aws / aws/amazon-eks-pod-identity-webhook
Projected volumeMount missing
- Dominant language
- Go
- Stars
- 691
- Forks
- 202
- Avg merge
- 4h 38m
- Merged PRs (30d)
- 1
Description
**What happened**:
We created a pod with a `iam.amazonaws.com/role:` annotation. The environment variables `AWS_ROLE_ARN` and `AWS_WEB_IDENTITY_TOKEN_FILE` are created. The volume `aws-iam-token` is also added to the pod. But the volumeMount `aws-iam-token` is missing. Other pods in the same namespace with the same service account but created by a different deployment are created with the volume mount.
**What you expected to happen**:
The volumeMount `aws-iam-token` is created alongside the environment variables and the volume.
**How to reproduce it (as minimally and precisely as possible)**:
**Anything else we need to know?**:
**Environment**:
- AWS Region: eu-central-1
- EKS Platform version (if using EKS, run `aws eks describe-cluster --name --query cluster.platformVersion`): "eks.3"
- Kubernetes version (if using EKS, run `aws eks describe-cluster --name --query cluster.version`): "1.17"
- Webhook Version:
Contributor guide
Research direction
Start by reproducing the pod mutation described for the AWS IAM role annotation and compare it with a working pod using the same service account. Inspect the webhook's handling of the aws-iam-token volume, environment variables, and volumeMount; done means the expected volumeMount is added alongside the existing injected resources. The issue does not name source files, tests, or a webhook version.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, go, kubernetes
- Domain
- backend, cloud, devops
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100