Open1
eksのaccessentry周り
awscli
# API併用モードに変更
aws eks update-cluster-config --name terraform-eks-example --access-config authenticationMode=API_AND_CONFIG_MAP
# アクセスエントリ作成
aws eks create-access-entry \
--cluster-name terraform-eks-example \
--principal-arn arn:aws:iam::xxxx:user/test \
--type STANDARD \
--username test
# アクセスポリシーの紐付け
aws eks associate-access-policy \
--cluster-name terraform-eks-example \
--principal-arn arn:aws:iam::xxx:user/test \
--access-scope type=namespace,namespaces=default \
--policy-arn arn:aws:eks::aws:cluster-access-policy/AmazonEKSViewPolicy
default namespaceが閲覧でき、それ以外が閲覧出来なければOK
$ k get pod -n default
No resources found in default namespace.
$ k get pod -n kube-system
Error from server (Forbidden): pods is forbidden: User "test" cannot list resource "pods" in API group "" in the namespace "kube-system"