use rolearn

Signed-off-by: Kaizhe Huang <khuang@aurora.tech>
falcosecurity · Jul 28, 2021 · ecbb07e · ecbb07e
1 parent 2124022
commit ecbb07e
Show file tree

Hide file tree

Showing 4 changed files with 5 additions and 9 deletions.
diff --git a/falcosidekick/CHANGELOG.md b/falcosidekick/CHANGELOG.md
@@ -7,7 +7,7 @@ Before release 0.1.20, the helm chart can be found in `falcosidekick` [repositor
 
 ## 0.3.12
 
-* Add fields `config.aws.accountid` and `config.aws.iamrole`
+* Add AWS configuration field `config.aws.rolearn`
 
 ## 0.3.11
 

diff --git a/falcosidekick/README.md b/falcosidekick/README.md
@@ -207,8 +207,7 @@ The following table lists the main configurable parameters of the Falcosidekick
 | `config.stan.checkcert`                      | check if ssl certificate of the output is valid  | `true`                                                                                                                                 |                                                                                                   |
 | `config.stan.minimumpriority`               | minimum priority of event for using use this output, order is `emergency\|alert\|critical\|error\|warning\|notice\|informational\|debug or ""`                                                | `debug`                                                                                           |
 | `config.aws.accesskeyid`                    | AWS Access Key Id (optionnal if you use EC2 Instance Profile)                                                                                                                          |                                                                                                   |
-| `config.aws.accountid`                    | AWS Account ID (optionnal if you use EC2 Instance Profile)                                                                                                                          |                                                                                                   |
-| `config.aws.iamrole`                    | AWS IAM role for falcosidekick service account to associate with (optionnal if you use EC2 Instance Profile)                                                                                                                          |                                                                                                   |
+| `config.aws.rolearn`                    | AWS IAM role ARN for falcosidekick service account to associate with (optionnal if you use EC2 Instance Profile)                                                                                                                          |                                                                                                   |
 | `config.aws.secretaccesskey`                | AWS Secret Access Key (optionnal if you use EC2 Instance Profile)                                                                                                                      |                                                                                                   |
 | `config.aws.region`                         | AWS Region (optionnal if you use EC2 Instance Profile)                                                                                                                                 |                                                                                                   |
 | `config.aws.cloudwatchlogs.loggroup`        | AWS CloudWatch Logs Group name, if not empty, CloudWatch Logs output is enabled                                                                                                        |                                                                                                   |

diff --git a/falcosidekick/templates/rbac.yaml b/falcosidekick/templates/rbac.yaml
@@ -4,11 +4,9 @@ kind: ServiceAccount
 metadata:
   name: {{ include "falcosidekick.fullname" . }}
   namespace: {{ .Release.Namespace }}
-  {{- if .Values.config.aws.accountid }}
-    {{- if .Values.config.aws.iamrole }}
+  {{- if .Values.config.aws.rolearn }}
   annotations:
-    eks.amazonaws.com/role-arn: arn:aws:iam::{{ .Values.config.aws.accountid }}:role/{{ .Values.config.aws.iamrole }}
-    {{- end }}
+    eks.amazonaws.com/role-arn: {{ .Values.config.aws.rolearn }}
   {{- end }}
   labels:
     app.kubernetes.io/name: {{ include "falcosidekick.name" . }}

diff --git a/falcosidekick/values.yaml b/falcosidekick/values.yaml
@@ -124,8 +124,7 @@ config:
     checkcert: true
 
   aws:
-    accountid: ""
-    iamrole: ""
+    rolearn: ""
     accesskeyid: ""
     secretaccesskey: ""
     region: ""