eks multi-tenancy 오류 수정

tks-cluster/aws-eks-keycloak-oidc-provider.yaml

@@ -13,11 +13,16 @@ spec:
       value: "C011b88fa"
     - name: keycloak_url
       value: 'https://keycloak.yourdomain.org/auth'
+    - name: cloud_account_id # will be not NULL if the cluster is multitenancy
+      value: "NULL"
 
   volumes:
-    - name: awsconfig
-      secret:
-        secretName: awsconfig-secret
+  - name: awsconfig
+    secret:
+      secretName: awsconfig-secret
+  - name: kubeconfig-adm
+    secret:
+      secretName: tks-admin-kubeconfig-secret
 
   templates:
   - name: createProvider
@@ -26,15 +31,33 @@ spec:
       - name: contract_id
       - name: cluster_id
       - name: keycloak_url
+      - name: cloud_account_id
     activeDeadlineSeconds: 1800
     container:
       image: harbor.taco-cat.xyz/tks/tks-aws:v1.1.0
       command:
       - /bin/bash
       - -exc
       - |
+        cp /kube/value kubeconfig_adm
+        export KUBECONFIG=kubeconfig_adm
         mkdir ~/.aws
-        cp /aws/* ~/.aws/   
+        cp /aws/* ~/.aws/
+
+        # Use AWS STS temporary security credential if multi-tenancy
+        if [ "$CLOUD_ACCOUNT_ID" != "NULL" ]; then
+          ROLE_ARN=$(kubectl get awsri $CLOUD_ACCOUNT_ID-account-role -ojsonpath='{.spec.roleARN}')
+          aws sts assume-role --role-arn $ROLE_ARN --role-session-name "TKS-ClusterAutoscaler-$CLUSTER_ID" --output json | tee ~/assume-role-sts-credential.txt
+          export AWS_ACCESS_KEY_ID=$(cat ~/assume-role-sts-credential.txt | jq -r '.Credentials.AccessKeyId')
+          export AWS_SECRET_ACCESS_KEY=$(cat ~/assume-role-sts-credential.txt | jq -r '.Credentials.SecretAccessKey')
+          export AWS_SESSION_TOKEN=$(cat ~/assume-role-sts-credential.txt | jq -r '.Credentials.SessionToken')
+
+          ROLE_ARN_REMOVED_SUFFIX=${ROLE_ARN%:*}
+          AWS_ACCOUNT_ID=${ROLE_ARN_REMOVED_SUFFIX#*::}
+        else
+          AWS_ACCOUNT_ID=$(kubectl  get secret -n argo awsconfig-secret -ojsonpath='{.data.AWS_ACCOUNT_ID}' | base64 -d)
+        fi
+
         # generate OIDC provider for EKS cluster
         ISSUER_URL=$KEYCLOAK_URL/realms/$CONTRACT_ID
         CLIENT_ID=$CLUSTER_ID-k8s-api
@@ -61,6 +84,10 @@ spec:
         value: "{{ inputs.parameters.keycloak_url }}"
       - name: CONTRACT_ID
         value: "{{ inputs.parameters.contract_id }}"
+      - name: CLOUD_ACCOUNT_ID
+        value: "{{workflow.parameters.cloud_account_id}}"
       volumeMounts:
         - name: awsconfig
           mountPath: "/aws"
+        - name: kubeconfig-adm
+          mountPath: "/kube"

tks-cluster/create-usercluster-wftpl.yaml

@@ -143,6 +143,8 @@ spec:
                   value: "{{ workflow.parameters.cluster_id }}"
                 - name: keycloak_url
                   value: "{{ workflow.parameters.keycloak_url }}"
+                - name: cloud_account_id
+                  value: "{{ workflow.parameters.cloud_account_id }}"
             when: >-
               {{steps.tks-create-cluster-repo.outputs.parameters.infra_provider}} == aws &&
                 {{steps.tks-create-cluster-repo.outputs.parameters.managed_cluster}} == true