Loft vcluster support for IRSA on top of EKS

Good Day!

Thanks for connecting with us at re:Post.

As per your notes, I can understand that you wish to connect virtual cluster with other AWS Services such as RDS, SES etc. within the same. Please correct me if I have misunderstood your concern.

Please note, as vcluster is a 3rd party tool, hereby I will able to respond at my best-efforts what I found via their resources and AWS integration possibilities with it.

As test-replicated the vcluster at my end before replying you here, I found that vcluster itself is limited to a single namespace on a host cluster (let's say EKS Cluster A). When being created, it creates below resources:

serviceaccount/vc-my-vcluster | serviceaccount/vc-workload-my-vcluster | configmap/my-vcluster-coredns | configmap/my-vcluster-init-manifests | role.rbac.authorization.k8s.io/my-vcluster | rolebinding.rbac.authorization.k8s.io/my-vcluster | service/my-vcluster | service/my-vcluster-headless | statefulset.apps/my-vcluster

Post-checking the RBAC permissions and architecture of vcluster > It's clear that permissions need to be routed via host cluster only. As mentioned already, vcluster is out of expertise for us, a best approach is to reach vcluster team by creating issue [1]. If you think there can be a follow-up required at AWS End, please feel free to create case from the account where you have the host cluster at [2].

Thanks for your understanding & cooperation! Have an AWSome Day Ahead & Stay Safe!

References:

[1] https://github.com/loft-sh/vcluster/issues

[2] https://aws.amazon.com/contact-us/