Velero is an open-source tool that allows you to backup and restore your Kubernetes cluster resources and persistent volumes. Velero backups support a number of different storage providers including Amazon S3. The process of setting up Velero backup with S3 using AWS credentials has been documented by Velero. However, at the time of this post, there is no official documentation on how to set up Velero using IRSA or IAM Roles for Service Accounts.

IRSA provides access to Kubernetes pods through service accounts. This offers a more secure alternative to access your AWS services as it eliminates the need to generate and store access key and secret key credentials. Instead, it allows you to assign an AWS Identity and Access Management (IAM) role to a Kubernetes service account. This provides a secure and scalable way to grant permissions to pods in a Kubernetes cluster.

The benefits of using IRSA in AWS include:

1. Enhanced security: IRSA allows you to assign granular permissions to pods in a Kubernetes cluster, which helps to reduce the risk of security breaches. By using IAM roles, you can apply the principle of least privilege, ensuring that each pod only has access to the resources it needs to function.
2. Simplified access management: By using IRSA, you can manage access to AWS resources at the Kubernetes namespace level, rather than having to manage access on a per-pod basis. This simplifies access management and reduces the risk of errors.
3. Improved scalability: IRSA allows you to automate the process of granting permissions to pods in a Kubernetes cluster. This means that you can easily scale your cluster up or down without having to manually manage access permissions.
4. Better auditability: IRSA provides better auditability by allowing you to track access to AWS resources at the Kubernetes namespace level. This can help you to identify potential security risks and ensure that your cluster is properly secured.
5. Integration with other AWS services: IRSA is fully integrated with other AWS services, such as AWS Security Hub and AWS CloudTrail, which provides additional security and compliance benefits.

The IAM role ARN (Amazon Resource Name) is set as an annotation in the Kubernetes service account which can then be assigned to a pod. IRSA utilizes IAM OIDC, or OpenID Connect, which allows the cluster to authenticate AWS API requests and obtain new JSON Web Tokens (JWT) for each pod that is using the service account.

In this blog post, we go through setting up Velero on an Amazon Elastic Kubernetes Service (EKS) cluster using IRSA. We start by creating the IAM OIDC provider, followed by creating the S3 bucket and the associated IAM role. Finally, we install Velero and configuring the backup storage location to access our S3 bucket without using any credentials.

Prerequisites

1. An existing AWS EKS cluster.
2. The AWS CLI installed and configured.
   AWS CLI install and update instructions – AWS Command Line Interface
3. The kubectl command installed and configured to access your EKS cluster.
   Install Tools – Kubernetes Documentation
4. The eksctl CLI installed.
   Installing or updating eksctl – Amazon EKS
5. The Velero CLI installed.
   Velero Backup Docs – Basic Install
6. Set the following environment variables:

# The name of the EKS cluster
EKS_CLUSTER_NAME=<name_of_eks_cluster>

# The service account and namespace where Velero will be installed
NAMESPACE=velero
SERVICE_ACCOUNT=velero

# The ID of the AWS account
AWS_ACCOUNT_ID=$(aws sts get-caller-identity --query "Account" --output text)
# The region of the EKS cluster
AWS_REGION="us-east-1"

# The IAM OIDC provider of the EKS cluster
OIDC_PROVIDER=$(aws eks describe-cluster --name $EKS_CLUSTER_NAME --region $AWS_REGION --query "cluster.identity.oidc.issuer" --output text | sed -e "s/^https:\/\///")

# The name of the S3 bucket that will be created to store Velero backups
BUCKET=<name_of_s3_bucket>

# The name of the IAM role that will be created for Velero
VELERO_ROLE=<name_of_velero_iam_role