Access an Amazon Neptune database from an Amazon EKS container

Verify the cluster context.

Before you interact with your Amazon EKS cluster by using Helm or other command-line tools, you must define environment variables that encapsulate your cluster's details. These variables are used in subsequent commands to ensure that they target the correct cluster and resources.

First, confirm that you are operating within the correct cluster context. This ensures that any subsequent commands are sent to the intended Kubernetes cluster. To verify the current context, run the following command.

kubectl config current-context

Define the CLUSTER_NAME variable.

Define the CLUSTER_NAME environment variable for your Amazon EKS cluster. In the following command, replace the sample value us-west-2 with the correct AWS Region for your cluster. Replace the sample value eks-workshop with your existing cluster name.

export CLUSTER_NAME=$(aws eks describe-cluster --region us-west-2 --name eks-workshop --query "cluster.name" --output text)

Validate output.

To validate that the variables have been set properly, run the following command.

echo $CLUSTER_NAME

Verify that the output of this command matches the input you specified in the previous step.

Create a service account.

You use IAM roles for service accounts to map your Kubernetes service accounts to IAM roles, to enable fine-grained permissions management for your applications that run on Amazon EKS. You can use eksctl to create and associate an IAM role with a specific Kubernetes service account within your Amazon EKS cluster. The AWS managed policy NeptuneFullAccess allows write and read access to your specified Neptune cluster.

Create a service account that you want to associate with an AWS managed policy named NeptuneFullAccess.

eksctl create iamserviceaccount --name eks-neptune-sa --namespace default --cluster $CLUSTER_NAME --attach-policy-arn arn:aws:iam::aws:policy/NeptuneFullAccess --approve --override-existing-serviceaccounts

where eks-neptune-sa is the name of the service account that you want to create.

Upon completion, this command displays the following response:

2024-02-07 01:12:39 [ℹ] created serviceaccount "default/eks-neptune-sa"

Verify that the account is set up properly.

Make sure that the eks-neptune-sa service account is set up correctly in the default namespace in your cluster.

kubectl get sa eks-neptune-sa -o yaml

The output should look like this:

apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789123:role/eksctl-eks-workshop-addon-iamserviceaccount-d-Role1-Q35yKgdQOlmM
  creationTimestamp: "2024-02-07T01:12:39Z"
  labels:
    app.kubernetes.io/managed-by: eksctl
  name: eks-neptune-sa
  namespace: default
  resourceVersion: "5174750"
  uid: cd6ba2f7-a0f5-40e1-a6f4-4081e0042316

Check connectivity.

Deploy a sample pod called pod-util and check connectivity with Neptune.

apiVersion: v1
kind: Pod
metadata:
  name: pod-util
  namespace: default
spec:
  serviceAccountName: eks-neptune-sa
  containers:
  - name: pod-util
    image: public.ecr.aws/patrickc/troubleshoot-util
    command:
      - sleep
      - "3600"
    imagePullPolicy: IfNotPresent

kubectl apply -f pod-util.yaml

kubectl exec --stdin --tty pod-util -- /bin/bash
bash-5.1# curl -X POST -d '{"gremlin":"g.V().limit(1)"}' https://db-neptune-1.cluster-xxxxxxxxxxxx.us-west-2.neptune.amazonaws.com:8182/gremlin
{"requestId":"a4964f2d-12b1-4ed3-8a14-eff511431a0e","status":{"message":"","code":200,"attributes":{"@type":"g:Map","@value":[]}},"result":{"data":{"@type":"g:List","@value":[]},"meta":{"@type":"g:Map","@value":[]}}}
bash-5.1# exit
exit

Enable IAM database authentication.

By default, IAM database authentication is disabled when you create a Neptune DB cluster. You can enable or disable IAM database authentication by using the AWS Management Console.

Follow the steps in the AWS documentation to enable IAM database authentication in Neptune.

Verify connections.

In this step, you interact with the pod-util container, which is already in running status, to install awscurl and verify the connection.