Is an OIDC provider required to use the EBS CSI driver with EKS?

1

The EKS documentation for EBS CSI driver says ...

Prerequisites

  • An existing cluster.

    • 1.20 requires eks.3 or later.
    • 1.21 requires eks.3 or later.
  • An existing AWS Identity and Access Management (IAM) OpenID Connect (OIDC) provider for your cluster. To determine whether you already have one, or to create one, see Creating an IAM OIDC provider for your cluster.

Is an OIDC provider required to use the EBS CSI driver with EKS? We would prefer to not use OIDC with EKS when using the EBS CSI driver. If it is not required, what is the updated procedure?

Thanks Ken

gefragt vor einem Jahr790 Aufrufe
2 Antworten
0

Amazon EKS uses IAM to provide authentication to your Kubernetes cluster, OIDC provider is just an additional option. It's not required for EBS CSI driver to work.

profile picture
beantwortet vor einem Jahr
0

Yes, an OIDC provider is one of the pre-requisite for using Amazon EBS CSI driver with EKS. You can check all the other pre-requisites in the Prerequisites section of this document.

Why is it a must requirement?

  • When we create an EKS cluster, an OIDC issuer URL is associated with it.
  • By default, the EBS CSI driver is configured to use IAM roles to service accounts (ISRA), where the EBS CSI driver pods use service account tokens to access IAM credentials.
  • To use ISRA, an IAM OIDC provider must exist for your cluster's OIDC issuer as mentioned here. This makes creating an OIDC provider a must requirement to use Amazon EBS with EKS cluster.

Also be it Amazon EBS or Amazon EFS Driver, both the drivers use IAM Roles for Service Account(ISRA), so OIDC must exist for the EKS cluster to use ISRA.

profile pictureAWS
beantwortet vor einem Jahr
profile picture
EXPERTE
überprüft vor 9 Monaten

Du bist nicht angemeldet. Anmelden um eine Antwort zu veröffentlichen.

Eine gute Antwort beantwortet die Frage klar, gibt konstruktives Feedback und fördert die berufliche Weiterentwicklung des Fragenstellers.

Richtlinien für die Beantwortung von Fragen