如何使用 GithubAction 和 OIDC 在 EKS 上部署 atefact

Question

I have a private EKS cluster and I'm trying to deploy some services on it using GithubActions. It works ok when I pass account credentials as a secret, and kubeconfig file as well. Like this:

name: Release

on:
  pull_request:
    branches: [main]

env:
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2

      - name: AWS Credentials
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: eu-central-1

      - name: helm deploy
        uses: koslib/helm-eks-action@master
        env:
          KUBE_CONFIG_DATA: ${{ secrets.KUBE_CONFIG_DATA }}
        with:
          command: helm upgrade <release name> --install --wait <chart> -f <path to values.yaml>

But I think it would be better if I can use OCID for that CI/CD and then fetch kubeconfig file as

aws eks update-kubeconfig --name <cluster>

And role to implement OIDC connection looks like

resource "aws_iam_openid_connect_provider" "github" {
  url             = "https://token.actions.githubusercontent.com"
  client_id_list  = ["sts.amazonaws.com"]
  thumbprint_list = ["a031c46782e6e6c662c2c87c76da9aa62ccabd8e"]
}

data "aws_iam_policy_document" "github_actions_assume_role" {
  statement {
    actions = ["sts:AssumeRoleWithWebIdentity"]
    principals {
      type        = "Federated"
      identifiers = [var.openid_connect_provider.arn]
    }
    condition {
      test     = "StringLike"
      variable = "token.actions.githubusercontent.com:sub"
      values   = ["repo:${var.organization}/${var.name}:*"]
    }
  }
}

Unfoutantly when I configure role I have no idea how I can attach it to service account to be able to install helm chart

Answer 1

我认为更好的方法是在您的 k8s 集群中部署一个自托管运行器，并使用 OIDC 向运行器 pod 授予必要的权限

Answer 2

Assuming the role name is arn:aws:iam::XXXX:role/github-oidc-provider-aws and Trust relationships set as well on that role

    {
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::XXXXXX:oidc-provider/token.actions.githubusercontent.com"
            },
            "Action": "sts:AssumeRoleWithWebIdentity",
            "Condition": {
                "StringLike": {
                    "token.actions.githubusercontent.com:sub": "repo:GithubOrg/reposiotry-name:ref:refs/heads/main"
                }
            }
        }
    ]
}

As well as identity providers set and works fine.

What do need to be set on EKS. AWS auth should be changed

  - rolearn: arn:aws:iam::XXXX:role/github-oidc-provider-aws
  username: github-action
  groups:
    - system:masters

Make sure you do not use system:masters but some other group created just for this access.

As well as EKS do require kubernetes-sigs/aws-iam-authenticator in the PATH