Integrate with EKS

​​

With Elastic Kubernetes Service (EKS) on AWS, EKS simplifies the management complexities of Kubernetes.

Through this integration, Apono helps you securely manage access to your AWS Elastic Kubernetes cluster.​

Prerequisites

​

Configure user authentication

Authentication can be completed with an Identity and Access Management IAM user or an IAM role. To grant a user access to an EKS cluster, the IAM user or IAM role must be mapped with a specific user identifier, such as an email address.Apono supports this mapping with an IAM role through AWS SSO or SAML federation from any identity provider (IdP).​

Create a new policy

Follow these steps to create a new policy:

1. Under Access management on the Identity and Access Management (IAM) page in AWS, click Policies > Create policy. The Specify permission page appears.

2. Click JSON.

3. Replace the default policy with the following policy. Be sure to replace the placeholder.

   Copy

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": "eks:DescribeCluster",
               "Resource": "arn:aws:eks:*:<AWS_ACCOUNT_ID>:cluster/*"
           }
       ]
   }

   Placeholder

   Description

   <AWS_ACCOUNT_ID>

   AWS account ID where the EKS is hosted

4. Click Next. The Review and create page appears.

5. Enter a Policy name. This name is used to identify this policy.

6. Click Create policy.

​

Create the IAM role

Follow these steps to create the IAM role:

1. Under Access management on the Identity and Access Management (IAM) page in AWS, click Roles > Create role. The Select trusted entity page appears.

2. Under Trusted entity type, select Custom trust policy.

3. Under Custom trust policy, replace the default policy with one of the following trust policies. Be sure to replace the placeholders.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEqualsIgnoreCase": {
                    "sts:RoleSessionName": "${SAML:sub}"
                },
                "ArnLike": {
                    "aws:PrincipalArn": [
                        "arn:aws:iam::<AWS_ACCOUNT_ID>:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_*",
                        "arn:aws:iam::<AWS_ACCOUNT_ID>:role/aws-reserved/sso.amazonaws.com/*/AWSReservedSSO_*"
                    ]
                }
            }
        }
    ]
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "Federated": "arn:aws:iam::<AWS_ACCOUNT_ID>:saml-provider/<SAML_PROVIDER>"
            },
            "Action": "sts:AssumeRoleWithSAML",
            "Condition": {
                "StringEquals": {
                    "SAML:aud": "https://signin.aws.amazon.com/saml"
                }
            }
        }
    ]
}

1. Click Next. The Add permissions page appears.

2. Under Permissions policies, select the newly created policy.

3. Click Next. The Name, review, and create page appears.

4. For the Role name, enter apono-k8s-access.

5. For the Description, enter required for k8s access managed by Apono.

6. Click Create role.

Authenticate the EKS cluster

Now that the IAM role has been created, you must authenticate the EKS cluster with the ConfigMap or EKS API.

Now, you can integrate with EKS.

Integrate with Elastic Kubernetes Service (EKS)

Follow these steps to complete the integration:

1. On the Catalog tab, click Elastic Kubernetes Service (EKS). The Connect Integration page appears.

2. Under Discovery, click one or more resource types to sync with Apono.

1. Click Next. The Apono connector section appears.

2. From the dropdown menu, select a connector.

1. Click Next. The Integration Config section expands.

2. Define the Integration Config settings.

1. Click Next. The Secret Store section expands.

1. (Optional) Associate the secret or credentials.

2. Click Next. The Get more with Apono section expands.

3. Define the Get more with Apono settings.

   Setting

   Description

   Custom Access Details

   (Optional) Instructions explaining how to access this integration's resources Upon accessing an integration, a message with these instructions will be displayed to end users in the User Portal. The message may include up to 400 characters. To view the message as it appears to end users, click Preview.

   Integration Owner

   1. From the Attribute dropdown menu, select User or Group under the relevant identity provider (IdP) platform.

   2. From the Value dropdown menu, select one or multiple users or groups.

   NOTE: When Resource Owner is defined, an Integration Owner must be defined.

   Resource Owner

   1. Enter a Key name. This value is the name of the tag created in your cloud environment.

   2. From the Attribute dropdown menu, select an attribute under the IdP platform to which the key name is associated. Apono will use the value associated with the key (tag) to identify the resource owner. When you update the membership of the group or role in your IdP platform, this change is also reflected in Apono.

   NOTE: When this setting is defined, an Integration Owner must also be defined.

4. Click Confirm.

Now that you have completed this integration, you can create access flows that grant permission to your Elastic Kubernetes Service cluster.

Log in to EKS with Apono access details

After a user gains access to an EKS resource, the user must authenticate with the cluster. The user must assume the apono-k8s-access role.

The following table shows two approaches to assume this role.