kiam で Kubernetes の Pod に IAM role を割り当てる

git clone https://github.com/uswitch/kiam.git
cd kiam/deploy
kubectl create -f agent.yaml
kubectl create -f server-rbac.yaml
kubectl create -f server.yaml

@@ -15,12 +19,16 @@ spec:
         role: server
     spec:
       serviceAccountName: kiam-server
+      tolerations:
+        - key: "node-role.kubernetes.io/master"
+          effect: "NoSchedule"
+          operator: "Exists"
       nodeSelector:
         kubernetes.io/role: master
       volumes:
         - name: ssl-certs
           hostPath:
-            path: /usr/share/ca-certificates
+            path: /etc/ssl/certs
         - name: tls
           secret:
             secretName: kiam-server-tls

spec:
  additionalPolicies:
    master: |
      [
        {
          "Effect": "Allow",
          "Action": ["sts:AssumeRole"],
          "Resource": ["*"]
        }
      ]      

#
# variables
#
variable "test-kiam-bucket-name" {
  type    = "string"
  default = "test-kiam-bucket"
}

#
# test-kiam-bucket role & policy
#
## role
resource "aws_iam_role" "test-kiam-bucket" {
  name = "${var.test-kiam-bucket-name}"

  assume_role_policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "Service": "ec2.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    },
    {
      "Sid": "",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::111111111111:role/masters.test.k8s.example.com"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF
}

## role policy
resource "aws_iam_role_policy" "test-kiam-bucket" {
  name = "${var.test-kiam-bucket-name}"
  role = "${aws_iam_role.test-kiam-bucket.id}"

  policy = <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::${var.test-kiam-bucket-name}"
      ]
    }
  ]
}
EOF
}

apiVersion: v1
kind: Pod
metadata:
  name: mypod
  labels:
    name: mypod 
spec:
  containers:
  - image: debian
    command: [ "/bin/bash", "-c", "--" ]
    args: [ "while true; do sleep 30; done;" ]
    name: mypod

$ kubectl create -f mypod.yml
pod "mypod" created

## aws-cli のインストール
$ kubectl exec -it mypod /bin/bash
root@mypod:/# apt-get update && apt-get install -y curl
root@mypod:/# apt-get install -y python && curl "https://bootstrap.pypa.io/get-pip.py" -o "get-pip.py" && python get-pip.py && pip install awscli
root@mypod:/# mkdir ~/.aws
root@mypod:/# cat > ~/.aws/config <<EOF
> [default]
> region = ap-northeast-1
> EOF

## security-credentials 配下は empty
root@mypod:/# curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
empty role

## S3 bucket の中身は見ることができない
root@mypod:/# aws s3 ls s3://test-kiam-bucket
Unable to locate credentials. You can configure credentials by running "aws configure".

## Pod に用意した role 名で annotation をつける
% kubectl annotate pods mypod iam.amazonaws.com/role='test-kiam-bucket'
pod "mypod" annotated

## namespace にも利用できる role の許可設定を annotation で入れる
% kubectl annotate namespace default iam.amazonaws.com/permitted='.*'
namespace "default" annotated

## S3 バケットの中身が見られるか確認してみる
root@mypod:/# aws s3 ls s3://test-kube2iam-bucket
2018-02-26 12:31:57        306 chart.txt

% kubectl annotate pods mypod iam.amazonaws.com/role-
pod "mypod" annotated

root@mypod:/# aws s3 ls s3://test-kiam-bucket
Unable to locate credentials. You can configure credentials by running "aws configure".

kubectl annotate pods mypod iam.amazonaws.com/role='arn:aws:iam::111111111111:role/test-kiam-bucket'

kubectl annotate namespace default iam.amazonaws.com/permitted='test-kiam-*'