Open1

eksのaccessentry周り

not75743not75743

awscli

# API併用モードに変更
aws eks update-cluster-config --name terraform-eks-example --access-config authenticationMode=API_AND_CONFIG_MAP

# アクセスエントリ作成
aws eks create-access-entry \
--cluster-name terraform-eks-example \
--principal-arn arn:aws:iam::xxxx:user/test \
--type STANDARD \
--username test

# アクセスポリシーの紐付け
aws eks associate-access-policy \
--cluster-name terraform-eks-example \
--principal-arn arn:aws:iam::xxx:user/test \
--access-scope type=namespace,namespaces=default \
--policy-arn arn:aws:eks::aws:cluster-access-policy/AmazonEKSViewPolicy

default namespaceが閲覧でき、それ以外が閲覧出来なければOK

$ k get pod -n default
No resources found in default namespace.

$ k get pod -n kube-system
Error from server (Forbidden): pods is forbidden: User "test" cannot list resource "pods" in API group "" in the namespace "kube-system"