amazon-eks-pod-identity-webhook

Amazon EKS Pod Identity Webhook

This webhook is for mutating pods that will require AWS IAM access.

Note

After version v0.3.0, --in-cluster=true no longer works and is deprecated. Please use --in-cluster=false and manage the cluster certificate with cert-manager or some other external certificate provisioning system. This is because certificates using the legacy-unknown signer are no longer signed when using the v1 certificates API.

EKS Walkthrough

1. Create an OIDC provider in IAM for your cluster. You can find the OIDC discovery endpoint by describing your EKS cluster.
   bash复制

   aws eks describe-cluster --name $CLUSTER_NAME --query cluster.identity.oidc

   And enter "sts.amazonaws.com" as the client-id
2. Create an IAM role for your pods and modify the trust policy to allow your pod's service account to use the role:

…

1. Modify your pod's service account to be annotated with the ARN of the role you want the pod to use

…

1. All new pods launched using this Service Account will be modified to use IAM for pods. Below is an example pod spec with the environment variables and volume fields added by the webhook.

…

Usage with Windows container workloads

To ensure workloads are scheduled on windows nodes have the right environment variables, they must have a nodeSelector targeting windows it must run on. Workloads targeting windows nodes using nodeAffinity are currently not supported.

  nodeSelector:
    beta.kubernetes.io/os: windows

Or for Kubernetes 1.14+

  nodeSelector:
    kubernetes.io/os: windows

Usage with non-root container user

When running a container with a non-root user, you need to give the container access to the token file by setting the fsGroup field in the securityContext object.

Usage

…

AWS_DEFAULT_REGION Injection

When the aws-default-region flag is set this webhook will inject AWS_DEFAULT_REGION and AWS_REGION in mutated containers if AWS_DEFAULT_REGION and AWS_REGION are not already set.

AWS_STS_REGIONAL_ENDPOINTS Injection

When the sts-regional-endpoint flag is set to true, the webhook will inject the environment variable AWS_STS_REGIONAL_ENDPOINTS with the value set to regional. This environment variable will configure the AWS SDKs to perform the sts:AssumeRoleWithWebIdentity call to get credentials from the regional endpoint, instead of the global endpoint in us-east-1. This is desirable in almost all cases, unless the STS regional endpoint is disabled in your account.

You can also enable this per-service account with the annotation eks.amazonaws.com/sts-regional-endpoints set to "true".

pod-identity-webhook ConfigMap

The purpose of the pod-identity-webhook ConfigMap is to simplify the mapping of IAM roles and ServiceAccount when using tools/installers like kOps that directly manage IAM roles and trust policies. When using these tools, users do not need to configure annotations on the ServiceAccounts as the tools already know the relationship can relay it to the webhook.

When the watch-config-map flag is set to true, the webhook will watch the pod-identity-webhook ConfigMap in the namespace configured by the --namespace flag for additional ServiceAccounts. The webhook will mutate Pods configured to use these ServiceAccounts even if they have no annotations.

Should the same ServiceAccount both be referenced both in the ConfigMap and have annotations, the annotations takes presedence.

Here is an example ConfigMap:

…

Container Images

Container images for amazon-eks-pod-identity-webhook can be found on ECR.

Installation

Pre-requisites

You must install cert-manager as it is a pre-requisite for below deployments. (See cert-manager installation)

In-cluster

You can use the provided configuration files in the deploy directory, along with the provided Makefile.

make cluster-up IMAGE=amazon/amazon-eks-pod-identity-webhook:latest

This will:

• Create a service account, role, cluster-role, role-binding, and cluster-role-binding that the deployment requires
• Create the deployment, service, ClusterIssuer, certificate, and mutating webhook in the cluster
• Use in-cluster=false so that the webhook reloads certificates from the filesystem rather than creating CSRs to request certificates (using CSRs is now deprecated and will not work versions later than v0.3.0).

For self-hosted API server configuration, see see SELF_HOSTED_SETUP.md

On API server

TODO

Notes

With the upgrade to client-go 1.18, certificate_manager_server_expiration_seconds metric has been removed by an upstream commit kubernetes/kubernetes#85874. A new metric certificate_manager_server_rotation_seconds is added which tracks the time a certificate was valid before getting rotated.

Code of Conduct

See CODE_OF_CONDUCT.md

License

Apache 2.0 - Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved. See LICENSE