AWS re:Invent 2023 CON335 - Securing Kubernetes Workloads in Amazon EKS - Demo

This repo contains setup scripts used to demonstrate EKS Pod Identity (2023) and EKS Cluster Access Management (2023).

• Slides
• YouTube

EKS Pod Identity

EKS Cluster Access Management

Setup

You'll need the AWS CLI installed, as well as node,

brew install node asciinema agg kubernetes-cli
npm install -g aws-cdk

To set up the VPC for EKS clusters, IAM roles, and an S3 bucket, use the provided CDK.

cdk bootstrap
cdk deploy

Once you have that setup, edit demos/env.sh and insert the outputs from your CDK stack.

cd demo
source env.sh

Now you can setup your EKS clusters.

CLUSTER_NAME=red-fish ./cluster-setup.sh

CLUSTER_NAME=blue-fish ./cluster-setup.sh

# I only used a third cluster for the CAM demo in order to run it in EKS's pre-production environment. 
# A third cluster is not stricly necessary.
CLUSTER_NAME=gold-fish ./cluster-setup.sh

EKS Pod Identity Demo

Under demos/pod-identity, there is a README with full runthrough steps for the demo.

Cluster Access Management

Before running this demo, you'll need to configure the demos/cluster-access-management/aws_config.ini file with a method of getting credentials.

cd demos/cluster-access-management
source env.sh
./run.sh cam-demo.sh

License

See LICENSE, Apache 2.0,