amazon-eks-pod-identity-webhook

amazon-eks-pod-identity-webhook copied to clipboard

Unable to pass the credentials to docker inside docker

4

**What happened**: M running a pod with a service account(annotated with a role). Inside the pods these environment variables are mounted : AWS_WEB_IDENTITY_TOKEN_FILE AWS_REGION AWS_ROLE_ARN inside the pod, when m...

shardulsrivastava

**What would you like to be added**: Documentation should: 1. Call out use of WebIdentityTokenCredentialProvider in the default CrentialProvider chain. 2. Dockerfile must explicitly specify the non-root `USER` directive This...

rbranche

Decouple IAM Role conditions from kubernetes IdP details

1

**What would you like to be added**: I'd like to decouple the IAM roles' trust policy from kubernetes cluster details, while maintaining the service account level access controls. The condition...

cgetzen

Seeing issue with aws-iam-token missing for all pods

2

HI Im seeing the below issue when bringing up the new pods Almost all the pods in namespace have this issue..I checked all teh resources oidc role policy etc..everything looks...

saiharshitachava

Confusion with k8s sa pki vs amazon-eks-pod-identity-webhook pki keypairs

1

I am running this amazon-eks-pod-identity-webhook in several self-hosted k8s in aws. We were on k8s 1.17.x now while upgrading to k8s 1.20.x, we noticed that kubeadm spits out: Default k8s...

bjethwan

Readiness Gate

4

**What would you like to be added**: It would be nice to have [a readiness gate](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-readiness-gate) that checks if the AWS role defined in the service account was successfully picked...

encron

Skip container annotations is not working for me.

2

**What happened**: I have added below annotation as mentioned in document but still AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE environmental variable is getting added to the ignored contaIners. ``` apiVersion: v1 kind: Pod...

Nitesh-vaidyanath

Tokens and env vars stopped being injected

3

**What happened**: A few days ago, we noticed that some operations that used to succeed on AWS from our pods started to receive 403s. After a lot of investigation, we...

conradoverta

Support annotations for limiting expose of the web identity token file to particular containers

1

**What would you like to be added**: Annotations (say `eks.amazonaws.com/include-containers`, `eks.amazonaws.com/exclude-containers`,`eks.amazonaws.com/include-init-containers`, `eks.amazonaws.com/exclude-init-containers`) to whitelist/blacklist containers/init containers from having access to the injected projected ServiceAccount token **Why is this needed**: Currently...

dippynark

vendor bump to gogo/protobuf 1.3.2

1

CVE-2021-3121 ( https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3121 ) covers an issue in GoGo Protobuf. It is fixed with version 1.3.2. Update the vendoring of gogo/protobuf appropriately. `go get -u github.com/gogo/protobuf ; go mod tidy...

joelddiaz