✈️ Convert Kube2IAM roles to function with IRSA

[jhpyke]

User Story

In order to run airflow jobs on the new cluster, said cluster will need to be able to assume roles existing in the AP-Data-Production account. Currently, said roles are handed in using pod annotations and Kube2IAM. However, for the new cluster it will be IRSA used to pass the roles. As such, we should experiment to find what changes are required to allow this to function seamlessly to users.

Value / Purpose

No response

Useful Contacts

No response

User Types

No response

Hypothesis

No response

Proposal

The person doing this ticket will need to experiment a bit, as IRSA for Airflow is a new use case. Once they are confident with the creation and passing of IRSA roles, they should then expand their scope to cover converting and existing role into one that can be assumed via IRSA.

Additional Information

No response

Definition of Done

• Experiment and build a system where two different airflow pods can assume different roles via IRSA.
• Demonstrate that said IRSA roles can be handed in from a separate account (you will likely need an assumption statement on both sides)
• Write up the steps required to convert a Kube2IAM compatible role to an IRSA compatible one.

[github-actions]

This issue is being marked as stale because it has been open for 60 days with no activity. Remove stale label or comment to keep the issue open.

[github-actions]

This issue is being closed because it has been open for a further 7 days with no activity. If this is still a valid issue, please reopen it, Thank you!