Create component for configuring IAM roles for IRSA

[flostadler]

Hello!

• Vote on this issue by adding a 👍 reaction
• If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

Issue details

Users can use IRSA (IAM Roles for Service Accounts) to assign IAM roles to kubernetes workloads. This requires crafting rather complex assume role permissions (see).

They need to create an OIDC provider and then retrieve its ARN and URL to configure the trust relationship of the role. This will look like this:

pulumi-eks/examples/oidc-iam-sa/index.ts

Lines 35 to 59 in b170816

	const saAssumeRolePolicy = aws.iam.getPolicyDocumentOutput({
	statements: [{
	actions: ["sts:AssumeRoleWithWebIdentity"],
	conditions: [{
	test: "StringEquals",
	values: [pulumi.interpolate`system:serviceaccount:${appsNamespaceName}:${saName}`],
	variable: pulumi.interpolate`${cluster.oidcIssuer}:sub`,
	}],
	effect: "Allow",
	principals: [{
	identifiers: [cluster.oidcProviderArn],
	type: "Federated",
	}],
	}],
	});
	const saRole = new aws.iam.Role(saName, {
	assumeRolePolicy: saAssumeRolePolicy.json,
	});
	// Attach the S3 read only access policy.
	const saS3Rpa = new aws.iam.RolePolicyAttachment(saName, {
	policyArn: "arn:aws:iam::aws:policy/AmazonS3FullAccess",
	role: saRole,
	});

Instead of users to now about the exact format, we could create a component that wraps that.

For example:

const irsaRole = new eks.IrsaRole("role", {
    cluster: eksCluster, // or cluster name alternatively
    serviceAccounts: [{
        namespace: "default",
        serviceAccount: "my-super-app",
    }],
});

Affected area/feature