Configuration Management in Amazon EKS

Configuration Management in Amazon EKS An architecture diagram generated by Archify. AWS AppConfig · dynamic configuration · AWS Services AWS AppConfig dynamic configuration AWS Secrets Manager · secret storage · AWS Services AWS Secrets Manager secret storage AWS Parameter Store · config values & secrets · AWS Services AWS Parameter Store config values & secrets AWS KMS · encryption keys · AWS Services AWS KMS encryption keys AWS IAM · roles & policies · AWS Services AWS IAM roles & policies ACK · AWS Controllers for Kubernetes · Amazon EKS Cluster › Integration tools ACK AWS Controllers for Kubernetes External Secrets Operator · ExternalSecret sync · Amazon EKS Cluster › Integration tools External Secrets Operator ExternalSecret sync ASCP · Secrets Store CSI Driver provider · Amazon EKS Cluster › Integration tools ASCP Secrets Store CSI Driver provider IRSA · IAM Roles for Service Accounts · Amazon EKS Cluster › Integration tools IRSA IAM Roles for Service Accounts Kubernetes Configuration · ConfigMap · Secret · Amazon EKS Cluster Kubernetes Configuration ConfigMap · Secret Pod · application workload · Amazon EKS Cluster Pod application workload Integrates Integrates Integrates Creates Secret Mounts Secret Grants permissions Encrypts Manages AWS resources AWS Services Amazon EKS Cluster Integration tools Legend Application Pod Integration tools Kubernetes config objects AWS config & secret services AWS security services

AWS service integration

  • • Secrets Manager / Parameter Store: external secret management
  • • AppConfig: dynamic config updates without redeploying
  • • KMS: encrypts Secrets in the EKS cluster

Integration tools

  • • External Secrets Operator / ASCP bring AWS values in as Kubernetes Secrets
  • • IRSA binds IAM roles to service accounts to give Pods least privilege
  • • ACK manages AWS resources through Kubernetes manifests