aws / aws/amazon-eks-pod-identity-webhook

Invalid k8s service account token

Open
#232 5 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
691
Forks
202
Avg merge
4h 38m
Merged PRs (30d)
1

Description

**What happened**:
The file /var/run/secrets/eks.amazonaws.com/serviceaccount/token contained a malformed token of the form
```
11:11:49.782386 40364 v3.go:79] EOF
```

**What you expected to happen**:
The token should not have been malformed

**How to reproduce it (as minimally and precisely as possible)**:
Not reproducible

**Anything else we need to know?**:
Since the token was malformed, and since we use EKS IRSA, the AWS STS call was failing

**Environment**: EKS
- AWS Region: sa-east-1
- EKS Platform version (if using EKS, run `aws eks describe-cluster --name --query cluster.platformVersion`): eks.7
- Kubernetes version (if using EKS, run `aws eks describe-cluster --name --query cluster.version`): 1.29
- Webhook Version: unsure

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the malformed token at /var/run/secrets/eks.amazonaws.com/serviceaccount/token alongside the EKS 1.29, platform eks.7, and IRSA details in the report. No repository file, test, webhook version, or reproduction steps are named, so first determine whether the webhook can produce this token and establish a reproducible failure. Done means identifying the cause and preventing malformed tokens with regression coverage.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, go, kubernetes
Domain
authentication, cloud, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.