A simple Lambda that takes its event and send it into a Service in EKS cluster.
The Lambda authenticates to the EKS using IAM role and a ClusterRole defining it permissions.
The Service type is ClusterIP, so the Lambda uses the
Kubernetes Service proxy API
which enables to send HTTP requests without exposing any endpoint.
With such a solution, connecting Kubernetes applications environment into cloud resources cannot be easier. The service is available only within the cluster but still can handle incoming events. The service also doesn't have an Authentication & Authorization layer because it is being taken care of by the cluster.
Note: The Lambda create a proxy channel between the event source and a Kubernetes Service. But it can do any other Kubernetes action as long as it has the right permissions.
- Create a simple HTTP service in your Kubernetes cluster:
kubectl apply -f ./simple-service/simple-service.yml - Create an IAM role for your Lambda
- Add IAM role authentication to the EKS
- Add IAM role user cluster permissions
kubectl apply -f ./eks-Lambda/lambda-cluster-role.yml- Create a new Lambda with the IAM role and your code - Using zip or ECR image.
- Configure the new Lambda with the following environment variables:
CLUSTER_NAME=YOUR EKS CLUSTER NAME
CLUSTER_REGION=YOUR EKS CLUSTER REGION
SERVICE_NAMESPACE= YOUR K8S SERVICE NAMESPACE
SERVICE_NAME= YOUR K8S SERVICE NAME
SERVICE_PORT= YOUR K8S SERVICE PORT
SERVICE_REQUEST_TIMEOUT= TIMEOUT
SERVICE_REQUEST_METHOD=THE SERVICE EXPOSED METHOD
SERVICE_REQUEST_PATH=THE SERVICE URITest your Lambda with such as event:
{
"name": "John",
"age": 24
}The response should look like:
{
"lambda_request_id": "12341234-1234-1234-1234-123412341234",
"lambda_arn": "arn:aws:lambda:YOUR_REGION:YOUR_ACCOUNT:function:YOUR_FUNCTION",
"status_code": 200,
"event": {
"name": "John",
"age": 24
},
"response": {
"status": 200,
"data": "{'message':'Hello world from John','event':{'name':'John','age':24}}"
}
}