aws / aws/amazon-eks-pod-identity-webhook

Unable to pass the credentials to docker inside docker

Open
#44 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
691
Forks
202
Avg merge
4h 38m
Merged PRs (30d)
1

Description

**What happened**:
M running a pod with a service account(annotated with a role). Inside the pods these environment variables are mounted :

AWS_WEB_IDENTITY_TOKEN_FILE
AWS_REGION
AWS_ROLE_ARN

inside the pod, when m trying to run a docker command like this :

```bash
docker run --rm \
-e AWS_WEB_IDENTITY_TOKEN_FILE \
-e AWS_REGION \
-e AWS_ROLE_ARN \
-v "/var/run/secrets/eks.amazonaws.com/serviceaccount/token:/var/run/secrets/eks.amazonaws.com/serviceaccount/token" \
node:10.13-alpine \
sh -c "sls deploy"
```

it is unable to use this credentials, looks like this path can't be mounted corretly:

`/var/run/secrets/eks.amazonaws.com/serviceaccount/token`

**What you expected to happen**:
docker command on the pod should run successfully.

**How to reproduce it (as minimally and precisely as possible)**:
Follow [this](https://docs.aws.amazon.com/eks/latest/userguide/specify-service-account-role.html) to setup EKS IAM service account and then run the above docker run command.

**Anything else we need to know?**:

**Environment**:
- AWS Region: `ap-southeast-1`
- EKS Platform version (if using EKS, run `aws eks describe-cluster --name --query cluster.platformVersion`): `eks.9`
- Kubernetes version (if using EKS, run `aws eks describe-cluster --name --query cluster.version`): `1.14`
- Webhook Version:

Contributor guide

Open the contributing guide

Research direction

Reproduce the report by following the linked EKS IAM service-account setup and running the provided docker command in a pod. Start by checking how the webhook-mounted token path behaves across the pod and nested Docker container; done means the nested command can use the service-account credentials and `sls deploy` completes successfully.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, docker, kubernetes
Domain
authentication, cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
32/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.