Add support for EKS Pod Identity

.github/workflows/branch-changes-release.yaml

@@ -59,5 +59,9 @@ jobs:
               owner: context.repo.owner,
               repo: context.repo.repo,
               body: `Changes release to Replicated on channel ${{ steps.generate-channel-info.outputs.channel-name }}! Check the [Replicated Dashboard](https://vendor.replicated.com/apps/carto/channels) for more details.
-               If you need to test the changes, you can assign the channel to your customer and download the latest version from the Admin Console.`
+               If you need to test the changes, you can assign the channel to your customer and download the latest version from the Admin Console. Deploy the changes using the following command:
+               \`\`\` bash
+                kubectl kots install carto/${{ steps.generate-channel-info.outputs.channel-name }} -n <namespace>
+               \`\`\`
+              `
             })

chart/templates/_commonChecks.tpl

@@ -8,7 +8,7 @@ Return common collectors for preflights and support-bundle
       namespace: {{ .Release.Namespace | quote }}
       timeout: 180s
       podSpec:
-        {{- if .Values.commonBackendServiceAccount.enableGCPWorkloadIdentity }}
+        {{- if .Values.commonBackendServiceAccount.name }}
         serviceAccountName: {{ template "carto.commonSA.serviceAccountName" . }}
         {{- end }}
         restartPolicy: Never

manifests/kots-config.yaml

@@ -494,16 +494,33 @@ spec:
           default: repl{{ if ConfigOptionEquals "replicatedLicenseType" "dev"}}repl{{ ConfigOption "derivedSelfHostedGCPProjectId"}}repl{{ end }}
 
         # AWS
+        ## EKS Pod Identity
+        - name: enableAWSEksPodIdentity
+          title: AWS EKS Pod Identity
+          when: '{{repl (ConfigOptionEquals "storageBucketsBehaviour" "custom_aws_s3") }}'
+          help_text: |-
+            The CARTO APIs running on your infrastructure are going to use EKS Pod Identity to access to Amazon Web Services.
+            [More info](https://docs.carto.com/carto-self-hosted/guides/use-eks-pod-identity-in-aws).
+          type: bool
+          default: "0"
+        - name: eksPodIdentityServiceAccountName
+          title: Kubernetes EKS Pod Identity service account name
+          when: '{{repl (ConfigOptionEquals "enableAWSEksPodIdentity" "1") }}'
+          required: true
+          type: text
+          help_text: |-
+            Name of the kubernetes service account that you created in the namespace to configure EKS Pod Identity.
+            [More info](https://docs.carto.com/carto-self-hosted/guides/use-eks-pod-identity-in-aws).
         - name: storageBucketsAwsAccessKeyId
           title: The AccessKey ID for S3 buckets
           type: text
           required: true
-          when: '{{repl (ConfigOptionEquals "storageBucketsBehaviour" "custom_aws_s3") }}'
+          when: '{{repl and (ConfigOptionEquals "storageBucketsBehaviour" "custom_aws_s3") (not (ConfigOptionEquals "enableAWSEksPodIdentity" "1")) }}'
         - name: storageBucketsAwsAccessKeySecret
           title: The AccessKey Secret for S3 buckets
           type: text
           required: true
-          when: '{{repl (ConfigOptionEquals "storageBucketsBehaviour" "custom_aws_s3") }}'
+          when: '{{repl and (ConfigOptionEquals "storageBucketsBehaviour" "custom_aws_s3") (not (ConfigOptionEquals "enableAWSEksPodIdentity" "1")) }}'
         - name: storageBucketsAwsS3Region
           title: Buckets AWS S3 Region
           when: '{{repl (ConfigOptionEquals "storageBucketsBehaviour" "custom_aws_s3") }}'
@@ -790,10 +807,10 @@ spec:
           help_text: |-
             The PostgreSQL schema where the DO is installed (i.e. `carto`)
 
-        ## Workload Identity
-        # Google
+        ## GKE Workload Identity
         - name: enableGoogleWorkloadIdentity
           title: Google Workload Identity
+          when: '{{repl (ConfigOptionEquals "storageBucketsBehaviour" "custom_aws_s3") }}'
           help_text: |-
             The CARTO APIs running on your infrastructure are going to use Workload Identity to access to Google Cloud Platform.
             [More info](https://docs.carto.com/carto-self-hosted/guides/use-workload-identity-in-gcp).

manifests/kots-helm.yaml

@@ -163,7 +163,8 @@ spec:
         registry: '{{repl HasLocalRegistry | ternary LocalRegistryHost "registry.self-hosted.carto.com/proxy/carto/gcr.io/carto-onprem-artifacts" }}'
     workspaceApi:
       image:
-        registry: '{{repl HasLocalRegistry | ternary LocalRegistryHost "registry.self-hosted.carto.com/proxy/carto/gcr.io/carto-onprem-artifacts" }}'
+        registry: '{{repl HasLocalRegistry | ternary LocalRegistryHost "registry.self-hosted.carto.com/proxy/carto/gcr.io/carto-artifacts" }}'
+        tag: feature_sc_438178_adapt_backend_code_to_start_using_the_credentials
     workspaceSubscriber:
       image:
         registry: '{{repl HasLocalRegistry | ternary LocalRegistryHost "registry.self-hosted.carto.com/proxy/carto/gcr.io/carto-onprem-artifacts" }}'
@@ -175,7 +176,8 @@ spec:
         registry: '{{repl HasLocalRegistry | ternary LocalRegistryHost "registry.self-hosted.carto.com/proxy/carto/gcr.io/carto-onprem-artifacts" }}'
     tenantRequirementsChecker:
       image:
-        registry: '{{repl HasLocalRegistry | ternary LocalRegistryHost "registry.self-hosted.carto.com/proxy/carto/gcr.io/carto-onprem-artifacts" }}'
+        registry: '{{repl HasLocalRegistry | ternary LocalRegistryHost "registry.self-hosted.carto.com/proxy/carto/gcr.io/carto-artifacts" }}'
+        tag: feature_sc_438178_adapt_backend_code_to_start_using_the_credentials
     routerMetrics:
       image:
         registry: '{{repl HasLocalRegistry | ternary LocalRegistryHost "registry.self-hosted.carto.com/proxy/carto/gcr.io/carto-onprem-artifacts" }}'
@@ -614,6 +616,14 @@ spec:
           # When enabling gke workload identity, the k8s SA should be created by the customer to be able to run preflights
           create: false
           name: '{{repl ConfigOption "k8sWorkloadIdentityServiceAccountName" }}'
+    # EKS Pod Identity
+    - when: '{{repl ConfigOptionEquals "enableAWSEksPodIdentity" "1" }}'
+      recursiveMerge: true
+      values:
+        commonBackendServiceAccount:
+          # When enabling gke workload identity, the k8s SA should be created by the customer to be able to run preflights
+          create: false
+          name: '{{repl ConfigOption "eksPodIdentityServiceAccountName" }}'
     # Local Registry
     - when: '{{repl (HasLocalRegistry) }}'
       recursiveMerge: true