Help improve this page
Want to contribute to this user guide? Scroll to the bottom of this page and select Edit this page on GitHub. Your contributions will help make our user guide better for everyone.
Set up the Amazon EKS Pod Identity Agent
Amazon EKS Pod Identity associations provide the ability to manage credentials for your applications, similar to the way that Amazon EC2 instance profiles provide credentials to Amazon EC2 instances.
Amazon EKS Pod Identity provides credentials to your workloads with an additional EKS Auth API and an agent pod that runs on each node.
Considerations
-
IPv6
By default, the EKS Pod Identity Agent listens on an
IPv4
andIPv6
address for pods to request credentials. The agent uses the loopback (localhost) IP address169.254.170.23
forIPv4
and the localhost IP address[fd00:ec2::23]
forIPv6
.If you disable
IPv6
addresses, or otherwise prevent localhostIPv6
IP addresses, the agent can't start. To start the agent on nodes that can't useIPv6
, follow the steps in Disable IPv6 in the EKS Pod Identity Agent to disable theIPv6
configuration.
Creating the Amazon EKS Pod Identity Agent
Agent prerequisites
-
An existing Amazon EKS cluster. To deploy one, see Get started with Amazon EKS. The cluster version and platform version must be the same or later than the versions listed in EKS Pod Identity cluster versions.
-
The node role has permissions for the agent to do the
AssumeRoleForPodIdentity
action in the EKS Auth API. You can use the AWS managed policy: AmazonEKSWorkerNodePolicy or add a custom policy similar to the following:{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "eks-auth:AssumeRoleForPodIdentity" ], "Resource": "*" } ] }
This action can be limited by tags to restrict which roles can be assumed by pods that use the agent.
-
The nodes can reach and download images from Amazon ECR. The container image for the add-on is in the registries listed in View Amazon container image registries for Amazon EKS add-ons.
Note that you can change the image location and provide
imagePullSecrets
for EKS add-ons in the Optional configuration settings in the AWS Management Console, and in the--configuration-values
in the AWS CLI. -
The nodes can reach the Amazon EKS Auth API. For private clusters, the
eks-auth
endpoint in AWS PrivateLink is required.