PingOne Privilege

Configuring AWS Elastic Kubernetes Service (Amazon EKS) access

After you onboard an AWS account to PingOne Privilege, you can manage access to your EKS clusters and namespaces at a granular level.

If an EKS cluster is configured to use the EKS API for authentication in combination with the aws-auth ConfigMap, PingOne Privilege automatically falls back to using the EKS API.

Onboard the cluster in PingOne Privilege

  1. In the PingOne Privilege admin console, go to Cloud > Clouds.

  2. On the tile for your AWS account, click More Info.

  3. Click Rescan.

  4. After the rescan completes, go to Cloud > Targets.

  5. Find the newly discovered cluster and click More Info.

  6. Enable the Manage toggle to onboard it.

For more details, see Onboarding target resources.

Additional considerations

Private clusters

If your EKS cluster is in a private VPC with no inbound internet access, you must deploy a PingOne Privilege gateway or relay within the same VPC. Learn more in Configuring gateways.

Default permissions

By default, an administrative user is granted the ProcyonKubeCtlView permission. After connecting to PingOne Privilege using the Endpoint Controller, the user’s Kubernetes context will be automatically available in their local ~/.kube/config file.