aws / aws/amazon-eks-pod-identity-webhook

Inject AWS_REGION/AWS_DEFAULT_REGION even if pod doesn't have serviceAccount

Open
#192 0 comments 7 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
691
Forks
202
Avg merge
4h 38m
Merged PRs (30d)
1

Description

**What would you like to be added**:
I would like an option (ideally, in EKS) to inject AWS_REGION and AWS_DEFAULT_REGION into all pods, even if they don't have service accounts. (Right now, this only happens if I have service accounts.)

**Why is this needed**:
I have scenarios where the code running in my pods need to be aware of their AWS region, even if they don't use STS. The main one is if I'm using an application performance monitoring (APM) agent like NewRelic, Splunk, or OpenTelemetry, where I might tag my telemetry with the current region, so I can identify performance issues endemic to one region but not another.

For example, in my newrelic.yml, I do this:
`labels: “region:<%= ENV.fetch(‘AWS_REGION’){ ‘null’ } %>;”`

...and in NewRelic, I can query and filter on application data just from us-east-2 or us-east-1. I need AWS_REGION to be set for this, though.

Contributor guide

Open the contributing guide

Research direction

Read the webhook's existing service-account-based environment injection behavior and determine where AWS_REGION and AWS_DEFAULT_REGION are added. Verify the desired behavior for pods without service accounts while preserving the current behavior for pods that do have them; the payload does not name specific files or tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, go, kubernetes
Domain
cloud, devops, infrastructure
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.