Configure Amazon EKS with Mend’s Kubernetes integration

Overview

The Mend Kubernetes (K8s) integration can connect with your Amazon EKS service using your provided access and secret keys.

Getting it done

Prerequisites before you configure Mend’s Kubernetes integration for Amazon EKS

• Your Mend user must be an organization administrator in order to access the Cloud Native UI.

• Your Amazon EKS role that owns the access and secret keys provided to Mend for authentication must have an IAM policy attached with the necessary actions for all relevant K8s clusters. See the Amazon EKS setup for Mend K8s integration access section of this document for instructions.

Amazon EKS setup for Mend K8s integration access

1. Create/Edit an AWS user with the following IAM policy that includes these policy permissions:

   CODE

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "sts:AssumeRole",
                   "eks:ListTagsForResource",
                   "eks:AccessKubernetesApi",
                   "eks:DescribeCluster",
                   "eks:ListClusters"
               ],
               "Resource": "<USER_ARN>"
           }
       ]
   }

2. Create access and secret keys for this user via the Security Credentials tab → Access keys section within AWS. Keep the access and secret keys on hand for the integration steps later on within the Mend Application. For assistance within AWS, read here: Managing access keys (console).

3. Apply Mend’s Cluster Role provided below to each of the clusters you wish to integrate. This step allows Mend access to the clusters to obtain the list of running images. In the mend-readonly-group.yaml YAML file example below, we use readonly-group as the value for the group name:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: readonly-clusterrole
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["get", "watch", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: readonly-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: readonly-clusterrole
subjects:
- kind: Group
  name: readonly-group
  apiGroup: rbac.authorization.k8s.io

"*" can be replaced with a specific list of resources, based on your needs.

4. Within the ConfigMap, add your AWS user (from step one) and its ARN under the mapUsers section:

   1. Open the ConfigMap (i.e via the kubectl command: kubectl edit configmap aws-auth -n kube-system)

   2. Using our readonly-group example from step three, add to the mapUsers section (or create a mapUsers section, if needed) the following:

      CODE

       mapUsers: |
          - userarn: <USER_ARN>
            username: <USERNAME>
            groups:
            - readonly-group

5. Save your changes and exit out of the files. You are now ready to configure the integration within the Mend Application.

Set up the Mend Kubernetes integration for Amazon EKS in the Mend Application

1. Within the Mend Application, navigate to the Cloud Native UI:

   

2. Navigate to the Integrations dashboard:

   

3. Click on the Kubernetes tab.

4. Click on + Add K8s service:

   

5. The “Add K8s service?” pop-up wizard appears. Select AWS EKS for the Service Type setting to start the configuration setup for Amazon EKS.

6. Fill out the Step 1 - Integration info section with your Amazon EKS information. For more information on the parameters provided, refer to the Amazon EKS parameters section within this document:

   

7. Once you provide your Access Key and Secret Key, click on Submit:

   

8. In Step 2 - Cluster selection, confirm the number of clusters identified is correct and which are accessible to Mend for the integration:

   

9. Click on Apply to add your Amazon EKS K8s integration:

   

Reference

Mend Kubernetes integration - Amazon EKS parameters