Skip to content

docs: add EKS Pod Identity steps for Kyverno#2001

Open
abdollahShahid wants to merge 1 commit into
kyverno:mainfrom
abdollahShahid:docs-eks-pod-identity-1289
Open

docs: add EKS Pod Identity steps for Kyverno#2001
abdollahShahid wants to merge 1 commit into
kyverno:mainfrom
abdollahShahid:docs-eks-pod-identity-1289

Conversation

@abdollahShahid
Copy link
Copy Markdown

Closes #1289

This PR adds EKS Pod Identity instructions to the existing Kyverno AWS IRSA blog post.

This update documents how to:

  • Use EKS Pod Identity as an alternative to IRSA for Kyverno on Amazon EKS.
  • Create the IAM trust policy for pods.eks.amazonaws.com.
  • Create and attach an IAM role for the Kyverno admission controller.
  • Create the EKS Pod Identity association for the kyverno-admission-controller ServiceAccount.
  • Restart the admission controller so credential environment variables are injected.
  • Verify the association and Pod Identity credential environment variables.

The existing IRSA instructions are kept intact for users who still use IRSA.

Testing

  • Ran npx prettier --check src/content/blog/aws-irsa/index.md
  • Ran npm run build

Copilot AI review requested due to automatic review settings May 9, 2026 19:00
@welcome
Copy link
Copy Markdown

welcome Bot commented May 9, 2026

Thanks for opening your first Pull Request here! Please check out our Contributing guidelines and confirm that you Signed off.

Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the existing “Kyverno + AWS IRSA” blog post to also document Amazon EKS Pod Identity as an alternative way to grant Kyverno’s admission controller AWS permissions for image verification workflows.

Changes:

  • Added a new “Enabling EKS Pod Identity” section with IAM trust policy, role creation/attachment, Pod Identity association, restart, and verification steps.
  • Kept the existing IRSA instructions intact and updated the conclusion to reference both Pod Identity and IRSA.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread src/content/blog/aws-irsa/index.md
Comment thread src/content/blog/aws-irsa/index.md Outdated
Signed-off-by: Muhammad Abdullah Shahid <108458621+abdollahShahid@users.noreply.github.com>
@abdollahShahid abdollahShahid force-pushed the docs-eks-pod-identity-1289 branch from 2c62f24 to 7079b79 Compare May 9, 2026 19:25
@Suhani95
Copy link
Copy Markdown
Contributor

@abdollahShahid Nice docs update overall.
Could we also document the minimum supported EKS and AWS CLI versions required for Pod Identity? Since create-pod-identity-association is relatively new, adding prerequisites would help reduce setup confusion.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Enhancement] Add steps to enable EKS pod identity in Kyverno

3 participants