AWS EKS
Official · maintained by Marmotmarmotdata/eks Discover namespaces, services, workloads, and cron jobs from Amazon EKS clusters
The EKS plugin discovers namespaces, services, deployments, stateful sets, cron jobs, and pods from Amazon EKS clusters. It is the Kubernetes plugin's discovery engine with AWS IAM authentication, so the assets, lineage, and run history it produces are identical. See the Kubernetes plugin for details on what gets discovered and how resources are linked.
Authentication uses AWS IAM: on each run the plugin mints a short-lived token from the AWS credentials of wherever Marmot runs. There is no static token to store or rotate. This is the clean way to read an EKS cluster from an EC2 instance or another AWS workload.
Prerequisites
Two grants are needed on the AWS side, plus the read-only Kubernetes RBAC role.
First, the IAM identity that Marmot runs as needs an EKS access entry on the cluster (or a mapping in the older aws-auth ConfigMap).
Second, that access entry must map to a Kubernetes group bound to a read-only role:
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: marmot-discovery
rules:
- apiGroups: [""]
resources: ["namespaces", "services", "pods"]
verbs: ["get", "list"]
- apiGroups: ["apps"]
resources: ["deployments", "statefulsets", "replicasets"]
verbs: ["get", "list"]
- apiGroups: ["batch"]
resources: ["cronjobs", "jobs"]
verbs: ["get", "list"]Credentials resolve from the standard AWS chain: IRSA, EKS Pod Identity, an EC2 instance profile, or static keys. Set credentials.role to assume a role, or credentials.region to pin the region. When Marmot runs outside AWS, set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in its environment and the chain picks them up.
Connecting to a cluster
The plugin looks up the cluster's endpoint and CA certificate from the EKS API, so you only give it the cluster name and region. This needs the eks:DescribeCluster permission.
eks_cluster_name: "prod"
credentials:
region: "eu-west-1"Keyless authentication
On Marmot Cloud or Marmot Enterprise the pipeline can present its own identity instead of access keys. Register your Marmot instance as an IAM OIDC identity provider (client id sts.amazonaws.com), create a role whose trust policy allows sts:AssumeRoleWithWebIdentity for that provider with <issuer host>:sub equal to the pipeline's subject, pipeline:<name> as reported by the pipeline API, and set credentials.role_arn and credentials.region. No key exists anywhere; Marmot mints a short-lived token for each run.
In the UI
Point-and-click, no config file needed.
- 1 Open Runs Create pipeline
- 2 Pick AWS EKS from the plugin list.
- 3 Fill in the wizard, set a schedule, save.
With the CLI
Save a YAML config, then run marmot ingest.
name: my-eks-pipeline
runs:
- eks:
eks_cluster_name: "<eks_cluster_name>"$ marmot ingest -c ingest.yamlNot using plugins? Other ways to populate Marmot
Configuration
18 top-level fields. * marks required fields.
tags multiselect Tags to apply to discovered assets
external_links object[] External links to show on all assets
name string Display name for the link
icon string Icon identifier for the link
url string URL to the external resource
filter object Filter discovered assets by name (regex)
include multiselect Include patterns for resource names (regex)
exclude multiselect Exclude patterns for resource names (regex)
cluster_name string Cluster name to prefix asset names with
namespaces multiselect Namespaces to discover. Empty or ["*"] means all namespaces
exclude_namespaces multiselect Namespaces to skip when discovering all namespaces
- default
- ["kube-system","kube-public","kube-node-lease"]
label_selector string Only discover namespaced resources matching this label selector (e.g. team=data)
discover_namespaces bool Discover namespaces
- default
- true
discover_services bool Discover services
- default
- true
discover_deployments bool Discover deployments
- default
- true
discover_statefulsets bool Discover stateful sets
- default
- true
discover_cronjobs bool Discover cron jobs, with their recent job runs as run history
- default
- true
discover_pods bool Discover pods. Off by default because pods are short-lived and can flood the catalog
- default
- false
labels_to_metadata bool Include resource labels in asset metadata
- default
- true
annotations_to_metadata bool Include resource annotations in asset metadata
- default
- false
audience string Audience of the Marmot identity token. Derived from the credentials' federation settings; set it only when the cloud side expects another
credentials object AWS credentials configuration
use_default bool Use AWS credentials from environment or default profile (recommended)
- default
- true
id string AWS access key ID
secret password AWS secret access key
token password AWS session token
profile string AWS profile to use from shared credentials file
role_arn string IAM role to assume with the Marmot identity token (AssumeRoleWithWebIdentity); its trust policy names the Marmot issuer as an OIDC provider. Setting it federates: no keys are needed, and region is required. role, if also set, is assumed on top of it
role string AWS IAM role ARN to assume with AssumeRole from the base credentials (static keys, a profile, the default chain, or role_arn)
role_external_id string External ID for cross-account role assumption
region string AWS region for services
endpoint string Custom endpoint URL for AWS services
eks_cluster_name string EKS cluster name