EKS
Service account IAM roles
Obtaining CA thumbprint of OIDC provider
AWS IAM identity provider needs to be configured with CA Thumbprint. More specifically, this is a SHA1 fingerprint (in lowercase and without colons) of the root CA certificate.
Thumbprint can be obtained with openssl or other tools, but there couple of shortcuts:
Oneliner from GH issue (https://github.com/terraform-providers/terraform-provider-aws/issues/10104):
echo | openssl s_client -servername oidc.eks.${REGION}.amazonaws.com -showcerts -connect oidc.eks.${REGION}.amazonaws.com:443 2>&- | tail -r | sed -n '/-----END CERTIFICATE-----/,/-----BEGIN CERTIFICATE-----/p; /-----BEGIN CERTIFICATE-----/q' | tail -r | openssl x509 -fingerprint -noout | sed 's/://g' | awk -F= '{print tolower($2)}'kubergrunttool (https://github.com/gruntwork-io/kubergrunt):
kubergrunt eks oidc-thumbprint --issuer-url $ISSUER_URL
Resources
Amazon EKS Best Practices Guide for Security - https://aws.github.io/aws-eks-best-practices/
Last updated