Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Streamlining AWS Role Assumption in KEDA Using OIDC/Federation #5178

Closed
ThaSami opened this issue Nov 10, 2023 · 0 comments · Fixed by #5061
Closed

Streamlining AWS Role Assumption in KEDA Using OIDC/Federation #5178

ThaSami opened this issue Nov 10, 2023 · 0 comments · Fixed by #5061
Labels
feature-request All issues for new features that have not been committed to needs-discussion

Comments

@ThaSami
Copy link
Contributor

ThaSami commented Nov 10, 2023

Proposal

The current implementation for role assumption in KEDA, particularly when overriding AWS roles via pod identity mechanisms or the awsRoleArn trigger authentication environment variable, relies on using the KEDA operator's IAM role. This process requires granting specific permissions to the KEDA operator's role to assume the designated AWS role. Additionally, it necessitates configuring the trust relationship on the target role to allow this assumption. While effective in environments utilizing kube2iam, this methodology introduces additional, and potentially unnecessary, configuration steps in IRSA setup.

We propose a change to the role assumption process in KEDA for AWS. This improvement involves enabling KEDA to assume AWS roles directly by utilizing OpenID Connect (OIDC) and federation mechanisms. This approach would allow KEDA to bypass the current requirement of configuring the operator's role with additional permissions for role assumption.

Use-Case

No response

Is this a feature you are interested in implementing yourself?

Yes

Anything else?

No response

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature-request All issues for new features that have not been committed to needs-discussion
Projects
Archived in project
1 participant