessKeyAlice Export: Name: Fn::Sub: "${AWS::StackName}-AccessKeyAlice" SecretAccessKeyAlice: Description: The SecretAccessKey for Alice user Value: !GetAtt AccessKeyAlice.SecretAccessKey Export: Name: Fn::Sub: "${AWS::StackName}-SecretAccessKeyAlice" EOF eval aws cloudformation deploy --capabilities CAPABILITYNAMEDIAM \ --parameter-overrides "ClusterName=test-k8s" \ --stack-name "test-k8s-users" --template-file cf.yml AWSCLOUDFORMATIONDETAILS=$(aws cloudformation describe-stacks --stack-name "test-k8s-users") ALICEROLEARN=$(echo "${AWSCLOUDFORMATIONDETAILS}" | jq -r ".Stacks[0].Outputs[] | select(.OutputKey==\"RoleAliceArn\") .OutputValue") ALICEUSERACCESSKEY=$(echo "${AWSCLOUDFORMATIONDETAILS}" | jq -r ".Stacks[0].Outputs[] | select(.OutputKey==\"AccessKeyAlice\") .OutputValue") ALICEUSERSECRETACCESSKEY=$(echo "${AWSCLOUDFORMATIONDETAILS}" | jq -r ".Stacks[0].Outputs[] | select(.OutputKey==\"SecretAccessKeyAlice\") .OutputValue") eksctl create iamidentitymapping --cluster="test-k8s" --arn="${ALICEROLEARN}" --username alice --group capsule.clastix.io cat > aws_config << EOF [profile alice] rolearn=${ALICEROLE_ARN} source_profile=alice EOF cat > aws_credentials << EOF [alice] awsaccesskeyid=${ALICEUSER_ACCESSKEY} awssecretaccesskey=${ALICEUSER_SECRETACCESSKEY} EOF eksctl utils write-kubeconfig --cluster=test-k8s --kubeconfig="kubeconfig-alice.conf" cat >> kubeconfig-alice.conf << EOF name: AWS_PROFILE value: alice name: AWSCONFIGFILE value: aws_config name: AWSSHAREDCREDENTIALS_FILE value: aws_credentials EOF ``` Export "admin" kubeconfig to be able to install Capsule: ```bash export KUBECONFIG=kubeconfig.conf ``` Install capsule from helm chart: ```bash helm repo add clastix https://clastix.github.io/charts helm upgrade --install --version 0.0.19 --namespace capsule-system --create-namespace capsule clastix/capsule ``` Use the default Tenant example: ```bash kubectl apply -f https://raw.githubusercontent.com/clastix/capsule/master/config/samples/capsulev1beta1tenant.yaml ``` Based on the tenant configuration above the user `alice` should be able to create namespace. Switch to a new terminal and try to create a namespace as user `alice`: ```bash unset AWSACCESSKEY_ID unset AWSSECRETACCESS_KEY kubectl create namespace test --kubeconfig="kubeconfig-alice.conf" ```