PingOne Privilege

Configuring Amazon EKS access

After you onboard an Amazon Web Services (AWS) account to PingOne Privilege, you can manage access to your Amazon Elastic Kubernetes Service (EKS) clusters and namespaces at a granular level.

If an EKS cluster is configured to use the EKS API for authentication in combination with the aws-auth ConfigMap, PingOne Privilege automatically falls back to using the EKS API.

Onboard the cluster in PingOne Privilege

  1. In the PingOne Privilege admin console, go to Cloud > Clouds.

  2. On the tile for your AWS account, click More Info.

  3. Click Rescan.

  4. After the rescan completes, go to Cloud > Targets.

  5. Find the newly discovered cluster and click More Info.

  6. Click the Manage toggle to the right (blue) to onboard it.

Learn more in Onboarding target resources.

Additional considerations

Private clusters

If your EKS cluster is in a private VPC with no inbound internet access, you must deploy a PingOne Privilege gateway or relay within the same VPC. Learn more in Configuring gateways.

Default permissions

By default, an administrative user is granted the ProcyonKubeCtlView permission. After connecting to PingOne Privilege using the Endpoint Controller, the user’s Kubernetes context will be automatically available in their local ~/.kube/config file.