Loft vcluster support for IRSA on top of EKS

0

Hi everyone,

We are currently studying the use of vcluster https://www.vcluster.com/ on top of our EKS clusters to provide self-service Kubernetes clusters for dev teams, Our backend microservices use IRSA to access AWS resources such as RDS, Secrets, Parameters, SES ... My question is, is it possible to get use of AWS IRSA from within a virtual cluster (vcluster)

I really appreciate any help you can provide.

feita há um ano673 visualizações
1 Resposta
0

Good Day!

Thanks for connecting with us at re:Post.

As per your notes, I can understand that you wish to connect virtual cluster with other AWS Services such as RDS, SES etc. within the same. Please correct me if I have misunderstood your concern.

Please note, as vcluster is a 3rd party tool, hereby I will able to respond at my best-efforts what I found via their resources and AWS integration possibilities with it.

As test-replicated the vcluster at my end before replying you here, I found that vcluster itself is limited to a single namespace on a host cluster (let's say EKS Cluster A). When being created, it creates below resources:

serviceaccount/vc-my-vcluster | serviceaccount/vc-workload-my-vcluster | configmap/my-vcluster-coredns | configmap/my-vcluster-init-manifests | role.rbac.authorization.k8s.io/my-vcluster | rolebinding.rbac.authorization.k8s.io/my-vcluster | service/my-vcluster | service/my-vcluster-headless | statefulset.apps/my-vcluster

Post-checking the RBAC permissions and architecture of vcluster > It's clear that permissions need to be routed via host cluster only. As mentioned already, vcluster is out of expertise for us, a best approach is to reach vcluster team by creating issue [1]. If you think there can be a follow-up required at AWS End, please feel free to create case from the account where you have the host cluster at [2].

Thanks for your understanding & cooperation! Have an AWSome Day Ahead & Stay Safe!

References:

[1] https://github.com/loft-sh/vcluster/issues

[2] https://aws.amazon.com/contact-us/

profile pictureAWS
ENGENHEIRO DE SUPORTE
respondido há um ano

Você não está conectado. Fazer login para postar uma resposta.

Uma boa resposta responde claramente à pergunta, dá feedback construtivo e incentiva o crescimento profissional de quem perguntou.

Diretrizes para responder a perguntas