80 lines
2.5 KiB
YAML
80 lines
2.5 KiB
YAML
apiVersion: kro.run/v1alpha1
|
|
kind: ResourceGroup
|
|
metadata:
|
|
name: podidentity.kro.run
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "-5"
|
|
spec:
|
|
schema:
|
|
apiVersion: v1alpha1
|
|
kind: PodIdentity
|
|
spec:
|
|
name: string | default="pod-identity"
|
|
values:
|
|
aws:
|
|
clusterName: string
|
|
policy:
|
|
description: 'string | default="Test Description"'
|
|
path: 'string | default="/"'
|
|
policyDocument: string | default=""
|
|
piAssociation:
|
|
serviceAccount: string
|
|
piNamespace: string
|
|
status:
|
|
policyStatus: ${podpolicy.status.conditions}
|
|
roleStatus: ${podrole.status.conditions}
|
|
resources:
|
|
- id: podpolicy
|
|
readyWhen:
|
|
- ${podpolicy.status.conditions[0].status == "True"}
|
|
template:
|
|
apiVersion: iam.services.k8s.aws/v1alpha1
|
|
kind: Policy
|
|
metadata:
|
|
name: ${schema.spec.name}-pod-policy
|
|
spec:
|
|
name: ${schema.spec.name}-pod-policy
|
|
description: ${schema.spec.values.policy.description}
|
|
path: ${schema.spec.values.policy.path}
|
|
policyDocument: ${schema.spec.values.policy.policyDocument}
|
|
- id: podrole
|
|
readyWhen:
|
|
- ${podrole.status.conditions[0].status == "True"}
|
|
template:
|
|
apiVersion: iam.services.k8s.aws/v1alpha1
|
|
kind: Role
|
|
metadata:
|
|
name: ${schema.spec.name}-role
|
|
spec:
|
|
name: ${schema.spec.name}-role
|
|
policies:
|
|
- ${podpolicy.status.ackResourceMetadata.arn}
|
|
assumeRolePolicyDocument: |
|
|
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"Service": "pods.eks.amazonaws.com"
|
|
},
|
|
"Action": [
|
|
"sts:TagSession",
|
|
"sts:AssumeRole"
|
|
]
|
|
}
|
|
]
|
|
}
|
|
- id: piAssociation
|
|
readyWhen:
|
|
- ${piAssociation.status.conditions[0].status == "True"}
|
|
template:
|
|
apiVersion: eks.services.k8s.aws/v1alpha1
|
|
kind: PodIdentityAssociation
|
|
metadata:
|
|
name: ${schema.spec.name}-pod-association-${schema.spec.values.piAssociation.serviceAccount}
|
|
spec:
|
|
clusterName: ${schema.spec.values.aws.clusterName}
|
|
roleARN: ${podrole.status.ackResourceMetadata.arn}
|
|
serviceAccount: ${schema.spec.values.piAssociation.serviceAccount}
|
|
namespace: ${schema.spec.values.piAssociation.piNamespace} |