AWS EKS Cluster에 AWS SSO 권한 추가 하기

Intro

AWS SSO를 사용할 경우 AWS EKS Cluster에 권한을 추가하는 방법에 대해 알아보도록 하겠습니다.
아래 예시는 싱가폴리전(ap-southeast-1)에 AWS SSO가 생성되어있고, 서울리전(ap-northeast-2)에 AWS EKS가 생성되어있는 예시입니다.

AWS SSO에 의해 생성된 IAM Role arn 확인

arn:aws:iam::123456789012:role/aws-reserved/sso.amazonaws.com/ap-southeast-1/AWSReservedSSO_AdministratorAccess_2c28b84fdf3ff678

Kubernetes Config Map aws-auth 설정

위에서 확인한 Arn에서 sso.amazonaws.com/ap-southeast-1/ 부분을 제외하고 아래와 같이 role을 추가
kubectl edit cm aws-auth -n kube-system

mapRoles: | 
 - groups:
    - system:masters
    rolearn: arn:aws:iam::123456789012:role/AWSReservedSSO_AdministratorAccess_2c28b84fdf3ff678
   username: readaccess:{{SessionName}}

~/.aws/config 설정

[profile EKSAdmin]
aws_access_key_id=ASIAUBH7DZ3KI....
aws_secret_access_key=PKDoOPefgIRPvaGor+...
aws_session_token=IQoJb3JpZ2luX2VjECAaCX...

~/.kube/config 설정

users:
- name: arn:aws:eks:ap-northeast-2:123456789012:cluster/eksworkshop-eksctl
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1alpha1
      args:
      - --region
      - ap-northeast-2
      - eks
      - get-token
      - --cluster-name
      - eksworkshop-eksctl
      - --role-arn
      - arn:aws:iam::123456789012:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_AdministratorAccess_2c28b84fdf3ff678
      env:
      - name: AWS_PROFILE
        value: "EKSAdmin"
      command: aws