The post covers the transition from IRSA with OIDC to EKS Pod Identities for managing IAM access in a new EKS cluster. It highlights the challenges faced when using Kubernetes Secrets Store CSI Driver to sync AWS Secrets Manager with Kubernetes Secrets, specifically the IAM role association issue. A solution using External
Table of contents
AWS: Kubernetes and External Secrets Operator for AWS Secrets ManagerThe problem: Kubernetes Secrets Store CSI Driver and “An IAM role must be associated with service account”External Secrets Operator: an overviewInstalling External Secrets Operator with HelmAuthentication with AWS IAMCreating an IAM PolicyCreating an IAM Role for EKS Pod IdentityCreating an EKS Pod Identity AssociationCreating a Kubernetes Secrets from AWS Secrets ManagerCreating a SecretStoreCreating an ExternalSecretAdvanced IAM Permissions per SecretStoreConclusionsSort: