AccessEntry

eks.services.k8s.aws/v1alpha1

Type	Link
GoDoc	eks-controller/apis/v1alpha1#AccessEntry

Metadata

Property	Value
Scope	Namespaced
Kind	`AccessEntry`
ListKind	`AccessEntryList`
Plural	`accessentries`
Singular	`accessentry`

An access entry allows an IAM principal (user or role) to access your cluster. Access entries can replace the need to maintain the aws-auth ConfigMap for authentication. For more information about access entries, see Access entries (https://docs.aws.amazon.com/eks/latest/userguide/access-entries.html) in the Amazon EKS User Guide.

Spec

accessPolicies:
  accessScope: 
    namespaces:
    - string
    type: string
  policyARN: string
clusterName: string
clusterRef: 
  from: 
    name: string
kubernetesGroups:
- string
principalARN: string
tags: {}
type: string
username: string

Field	Description
accessPolicies Optional	array
accessPolicies.[] Required	object
accessPolicies.[].accessScope.namespaces Optional	array
accessPolicies.[].accessScope.namespaces.[] Required	string
accessPolicies.[].policyARN Optional	string
clusterName Optional	string The name of your cluster.
clusterRef Optional	object AWSResourceReferenceWrapper provides a wrapper around *AWSResourceReference type to provide more user friendly syntax for references using ‘from’ field Ex: APIIDRef: from: name: my-api
clusterRef.from Optional	object AWSResourceReference provides all the values necessary to reference another k8s resource for finding the identifier(Id/ARN/Name)
clusterRef.from.name Optional	string
kubernetesGroups Optional	array The value for name that you’ve specified for kind: Group as a subject in a Kubernetes RoleBinding or ClusterRoleBinding object. Amazon EKS doesn’t confirm that the value for name exists in any bindings on your cluster. You can specify one or more names. Kubernetes authorizes the principalArn of the access entry to access any cluster objects that you’ve specified in a Kubernetes Role or ClusterRole object that is also specified in a binding’s roleRef. For more information about creating Kubernetes RoleBinding, ClusterRoleBinding, Role, or ClusterRole objects, see Using RBAC Authorization in the Kubernetes documentation (https://kubernetes.io/docs/reference/access-authn-authz/rbac/). If you want Amazon EKS to authorize the principalArn (instead of, or in addition to Kubernetes authorizing the principalArn), you can associate one or more access policies to the access entry using AssociateAccessPolicy. If you associate any access policies, the principalARN has all permissions assigned in the associated access policies and all permissions in any Kubernetes Role or ClusterRole objects that the group names are bound to.
kubernetesGroups.[] Required	string
tags Optional	object Metadata that assists with categorization and organization. Each tag consists of a key and an optional value. You define both. Tags don’t propagate to any other cluster or Amazon Web Services resources.
type Optional	string The type of the new access entry. Valid values are Standard, FARGATE_LINUX, EC2_LINUX, and EC2_WINDOWS. If the principalArn is for an IAM role that’s used for self-managed Amazon EC2 nodes, specify EC2_LINUX or EC2_WINDOWS. Amazon EKS grants the necessary permissions to the node for you. If the principalArn is for any other purpose, specify STANDARD. If you don’t specify a value, Amazon EKS sets the value to STANDARD. It’s unnecessary to create access entries for IAM roles used with Fargate profiles or managed Amazon EC2 nodes, because Amazon EKS creates entries in the aws-auth ConfigMap for the roles. You can’t change this value once you’ve created the access entry. If you set the value to EC2_LINUX or EC2_WINDOWS, you can’t specify values for kubernetesGroups, or associate an AccessPolicy to the access entry.
username Optional	string The username to authenticate to Kubernetes with. We recommend not specifying a username and letting Amazon EKS specify it for you. For more information about the value Amazon EKS specifies for you, or constraints before specifying your own username, see Creating access entries (https://docs.aws.amazon.com/eks/latest/userguide/access-entries.html#creating-access-entries) in the Amazon EKS User Guide.

Status

ackResourceMetadata: 
  arn: string
  ownerAccountID: string
  region: string
conditions:
- lastTransitionTime: string
  message: string
  reason: string
  status: string
  type: string
createdAt: string
modifiedAt: string

Field	Description
ackResourceMetadata Optional	object All CRs managed by ACK have a common `Status.ACKResourceMetadata` member that is used to contain resource sync state, account ownership, constructed ARN for the resource
ackResourceMetadata.arn Optional	string ARN is the Amazon Resource Name for the resource. This is a globally-unique identifier and is set only by the ACK service controller once the controller has orchestrated the creation of the resource OR when it has verified that an “adopted” resource (a resource where the ARN annotation was set by the Kubernetes user on the CR) exists and matches the supplied CR’s Spec field values. TODO(vijat@): Find a better strategy for resources that do not have ARN in CreateOutputResponse https://github.com/aws/aws-controllers-k8s/issues/270
ackResourceMetadata.ownerAccountID Required	string OwnerAccountID is the AWS Account ID of the account that owns the backend AWS service API resource.
ackResourceMetadata.region Required	string Region is the AWS region in which the resource exists or will exist.
conditions Optional	array All CRS managed by ACK have a common `Status.Conditions` member that contains a collection of `ackv1alpha1.Condition` objects that describe the various terminal states of the CR and its backend AWS service API resource
conditions.[] Required	object Condition is the common struct used by all CRDs managed by ACK service
controllers to indicate terminal states of the CR and its backend AWS
service API resource
conditions.[].message Optional	string A human readable message indicating details about the transition.
conditions.[].reason Optional	string The reason for the condition’s last transition.
conditions.[].status Optional	string Status of the condition, one of True, False, Unknown.
conditions.[].type Optional	string Type is the type of the Condition
createdAt Optional	string The Unix epoch timestamp at object creation.
modifiedAt Optional	string The Unix epoch timestamp for the last modification to the object.

AccessEntry

Metadata#

Spec#

Status#

Metadata

Spec

Status