Create an IAM OIDC provider for your cluster
Your cluster has an OpenID Connect
Prerequisites
An existing cluster. If you don't have one, you can create one using one of the Getting started with Amazon EKS guides.
To create an IAM OIDC identity provider for your
cluster with eksctl
-
Determine whether you have an existing IAM OIDC provider for your cluster.
View your cluster's OIDC provider URL.
aws eks describe-cluster --name <cluster_name> --query "cluster.identity.oidc.issuer" --output text
Example output:
https://oidc.eks.us-west-2.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E
List the IAM OIDC providers in your account. Replace
<EXAMPLED539D4633E53DE1B716D3041E>
(including<>
) with the value returned from the previous command.aws iam list-open-id-connect-providers | grep <EXAMPLED539D4633E53DE1B716D3041E>
Example output
"Arn": "arn:aws:iam::111122223333:oidc-provider/oidc.eks.us-west-2.amazonaws.com/id/EXAMPLED539D4633E53DE1B716D3041E"
If output is returned from the previous command, then you already have a provider for your cluster. If no output is returned, then you must create an IAM OIDC provider.
-
Create an IAM OIDC identity provider for your cluster with the following command. Replace
<cluster_name>
(including<>
) with your own value.eksctl utils associate-iam-oidc-provider --cluster <cluster_name> --approve
To create an IAM OIDC identity provider for your cluster with the AWS Management Console
-
Open the Amazon EKS console at https://console.aws.amazon.com/eks/home#/clusters
. -
Select the name of your cluster and then select the Configuration tab.
-
In the Details section, note the value of the OpenID Connect provider URL.
-
Open the IAM console at https://console.aws.amazon.com/iam/
. -
In the navigation panel, choose Identity Providers. If a Provider is listed that matches the URL for your cluster, then you already have a provider for your cluster. If a provider isn't listed that matches the URL for your cluster, then you must create one.
-
To create a provider, choose Add Provider.
-
For Provider Type, choose OpenID Connect.
-
For Provider URL, paste the OIDC issuer URL for your cluster, and then choose Get thumbprint.
-
For Audience, enter
sts.amazonaws.com
and choose Add provider.