Grant S3 access to notebook & dask pods

config/hubs/carbonplan.cluster.yaml

@@ -64,6 +64,7 @@ hubs:
                   name: Carbon Plan
                   url: https://carbonplan.org
           singleuser:
+            serviceAccountName: cloud-user-sa
             initContainers:
               # Need to explicitly fix ownership here, since EFS doesn't do anonuid
             - name: volume-mount-ownership-fix
@@ -185,6 +186,13 @@ hubs:
               cpu: 2
               memory: 4Gi
         gateway:
+          backend:
+            scheduler:
+              extraPodConfig:
+                serviceAccountName: cloud-user-sa
+            worker:
+              extraPodConfig:
+                serviceAccountName: cloud-user-sa
           resources:
             requests:
               cpu: 0.5

eksctl/carbonplan.jsonnet

@@ -1,12 +1,16 @@
 // Exports an eksctl config file for carbonplan cluster
-local cluster = import "./libsonnet/cluster.jsonnet";
 local ng = import "./libsonnet/nodegroup.jsonnet";
 
 // place all cluster nodes here
 local clusterRegion = "us-west-2";
 local masterAzs = ["us-west-2a", "us-west-2b", "us-west-2c"];
 local nodeAz = "us-west-2a";
 
+// List of namespaces where we have hubs deployed
+// Each will get a ServiceAccount that will get credentials to talk
+// to AWS services, via https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html
+local namespaces = ['staging', 'prod'];
+
 // Node definitions for notebook nodes. Config here is merged
 // with our notebook node definition.
 // A `node.kubernetes.io/instance-type label is added, so pods
@@ -33,12 +37,28 @@ local daskNodes = [
     { instancesDistribution+: { instanceTypes: ["r5.8xlarge"] }},
 ];
 
-cluster {
+{
+    apiVersion: 'eksctl.io/v1alpha5',
+    kind: 'ClusterConfig',
     metadata+: {
         name: "carbonplanhub",
-        region: clusterRegion
+        region: clusterRegion,
+        version: '1.19'
     },
     availabilityZones: masterAzs,
+    iam: {
+        withOIDC: true,
+
+        serviceAccounts: [{
+            metadata: {
+                name: "cloud-user-sa",
+                namespace: namespace
+            },
+            attachPolicyARNs:[
+                "arn:aws:iam::aws:policy/AmazonS3FullAccess"
+            ],
+        } for namespace in namespaces],
+    },
     nodeGroups: [
         ng {
             name: 'core-a',