Irsa on Confidential Containers

AWS

Mon, 01 Jan 0001 00:00:00 +0000

This documentation will walk you through setting up CAA (a.k.a. Peer Pods) on AWS Elastic Kubernetes Service (EKS). It explains how to deploy:

A single worker node Kubernetes cluster using Elastic Kubernetes Service (EKS)
CAA on that Kubernetes cluster
An Nginx pod backed by CAA pod VM

Pre-requisites

Install Required Tools:

Install kubectl,
Install Helm,
Install aws CLI tool,
Install eksctl CLI tool,
Ensure that the tools curl, git and jq are installed.

AWS Preparation

Set AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY (or AWS_PROFILE) and AWS_REGION for AWS CLI access

Note: As an alternative to static credentials, you can use IRSA (IAM Roles for Service Accounts) on EKS. With IRSA, the CAA pods authenticate via OIDC — no static AWS keys are stored in Kubernetes secrets. You still need AWS_REGION and temporary credentials for the cluster setup steps below.