EKS Agentless Setup
Last updated
Was this helpful?
Last updated
Was this helpful?
Sedai independently connects to each Elastic Kubernetes Service (EKS) cluster within an AWS account. EKS uses IAM for authentication and Kubernetes Role Based Access Control (RBAC) for authorization.
To connect an EKS cluster to Sedai, follow these steps:
Once complete, you can within Sedai and connect its .
AWS Identity and Access Management (IAM) authentication requires you to do the following:
Create your preferred Sedai
Create (recommended) or and attach the policy you create with Sedai's permissions.
When you create a cluster, Amazon EKS creates an endpoint for the managed Kubernetes API server that you can use to communicate with your cluster using Kubernetes management tools such as kubectl.
By default, this API server endpoint is public, and access to the API server is secured using a combination of IAM and native Kubernetes Role Based Access Control (RBAC).
You can enable private access to the Kubernetes API server so all communication between your nodes and the API server stays within your Virtual Private Cloud (VPC). You can also limit the IP addresses that can access your API server from the internet or completely disable internet access to the API server.
Depending on your organization's setup, proceed with any of the following connectivity options:
In this approach, you will establish a VPC peering connection from Sedai's environment to yours. Once the VPC peering and routing rules are in place, you can connect your EKS cluster via Private Network.
To initiate the VPC peering connection from Sedai, please contact support@sedai.io and provide the following details:
Deployment Region
Navigate to Cluster > Configurations > Networking > Cluster Security Group to edit the EKS Cluster Security Group. Add a rule to allow HTTPS connections from Sedai's Subnets.
Learn more about VPC peering:
Confirm kubectl access to your cluster and apply the following ClusterRole and ClusterRoleBinding:
The group name in the configuration from the previous step is sedai-service-account
. Next you will map the IAM Role (or User) to this group by updating the aws-auth configMap.
Take the backup of your current ConfigMap:
Open aws-auth ConfigMap for editing:
Add the following snippet under mapUsers
Update the IAM Role ARN below (1111222233
) to your unique Role ARN you created.
Access the following details to connect your EKS cluster to Sedai. When you're done, navigate to Settings > Integrations and select the Add Cloud button. Follow the prompts to add an EKS cluster.
From your AWS Console, navigate to your EKS cluster and select Configurations to access the following details:
EKS Cluster Name
Region
Cluster URL (endpoint)
Cluster Authority Certificate
Our team will confirm with you once we initiate the VPC peering connection. Navigate to your .
Once the VPC peering is in place, and add a routing entry to flow traffic to Sedai's VPC CIDR via VPC Peering Connection.
Next, set up the Kubernetes RBAC for Authorization. Use the IAM User/Role created in .
Based on your selection, download and apply the ClusterRole and ClusterRoleBindings: