Verifying DynamoDB access

Now, with the carts Service Account associated with the authorized IAM role, the carts Pod has permission to access the DynamoDB table. Let's verify this by exposing the UI through a Network Load Balancer and accessing the shopping cart.

First, create an NLB service to access the web store externally:

~$cat << 'EOF' | kubectl apply -f -

apiVersion: v1

kind: Service

metadata:

  name: ui-nlb-auto

  namespace: ui

  annotations:

    service.beta.kubernetes.io/aws-load-balancer-type: external

    service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing

    service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: instance

spec:

  type: LoadBalancer

  ports:

    - port: 80

      targetPort: 8080

      name: http

  selector:

    app.kubernetes.io/name: ui

    app.kubernetes.io/instance: ui

    app.kubernetes.io/component: service

EOF

service/ui-nlb-auto created

While we wait for the NLB to come online, let's validate the new environment variables that EKS Pod Identity has injected into the carts Pod:

~$kubectl -n carts exec deployment/carts -- env | grep AWS

AWS_STS_REGIONAL_ENDPOINTS=regional

AWS_DEFAULT_REGION=us-west-2

AWS_REGION=us-west-2

AWS_CONTAINER_CREDENTIALS_FULL_URI=http://169.254.170.23/v1/credentials

AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE=/var/run/secrets/pods.eks.amazonaws.com/serviceaccount/eks-pod-identity-token

Notable points about these environment variables:

• AWS_DEFAULT_REGION - The region is set automatically to the same as our EKS cluster
• AWS_STS_REGIONAL_ENDPOINTS - Regional STS endpoints are configured to avoid putting too much pressure on the global endpoint in us-east-1
• AWS_CONTAINER_CREDENTIALS_FULL_URI - This variable tells AWS SDKs how to obtain credentials using the HTTP credential provider. This means that EKS Pod Identity does not need to inject credentials via something like an AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY pair, and instead the SDKs can have temporary credentials vended to them via the EKS Pod Identity mechanism. You can read more about how this functions in the AWS documentation.

Now let's wait for the load balancer to finish provisioning:

~$wait-for-lb $(kubectl get service -n ui ui-nlb-auto -o jsonpath="{.status.loadBalancer.ingress[*].hostname}")

Waiting for k8s-ui-uinlbaut-a9797f0f61.elb.us-west-2.amazonaws.com...

You can now access http://k8s-ui-uinlbaut-a9797f0f61.elb.us-west-2.amazonaws.com

Access the web store and navigate to the shopping cart:

~$LB_HOSTNAME=$(kubectl get svc ui-nlb-auto -n ui -o yaml | yq .status.loadBalancer.ingress[0].hostname)

~$echo "http://$LB_HOSTNAME"

http://k8s-ui-uinlbaut-a9797f0f61.elb.us-west-2.amazonaws.com

The carts Pod is able to reach the DynamoDB service and the shopping cart is now accessible!

You have successfully configured Pod Identity in your application.