Use Pod Identity instead of IRSA

src/_nebari/stages/infrastructure/template/aws/modules/kubernetes/main.tf

@@ -192,40 +192,37 @@ resource "aws_eks_addon" "coredns" {
   ]
 }
 
-data "tls_certificate" "this" {
-  url = aws_eks_cluster.main.identity[0].oidc[0].issuer
-}
+resource "aws_eks_addon" "pod_identity" {
+  addon_name                  = "eks-pod-identity-agent"
+  cluster_name                = aws_eks_cluster.main.name
+  resolve_conflicts_on_create = "OVERWRITE"
+  resolve_conflicts_on_update = "OVERWRITE"
 
-resource "aws_iam_openid_connect_provider" "oidc_provider" {
-  client_id_list  = ["sts.${data.aws_partition.current.dns_suffix}"]
-  thumbprint_list = data.tls_certificate.this.certificates[*].sha1_fingerprint
-  url             = aws_eks_cluster.main.identity[0].oidc[0].issuer
+  # Ensure cluster and node groups are created
+  depends_on = [
+    aws_eks_cluster.main,
+    aws_eks_node_group.main,
+  ]
 
-  tags = merge(
-    { Name = "${var.name}-eks-irsa" },
-    var.tags
-  )
+  tags = var.tags
 }
 
-# IAM role for EBS CSI driver using IRSA
+# IAM role for EBS CSI driver using Pod Identity
 resource "aws_iam_role" "ebs_csi_driver" {
   name = "${var.name}-ebs-csi-driver"
 
-  # Trust policy - allows the Kubernetes service account to assume this role via OIDC
+  # Trust policy - allows EKS Pod Identity to assume this role
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
     Statement = [{
       Effect = "Allow"
       Principal = {
-        Federated = aws_iam_openid_connect_provider.oidc_provider.arn
-      }
-      Action = "sts:AssumeRoleWithWebIdentity"
-      Condition = {
-        StringEquals = {
-          "${replace(aws_eks_cluster.main.identity[0].oidc[0].issuer, "https://", "")}:sub" = "system:serviceaccount:kube-system:ebs-csi-controller-sa"
-          "${replace(aws_eks_cluster.main.identity[0].oidc[0].issuer, "https://", "")}:aud" = "sts.amazonaws.com"
-        }
+        Service = "pods.eks.amazonaws.com"
       }
+      Action = [
+        "sts:AssumeRole",
+        "sts:TagSession"
+      ]
     }]
   })
 
@@ -241,25 +238,32 @@ resource "aws_iam_role_policy_attachment" "ebs_csi_driver" {
   policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEBSCSIDriverPolicy"
 }
 
-# IAM role for Cluster Autoscaler using IRSA
+# EKS Pod Identity Association for EBS CSI Driver
+resource "aws_eks_pod_identity_association" "ebs_csi_driver" {
+  cluster_name    = aws_eks_cluster.main.name
+  namespace       = "kube-system"
+  service_account = "ebs-csi-controller-sa"
+  role_arn        = aws_iam_role.ebs_csi_driver.arn
+
+  tags = var.tags
+}
+
+# IAM role for Cluster Autoscaler using Pod Identity
 resource "aws_iam_role" "cluster_autoscaler" {
   name = "${var.name}-cluster-autoscaler"
 
-  # Trust policy - allows the Kubernetes service account to assume this role via OIDC
+  # Trust policy - allows EKS Pod Identity to assume this role
   assume_role_policy = jsonencode({
     Version = "2012-10-17"
     Statement = [{
       Effect = "Allow"
       Principal = {
-        Federated = aws_iam_openid_connect_provider.oidc_provider.arn
-      }
-      Action = "sts:AssumeRoleWithWebIdentity"
-      Condition = {
-        StringEquals = {
-          "${replace(aws_eks_cluster.main.identity[0].oidc[0].issuer, "https://", "")}:sub" = "system:serviceaccount:${var.environment}:cluster-autoscaler"
-          "${replace(aws_eks_cluster.main.identity[0].oidc[0].issuer, "https://", "")}:aud" = "sts.amazonaws.com"
-        }
+        Service = "pods.eks.amazonaws.com"
       }
+      Action = [
+        "sts:AssumeRole",
+        "sts:TagSession"
+      ]
     }]
   })
 
@@ -274,3 +278,13 @@ resource "aws_iam_role_policy_attachment" "cluster_autoscaler" {
   role       = aws_iam_role.cluster_autoscaler.name
   policy_arn = aws_iam_policy.worker_autoscaling.arn
 }
+
+# EKS Pod Identity Association for Cluster Autoscaler
+resource "aws_eks_pod_identity_association" "cluster_autoscaler" {
+  cluster_name    = aws_eks_cluster.main.name
+  namespace       = var.environment
+  service_account = "cluster-autoscaler"
+  role_arn        = aws_iam_role.cluster_autoscaler.arn
+
+  tags = var.tags
+}

src/_nebari/stages/infrastructure/template/aws/modules/kubernetes/outputs.tf

@@ -13,21 +13,6 @@ output "node_groups_arn" {
   value = aws_eks_node_group.main[*].arn
 }
 
-output "cluster_oidc_issuer_url" {
-  description = "The URL on the EKS cluster for the OpenID Connect identity provider"
-  value       = aws_eks_cluster.main.identity[0].oidc[0].issuer
-}
-
-output "oidc_provider_arn" {
-  description = "The ARN of the OIDC Provider"
-  value       = aws_iam_openid_connect_provider.oidc_provider.arn
-}
-
-output "cluster_autoscaler_role_arn" {
-  description = "IAM role ARN for Cluster Autoscaler (IRSA)"
-  value       = aws_iam_role.cluster_autoscaler.arn
-}
-
 # https://github.com/terraform-aws-modules/terraform-aws-eks/blob/16f46db94b7158fd762d9133119206aaa7cf6d63/examples/self_managed_node_group/main.tf
 output "kubeconfig" {
   description = "Kubernetes connection configuration kubeconfig"

src/_nebari/stages/infrastructure/template/aws/outputs.tf

@@ -24,18 +24,3 @@ output "nfs_endpoint" {
   description = "Endpoint for nfs server"
   value       = length(module.efs) == 1 ? module.efs[0].credentials.dns_name : null
 }
-
-output "cluster_oidc_issuer_url" {
-  description = "The URL on the EKS cluster for the OpenID Connect identity provider"
-  value       = module.kubernetes.cluster_oidc_issuer_url
-}
-
-output "oidc_provider_arn" {
-  description = "The ARN of the OIDC Provider"
-  value       = module.kubernetes.oidc_provider_arn
-}
-
-output "cluster_autoscaler_role_arn" {
-  description = "IAM role ARN for Cluster Autoscaler (IRSA)"
-  value       = module.kubernetes.cluster_autoscaler_role_arn
-}

src/_nebari/stages/kubernetes_initialize/__init__.py

@@ -45,7 +45,6 @@ class InputVars(schema.Base):
     external_container_reg: Optional[ExtContainerReg] = None
     gpu_enabled: bool = False
     gpu_node_group_names: List[str] = []
-    cluster_autoscaler_role_arn: Optional[str] = None
 
 
 class InputSchema(schema.Base):
@@ -95,13 +94,6 @@ def input_vars(self, stage_outputs: Dict[str, Dict[str, Any]]):
                 if self.config.amazon_web_services.node_groups[group].gpu
             ]
             input_vars.aws_region = self.config.amazon_web_services.region
-            # Get the Cluster Autoscaler IAM role ARN from infrastructure stage output
-            if "stages/02-infrastructure" in stage_outputs:
-                input_vars.cluster_autoscaler_role_arn = (
-                    stage_outputs["stages/02-infrastructure"]
-                    .get("cluster_autoscaler_role_arn", {})
-                    .get("value", "")
-                )
 
         return input_vars.model_dump()
 

src/_nebari/stages/kubernetes_initialize/template/main.tf

@@ -14,7 +14,6 @@ module "kubernetes-autoscaling" {
 
   aws_region   = var.aws_region
   cluster-name = local.cluster_name
-  iam_role_arn = var.cluster_autoscaler_role_arn
 }
 
 module "traefik-crds" {

src/_nebari/stages/kubernetes_initialize/template/modules/cluster-autoscaler/main.tf

@@ -12,9 +12,7 @@ resource "helm_release" "autoscaler" {
         create = true
         serviceAccount = {
           name = "cluster-autoscaler"
-          annotations = {
-            "eks.amazonaws.com/role-arn" = var.iam_role_arn
-          }
+          # Pod Identity doesn't require annotations - association is handled via EKS Pod Identity
         }
       }
 

src/_nebari/stages/kubernetes_initialize/template/modules/cluster-autoscaler/variables.tf

@@ -18,8 +18,3 @@ variable "overrides" {
   type        = list(string)
   default     = []
 }
-
-variable "iam_role_arn" {
-  description = "IAM role ARN for Cluster Autoscaler (IRSA)"
-  type        = string
-}

src/_nebari/stages/kubernetes_initialize/template/variables.tf

@@ -30,9 +30,3 @@ variable "gpu_enabled" {
 variable "gpu_node_group_names" {
   description = "Names of node groups with GPU"
 }
-
-variable "cluster_autoscaler_role_arn" {
-  description = "IAM role ARN for Cluster Autoscaler (IRSA)"
-  type        = string
-  default     = ""
-}