Eksctl: Config file support for iamidentitymapping

[serhatcetinkaya]

Hi all, I've been trying to use eksctl create|get|delete iamidentitymapping with -f some_file.yaml but I couldn't really figure out what to put inside the file. Can someone please document this or create some files under example directory ?

PS: You may want to merge it with https://github.com/weaveworks/eksctl/pull/932

[martina-if]

Hi @serhatcetinkaya , the config file in these commands is only used to get the cluster information, not the roles or the other iam specific parameters. This is how it works today but we will consider this for a future iteration.

[rocktavious]

@martina-if +1 for this feature it would help in bootstraping a cluster that others can talk to right away instead of just the people who have Admin in that AWS account.

[serhatcetinkaya]

Hi @martina-if , is there any update on this ?

I think it can even be included in the main config file like (another block to configure aws-auth configmap):

eksctl create cluster --config-file=<path>

[TBeijen]

Would be nice to have this in config (code as documentation).

Given how eksctl create iamidentitymapping is implemented, would something like this in the config work?

iam:
  identityMappings:
    - roleARN: arn:aws:iam::123456:role/kube-admin
      username: kube-admin
      group: system:masters
    - roleARN: arn:aws:iam::123456:role/power-users
      username: power-user
      group: my-custom-power-user-group

Something to figure out would be how eksctl should behave when removing an identityMapping from the config file and running eksctl update cluster.

[martina-if]

Duplicate of #874