Connect an Amazon EKS Cluster with Cloudcraft

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

By scanning your Amazon EKS clusters, Cloudcraft allows you to generate system architecture diagrams to help visualize your deployed workloads and pods.

Cloudcraft uses the role-based access control (RBAC) authorization method provided by Kubernetes to authorize Cloudcraft’s existing read-only IAM entity role. That means Cloudcraft requires no special software or agent.

To learn more about RBAC configuration and IAM entities, see Managing users or IAM roles for your cluster.

The ability to scan Amazon EKS clusters and AWS accounts is only available to Cloudcraft Pro subscribers. Check out our pricing page for more information.

Prerequisites

Before connecting your Amazon EKS clusters with Cloudcraft, you must connect your AWS account and generate diagrams that include your clusters.

To connect your AWS account and familiarize yourself with Cloudcraft, see the following articles:

You should also install and configure kubectl, a tool that allows you to control Kubernetes clusters through the command line. Cloudcraft recommends using the latest version to avoid issues.

Authorizing the Cloudcraft IAM role for view-only

Start by opening a blueprint with an existing Amazon EKS cluster or using the Auto Layout feature to generate a new blueprint.

With your AWS environment mapped into a blueprint, select the Amazon EKS cluster that you wish to scan, and click the Enable cluster scanning button that appears in the component toolbar.

Interactive Cloudcraft diagram showing an AWS EKS cluster with enable cluster scanning button highlighted.

The next screen provides step-by-step commands to run in Terminal.

As the Amazon EKS cluster creator or user with admin access, open the aws-auth ConfigMap file with kubectl.

kubectl edit -n kube-system configmap/aws-auth

With the aws-auth.yaml file open in a text editor, add the role details to the mapRoles section of the file, just after under the data section.

data:
  mapRoles: |
    - rolearn: <arn-for-the-readonly-cloudcraft-iam-role>
      groups:
        - cloudcraft-view-only

If the section does not exist, add it. Once done, save the file and exit.

`groups` refer to groups in your cluster to which the role is mapped. For more information, see [Default Roles and Role Bindings][8] in the Kubernetes documentation.
Typos and syntax errors can affect the permissions of all IAM users and roles updated in the ConfigMap file. To prevent this from occuring, Cloudcraft recommends adding a YAML linter to your text editor.

Granting view-only access to the Cloudcraft IAM role

Next, use ClusterRoleBinding to bind the IAM role to a Kubernetes role.

A ClusterRoleBinding grants permissions defined in a role to a user or set of users in all namespaces in a cluster. Kubernetes defines some default user-facing roles. For Cloudcraft, use the predefined “view” role that allows view-only access to most objects in a namespace.

Enter the following multi-line command to create the ClusterRoleBinding and grant view-only permission to users in the cloudcraft-view-only group.

cat << EOF | kubectl apply -f -
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: cloudcraft-view-only
subjects:
  - kind: Group
    name: cloudcraft-view-only
    apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: view
  apiGroup: rbac.authorization.k8s.io
EOF

Testing access to the cluster

To test that Cloudcraft can access to the cluster, click Test cluster access at the bottom of the Enable Kubernetes Cluster Scanning screen.

Cloudcraft interface showing Kubernetes cluster role configuration with a 'Test Cluster Access' button highlighted by an arrow.

To scan other clusters, repeat the process as many times as needed.