Connect SeekrFlow cloud identity

You created the role or managed identity in Set up cloud identity, and recorded its settings in your values file. This page connects it to SeekrFlow’s service accounts.

Skip this page if either applies:

On-premises deployment – Storage credentials come from a Kubernetes secret you create in Create SeekrFlow secrets. You don’t need a cloud identity.
Amazon Web Services (AWS) Identity and Access Management (IAM) roles for service accounts – The role annotation in your values file connects the identity.

With the sfe CLI
Without the sfe CLI

Your AWS identity needs these permissions:

iam:UpdateAssumeRolePolicy and iam:PassRole on the SeekrFlow role
eks:CreatePodIdentityAssociation and eks:ListPodIdentityAssociations on the cluster

Preview the changes

Replace <role-arn> with the Amazon Resource Name (ARN) of the role you created for SeekrFlow:

sfe cloud-identity aws -f my-values.yaml --role-arn <role-arn> --dry-run

Connect the identity

sfe cloud-identity aws -f my-values.yaml --role-arn <role-arn>

The command updates the role’s trust policy and creates an Amazon Elastic Kubernetes Service (Amazon EKS) Pod Identity association for each SeekrFlow service account.

Restart External Secrets Operator

External Secrets Operator gets its AWS credentials only when it starts. If you use it, restart it now:

kubectl rollout restart deployment external-secrets -n external-secrets

Your AWS identity needs iam:PassRole on the SeekrFlow role and eks:CreatePodIdentityAssociation on the cluster.Your role’s trust policy must already allow Amazon EKS Pod Identity. See Set up cloud identity. Create a Pod Identity association for each of these service accounts:

Namespace	Service accounts
`seekrflow`	`seekrflow-agent` `seekrflow-auth` `seekrflow-data-ready` `seekrflow-frontend` `seekrflow-flowmodel` `seekrflow-explainability` `seekrflow-ingestion` `seekrflow-keycloak` `seekrflow-license` `seekrflow-operator` `seekrflow-router` `seekrflow-serving` `seekrflow-training` `seekrflow-tool` `seekrflow-mlflow-run` `seekrflow-mlflow-tracking` `seekrflow-lora-controller` `seekrflow-argo-workflows-workflow-controller`
`argo-workflows`	`seekrflow-argo-workflows-workflow-controller`
`external-secrets`	`external-secrets`, if you use External Secrets Operator

For example:

aws eks create-pod-identity-association \
  --cluster-name <cluster-name> \
  --namespace seekrflow \
  --service-account seekrflow-agent \
  --role-arn <role-arn>

External Secrets Operator gets its AWS credentials only when it starts. If you use it, restart it now:

kubectl rollout restart deployment external-secrets -n external-secrets

SeekrFlow Self-Managed

Plan a SeekrFlow deployment

Provision SeekrFlow dependencies

Prepare to install SeekrFlow

Deploy SeekrFlow

Operate SeekrFlow

Reference