kube2iam

We've been using kube2iam for this for a couple of years. You just create a role give it an assume role policy that allows the node to assume it. Then annotate your pod w/ the role arn. When they make a call to get their instance profile you get the role instead. It's a little annoying in that your pod code thinks its making a metadata call (which is super super fast), but what is actually happening is kube2iam intercepted that and will make a sts:assumerole call... which takes forever. So people just need to set their timeout a little higher than normal. https://github.com/jtblin/kube2iam

https://github.com/jtblin/kube2iam is probably what you're looking for, it uses iptables to allow/disallow pods requests to the ec2 metadata service based on kubernetes annotations in fact, if you check out the source (located here: https://github.com/awslabs/aws-service-operator) it's recommended to use kube2iam edit: haven't fully read the article yet but if the operator supports managing IAM roles thru a CRD you could potentially create the role and attach it via annotation in one go. double edit: looks like IAM roles aren't directly supported yet, the following is what appears to be supported: - cloudformation templates - dynamodb - s3 - sns subscriptions and topics - sqs queues - ecr repos

You can use IAM to auth to a cluster using heptio authenticator https://github.com/heptio/authenticator/blob/master/README.m... You can grant IAM roles to individual pods running in k8s using kube2iam, though there are new advancements seemingly coming, or already out, now that amazon has announced eks. https://github.com/jtblin/kube2iam Kops can provision and manage a cluster that incorporates multiple subnets allowing you to have a multi-az buildout https://github.com/kubernetes/kops/blob/master/docs/high_ava...

IAM credentials for ECS tasks are implemented with a transparent proxy to the metadata API, and there are similar projects for Kubernetes. The one that's most popular I believe is kube2iam: https://github.com/jtblin/kube2iam Using IAM roles then boils down to setting an annotation such as `iam.amazonaws.com/role: my-db-access-role` on a pod (assuming the correct trust relationship has been configured).

IAM roles for pods: https://github.com/jtblin/kube2iam Running kubernetes in private networks: You could probably get private subnet support by - Deploying manually or deploying with a script, then changing things in AWS (route tables, public IP, etc) to be private, manually afterwards (both cumbersome but possible) - Using NodePort instead of LoadBalancer on any services