You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+10-5Lines changed: 10 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -69,16 +69,21 @@ In order to fetch and store secrets in the AWS Secrets Manager, the user must pr
69
69
70
70
#### Set up Cloud Backup With AWS Secret Manager
71
71
72
-
The `secret-agent` expects credentials to be discoverable via standard [AWS mechanisms](https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials). These credentials can be provided in a number of ways, for example:
72
+
The `secret-agent` expects credentials to be discoverable via standard [AWS mechanisms](https://aws.github.io/aws-sdk-go-v2/docs/configuring-sdk/#specifying-credentials). These credentials can be provided in a number of ways as per the link.
However, when running inside AWS the _preferred_ method should be to attach a serviceAccount to the deployment with properly scope policies on the role.
-_AWS_WEB_IDENTITY_TOKEN_FILE_ -> this will be handled by the IAM controller for each deployment correctly set up annotations on the serviceAccount.
75
79
* Shared Credentials file: _~/.aws/credentials_
76
-
* Shared Configuration file: _(~/.aws/config_
77
-
* EC2 Instance Metadata (preferred): _Obtains credentials from 169.254.169.254_
80
+
* Shared Configuration file: _~/.aws/config_
81
+
* EC2 Instance Metadata_v2: _Obtains credentials from 169.254.169.254_
82
+
- This is not ideal as all the pods on the node will have access to the same policy, _this_ may not be a desired outcome if topologySkew are not properly segragating workloads across different nodes/node pools.
78
83
79
84
Refer to [AWS documentation](https://docs.aws.amazon.com/secretsmanager/latest/userguide/auth-and-access_overview.html) for instructions on how to obtain credentials and grant necessary permissions to access the AWS Secrets Manager. The `secret-agent` needs to access read/write secrets. This can be achieved by allowing access to the `arn:aws:iam::aws:policy/SecretsManagerReadWrite` AWS managed policy.
80
85
81
-
Even though the recommended way to obtain credentials is to use the EC2 Instance Metadata service, it is possible to provide custom credentials via a Kubernetes secret. The secret reference is provided in the SAC in `spec.appConfig.credentialsSecretName`. In the default `secret-agent` deployment, the user is expected to publish the cloud credentials' secret in the same namespace as the operator. This target namespace can be changed by changing the runtime argument `--cloud-secrets-namespace=[NS_NAME]` located in the operator's [manifest](/config/manager/manager.yaml). If this argument is omitted completely, the namespace will default to the namespace of each SAC.
86
+
When running outside of AWS environments it is possible to provide custom credentials via a Kubernetes secret. The secret reference is provided in the SAC in `spec.appConfig.credentialsSecretName`. In the default `secret-agent` deployment, the user is expected to publish the cloud credentials' secret in the same namespace as the operator. This target namespace can be changed by changing the runtime argument `--cloud-secrets-namespace=[NS_NAME]` located in the operator's [manifest](/config/manager/manager.yaml). If this argument is omitted completely, the namespace will default to the namespace of each SAC.
82
87
83
88
Once these credentials are posted to a Kubernetes secret, the next step is to configure the AWS Secret Manager using the `SecretAgentConfiguration`.
description: 'APIVersion defines the versioned schema of this representation
52
-
of an object. Servers should convert recognized schemas to the latest
53
-
internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
49
+
description: |-
50
+
APIVersion defines the versioned schema of this representation of an object.
51
+
Servers should convert recognized schemas to the latest internal value, and
52
+
may reject unrecognized values.
53
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
54
54
type: string
55
55
kind:
56
-
description: 'Kind is a string value representing the REST resource this
57
-
object represents. Servers may infer this from the endpoint the client
58
-
submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
56
+
description: |-
57
+
Kind is a string value representing the REST resource this object represents.
58
+
Servers may infer this from the endpoint the client submits requests to.
59
+
Cannot be updated.
60
+
In CamelCase.
61
+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
0 commit comments