Skip to content
Buildpacks on EKS

IAM map

IRSA
IAM Roles for Service Accounts — pods use a Kubernetes service account annotated with an IAM role ARN. is not the only auth in this lab — and IRSA alone is not enough for kpack to push to ECR
Amazon Elastic Container Registry — stores OCI images built by kpack; EKS pulls from here..

Auth paths

Section titled “Auth paths”
Actor Mechanism Permission
You → CodeCommit
AWS managed Git hosting — GitHub alternative used for app source and deploy manifests in this lab.		 AWS SSO / CLI GitPush, GitPull
kpack
Kubernetes-native build service that runs CNB builds on-cluster and pushes images to a registry. → CodeCommit		 K8s secret codecommit-credentials (HTTPS git user) Clone pulse-app
kpack → ECR docker-registry secret ecr-credentials on kpack-sa Push image tags
kpack → AWS APIs IRSA on kpack-sa → role cluster-1-kpack-ecr ECR API policy (lab attach)
EKS
Amazon Elastic Kubernetes Service — this lab uses cluster name `cluster-1`. nodes → ECR		 Node / Auto Mode pull path Pull pulse:main
Argo CD
Argo CD — GitOps controller that syncs cluster state from Git repositories. → CodeCommit		 Capability role ArgoCDCapabilityRole codecommit:GitPull on pulse-deploy
Argo CD → EKS Capability role + access entry Deploy Applications

Named principals (lab defaults)

Section titled “Named principals (lab defaults)”
Name Type Created on Purpose
ArgoCDCapabilityRole IAM role Argo CD capability Trust capabilities.eks.amazonaws.com
ArgoCDCodeCommitPulseDeploy Inline role policy same GitPull on pulse-deploy
cluster-1-kpack-ecr IAM role (IRSA) kpack via GitOps Bound to SA kpack-sa / default
cluster-1-kpack-ecr-policy Customer-managed policy same From demo/platform/kpack/irsa-policy.json
kpack-codecommit-git IAM user same HTTPS Git credentials; AWSCodeCommitPowerUser

Generated local JSON (not committed): demo/config/iam/argocd-trust-policy.json, demo/config/iam/argocd-codecommit-policy.json.

kpack → ECR

Section titled “kpack → ECR”

kpack authenticates to registries with annotated secrets — IRSA alone is not enough. Without ecr-credentials, ClusterBuilder fails with ECR 401 Unauthorized.

  1. Create a docker-registry secret for ECR.
  2. Annotate kpack.io/docker=<registry>.
  3. List it on kpack-sa secrets:.

ECR passwords expire (~12h). Re-create the secret if builds start failing auth.

IRSA on kpack-sa still attaches the ECR push policy for AWS API access and consistency with the walkthrough.

CodeCommit git credentials for kpack

Section titled “CodeCommit git credentials for kpack”

SSO principals cannot create CodeCommit HTTPS Git credentials. Use the dedicated IAM user above. Store as kubernetes.io/basic-auth secret codecommit-credentials with annotation kpack.io/git (see kpack via GitOps).

Argo CD capability

Section titled “Argo CD capability”

No IRSA on workload pods for Git — the capability role pulls manifests from CodeCommit directly. Settings → Repositories staying empty in the UI is expected when auth is the capability role, not a repo secret.