aws / aws/amazon-eks-pod-identity-webhook
Unable to pass the credentials to docker inside docker
- Dominant language
- Go
- Stars
- 691
- Forks
- 202
- Avg merge
- 4h 38m
- Merged PRs (30d)
- 1
Description
**What happened**:
M running a pod with a service account(annotated with a role). Inside the pods these environment variables are mounted :
AWS_WEB_IDENTITY_TOKEN_FILE
AWS_REGION
AWS_ROLE_ARN
inside the pod, when m trying to run a docker command like this :
```bash
docker run --rm \
-e AWS_WEB_IDENTITY_TOKEN_FILE \
-e AWS_REGION \
-e AWS_ROLE_ARN \
-v "/var/run/secrets/eks.amazonaws.com/serviceaccount/token:/var/run/secrets/eks.amazonaws.com/serviceaccount/token" \
node:10.13-alpine \
sh -c "sls deploy"
```
it is unable to use this credentials, looks like this path can't be mounted corretly:
`/var/run/secrets/eks.amazonaws.com/serviceaccount/token`
**What you expected to happen**:
docker command on the pod should run successfully.
**How to reproduce it (as minimally and precisely as possible)**:
Follow [this](https://docs.aws.amazon.com/eks/latest/userguide/specify-service-account-role.html) to setup EKS IAM service account and then run the above docker run command.
**Anything else we need to know?**:
**Environment**:
- AWS Region: `ap-southeast-1`
- EKS Platform version (if using EKS, run `aws eks describe-cluster --name --query cluster.platformVersion`): `eks.9`
- Kubernetes version (if using EKS, run `aws eks describe-cluster --name --query cluster.version`): `1.14`
- Webhook Version:
Contributor guide
Research direction
Reproduce the report by following the linked EKS IAM service-account setup and running the provided docker command in a pod. Start by checking how the webhook-mounted token path behaves across the pod and nested Docker container; done means the nested command can use the service-account credentials and `sls deploy` completes successfully.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, docker, kubernetes
- Domain
- authentication, cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100