aws / aws/amazon-eks-pod-identity-webhook
Invalid k8s service account token
- Dominant language
- Go
- Stars
- 691
- Forks
- 202
- Avg merge
- 4h 38m
- Merged PRs (30d)
- 1
Description
**What happened**:
The file /var/run/secrets/eks.amazonaws.com/serviceaccount/token contained a malformed token of the form
```
11:11:49.782386 40364 v3.go:79] EOF
```
**What you expected to happen**:
The token should not have been malformed
**How to reproduce it (as minimally and precisely as possible)**:
Not reproducible
**Anything else we need to know?**:
Since the token was malformed, and since we use EKS IRSA, the AWS STS call was failing
**Environment**: EKS
- AWS Region: sa-east-1
- EKS Platform version (if using EKS, run `aws eks describe-cluster --name --query cluster.platformVersion`): eks.7
- Kubernetes version (if using EKS, run `aws eks describe-cluster --name --query cluster.version`): 1.29
- Webhook Version: unsure
Contributor guide
Research direction
Start by reviewing the malformed token at /var/run/secrets/eks.amazonaws.com/serviceaccount/token alongside the EKS 1.29, platform eks.7, and IRSA details in the report. No repository file, test, webhook version, or reproduction steps are named, so first determine whether the webhook can produce this token and establish a reproducible failure. Done means identifying the cause and preventing malformed tokens with regression coverage.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, go, kubernetes
- Domain
- authentication, cloud, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100