Actions-runner-controller: Using EKS IAM role for service accounts within container

[dudicoco]

Hi,

How can the IRSA IAM role be used within a job's container step?

jobs:
  build:
    runs-on: self-hosted
    steps:
      - uses: actions/checkout@v2

      - name: Run AWS CLI command
        uses: docker://amazon/aws-cli:2.0.6
        with:
          args: ec2 describe-network-interfaces --region us-east-1

[mumoshu]

@dudicoco Hey! Please try these steps.

[dudicoco]

Thanks @mumoshu. I've already followed these steps and was able to use the role for normal steps, i'm referring specifically to steps which run on a docker container, note the uses: docker://amazon/aws-cli:2.0.6 in my example on the first comment.

[mumoshu]

@dudicoco Ah gotcha!

Theoretically speaking, you'd neet to set AWS_ROLE_ARN=arn:aws:iam::<AWS_ACCOUNT_ID>:role/<IAM_ROLE_NAME>, AWS_WEB_IDENTITY_TOKEN_FILE=/var/run/secrets/eks.amazonaws.com/serviceaccount/token as provided by IRSA and mount host's /var/run/secrets onto the container's /var/run/secrets.

But I wonder if volume mounts are supported by the docker triggered via uses.

[mumoshu]

I think that it worth trying to run docker run instead of uses, like:

run: |
  docker run -v /var/run/secrets:/var/run/secrets -e AWS_ROLE_ARN -e AWS_WEB_IDENTITY_TOKEN_FILE ... amazon/aws-cli:2.0.6 $YOUR_ARGS

[dudicoco]

Thanks @mumoshu!
I assumed I would need to pass these to the container, was hoping that there was a more efficient way :)
The docker run command worked for me.
uses is pretty useless here because it can't access the runner's environment variables.

[kuperiu]

This works for me

jobs:
  example1:
    runs-on: eks-docker
    container:
      image: amazon/aws-cli:latest
      env:
        AWS_WEB_IDENTITY_TOKEN_FILE: /var/run/secrets/eks.amazonaws.com/serviceaccount/token
        AWS_ROLE_ARN: arn:aws:iam::xxxx:role/gh-runner
      volumes:
        - /var/run/secrets/eks.amazonaws.com/serviceaccount/token:/var/run/secrets/eks.amazonaws.com/serviceaccount/token
    steps:
        - run: aws sts get-caller-identity
        - run: aws s3 ls

[dudicoco]

@kuperiu thanks, I wondered if perhaps using container instead of uses would work.
Were you able to use environment variables from the runner ( AWS_WEB_IDENTITY_TOKEN_FILE: ${AWS_WEB_IDENTITY_TOKEN_FILE} ) ?

[kuperiu]

no as you can see from the example i had to pass it on.
i didn't find a way to do it globally, but this works good enough because i was able to use the jwt token.

[mumoshu]

@kuperiu Awesome! Thanks for sharing your insight 👍

Would you mind if I added some explanation and a link to the info in our README?

[kuperiu]

Go aheahd