Kubernetes

Kubernetes #

This document provides how we are using kubernetes as our app orchestration.

Accessing EKS via kubectl #

Prerequisite #

Steps #

  1. Configure AWS CLI profile via SSO
$ aws configure sso

This command will prompt you to provide following variables.

  • SSO session name: Can be anything
  • SSO start URL: Must be https://tofu-bonsai.awsapps.com/start
  • SSO region: Must be eu-central-1
  • SSO registration scopes: Choose default (sso:account:access)
  • role name: If you are assigned to multiple accounts, or have multiple roles, you are prompted to choose one. See About roles section below for detail.
  • Default client Region: Must be eu-central-1
  • CLI default output format: Anything you want. json should be fine.
  • Profile name: Profile name you are going to use in your local machine. You might want a name that is shorter than the default.
  1. Verify your configuration
$ aws sts get-caller-identity --profile <profile name you chose above>

If the command above prints something like following, your profile was configured successfully.

{
    "UserId": "XXXXXXXXXXXXXXXX:dummy@gotofu.com",
	"Account": "123456789012",
    "Arn": "arn:aws:sts::123456789012:assumed-role/AWSReservedSSO_XXX_YYYYY/dummy@gotofu.com"
}
  1. Delete old configuration (Only if you already have a config with old IAM user)
$ kubectl config delete-context arn:aws:eks:eu-central-1:<AWS Account ID>:cluster/bonsai-app-eks-cluster-<dev or prod>
  1. Get kubectl config from EKS
$ aws eks update-kubeconfig --region eu-central-1 --name bonsai-app-eks-cluster-<dev or prod> --profile <profile name>
  1. Test

You should be able to use kubectl to work with our EKS cluster. Let’s test if you really can.

$ kubectl get pod

If you see list of running pods. You are with this section.

About roles #

We are using AWS IAM Identity Center with SSO to login to AWS. Each user is assigned to one (or more) following role:

  • full_access
  • bonsai_developers
  • Billing

Users with full_access role can access both production and dev, but only dev for bonsai_developers.