Komiser EKS cluster deployment with multiple AWS account access
Tags: deployment, tutorial, cloud
Published: 2022-11-28 13:06:21

Have you tested Komiser locally and would like to take the next step and deploy it to a Kubernetes cluster?

Follow the steps below to launch a Komiser deployment that authenticates to various AWS accounts in a safe and compliant way by leveraging the EKS authentication method via [OIDC identity providers](https://docs.aws.amazon.com/eks/latest/userguide/authenticate-oidc-identity-provider.html).

In this tutorial we will take steps to deploy Komiser to an **EKS** cluster and allow it to access resources in another **AWS account** (as well as in the resources of the AWS account where the Komiser is running in).

The two example clusters are **ADMIN** (Komiser will be deployed here) and **DEV**.

> _Note: all code snippets in the article can be found_ [_here_](https://docs.komiser.io/docs/Cloud%20Providers/aws#multiple-account-eks-helm-chart-installation)_._

## Solution diagram:

![Two accounts diagram](https://miro.medium.com/max/1400/1*9aU6AR5sy_i1LS-sKfYpcw.png)

## 1 — Create an IAM OIDC provider for your ADMIN cluster

-   Open the Amazon [EKS console.](https://console.aws.amazon.com/eks/home#/clusters)
-   Select the name of your cluster.
-   In the **Details** section on the **Overview** tab, note the value of the **OpenID Connect provider URL**.
-   Open the [IAM console](https://console.aws.amazon.com/iam/).
-   In the left navigation pane, choose **Identity Providers** under **Access management**. If a **Provider** is listed that matches the URL for your cluster, then you already have a provider for your cluster. If a provider isn’t listed that matches the URL for your cluster, then you must create one.

![IAM identity provider window](https://miro.medium.com/max/1400/1*JlT48ESA8QVhiBRRmii_5Q.png)

-   To create a provider, choose **Add Provider**.
-   For **Provider Type**, choose **OpenID Connect**.
-   For the **Provider URL**, paste the OIDC issuer URL for your cluster, and then choose **Get thumbprint**.
-   For **Audience**, enter sts.amazonaws.com and choose **Add provider**.

## 2 — Register the ADMIN OIDC provider in the DEV cluster

-   Grab the **OpenID Connect provider URL** from the **ADMIN** account.
-   Open the [IAM console.](https://console.aws.amazon.com/iam/)
-   In the left navigation pane, choose **Identity Providers** under **Access management**.
-   To create a provider, choose **Add Provider**.
-   For **Provider Type**, choose **OpenID Connect**.
-   For **Provider URL**, paste the ADMIN OIDC issuer URL, and then choose **Get thumbprint**.
-   For **Audience**, enter sts.amazonaws.com and choose **Add provider**.

## 3 — Create an ADMIN IAM roleOpen the [IAM console](https://console.aws.amazon.com/iam/).

1.  Open the [IAM console](https://us-east-1.console.aws.amazon.com/iam/?region=us-east-1#)
2.  In the left navigation pane, choose **Policies** and then choose **Create policy**.
3.  Choose the **JSON** tab.
4.  In the **Policy Document** field, paste the Komiser recommended [policy](https://github.com/mlabouardy/komiser/blob/master/policy.json).
5.  Choose **Review policy**.
6.  Enter a name and description for your policy and then choose **Create policy**.
7.  Record the Amazon Resource Name (ARN) of the policy to use later when you create your role.
8.  Generate the trust relationship with the Dev Account
9.  We will need to have a trust policy to attach to the role so in your terminal run the following script

![Admin/Dev account trust relationship](https://miro.medium.com/max/1400/1*bQ78qwga9qtpkTxyXl9LiA.png)

> _NOTE: Make sure to substitute ${NAMESPACE} for the namespace you will deploy the helm chart in. If deployed in any other namespace, you will see sts:AssumeRoleWithWebIdentity failure messages in the pod logs._

-   Run the modified code block from the previous step to create a file named _trust.json._
-   Run the following AWS CLI command to create the role. Replace “my-iam-role” with a name for your IAM role, and “my-role-description” with a description for your role.

![Create role command](https://miro.medium.com/max/1400/1*YkdeLjUTXND0BivvXD4V-A.png)

-   Run the following command to attach an IAM policy to your role. Replace “my-iam-role” with the name of your IAM role, 111122223333 with your account ID (or with **aws**, if you’re attaching an AWS managed policy), and my-iam-policy with the name of an existing policy that you created or an IAM AWS managed policy.

![Attach IAM role command](https://miro.medium.com/max/1400/1*Jglyq8HpPs8aGiED5sE8Jg.png)

## 4 — CREATE A DEV IAM role

-   Same as in step 3 but in the Dev account.
-   Add the recommended Komiser [policy](https://github.com/mlabouardy/komiser/blob/master/policy.json)
-   Create a Trust Relationship with the ADMIN role

## 5 — Add the ADMIN role to the ServiceAccount

![Komiser service account manifest](https://miro.medium.com/max/1400/1*s-qqO8khwoWCxqqyiDOGJQ.png)

## 6 — Add a ConfigMap to the /templates folder

-   Create a ConfigMap manifest file with the profile credentials data for each account.
-   Add the configmap.yaml file to the /templates folder in the root of the repository.

![Komiser configMap manifest](https://miro.medium.com/max/1400/1*7XYIT5JQbekXQOYtGRwtFA.png)

## 7- Mount the ConfigMap to the Deployment manifest

-   Mount the ConfigMap onto the deployment in order to be able to load the pod with the requisite AWS credentials
-   Make sure not to change the mount path or internal volume path, paths should match the example below.
-   Add the command: \[“ — multiple”\] to the container to allow a multi account setup

![Komiser deployment manifest](https://miro.medium.com/max/1400/1*lla6kGNJABwnUa57RmCj4g.png)

**Deploy the helm chart:**

![Helm install command](https://miro.medium.com/max/1042/1*mvs94untawg8MOlUdsTTLA.png)

You should be good to go! Try accessing the endpoint which is exposed by the service.

**Check out the tutorial video below which goes through each step:**

[https://www.youtube.com/watch?v=pYfjHKM1gzw](https://www.youtube.com/watch?v=pYfjHKM1gzw)

Regardless if you are a Developer, DevOps, or Cloud engineer. Dealing with the cloud can be tough at times, especially on your own. If you are using Tailwarden or Komiser and want to share your thoughts doubts and insights with other cloud practitioners feel free to join our [Tailwarden discord server](https://discord.oraculi.io/). Where you will find tips, community calls, and much more.