aws / aws/amazon-eks-pod-identity-webhook

Projected volumeMount missing

Open
#82 2 comments 1 reaction 0 assignees View on GitHub
Dominant language
Go
Stars
691
Forks
202
Avg merge
4h 38m
Merged PRs (30d)
1

Description

**What happened**:
We created a pod with a `iam.amazonaws.com/role:` annotation. The environment variables `AWS_ROLE_ARN` and `AWS_WEB_IDENTITY_TOKEN_FILE` are created. The volume `aws-iam-token` is also added to the pod. But the volumeMount `aws-iam-token` is missing. Other pods in the same namespace with the same service account but created by a different deployment are created with the volume mount.

**What you expected to happen**:

The volumeMount `aws-iam-token` is created alongside the environment variables and the volume.

**How to reproduce it (as minimally and precisely as possible)**:

**Anything else we need to know?**:

**Environment**:
- AWS Region: eu-central-1
- EKS Platform version (if using EKS, run `aws eks describe-cluster --name --query cluster.platformVersion`): "eks.3"
- Kubernetes version (if using EKS, run `aws eks describe-cluster --name --query cluster.version`): "1.17"
- Webhook Version:

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the pod mutation described for the AWS IAM role annotation and compare it with a working pod using the same service account. Inspect the webhook's handling of the aws-iam-token volume, environment variables, and volumeMount; done means the expected volumeMount is added alongside the existing injected resources. The issue does not name source files, tests, or a webhook version.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, go, kubernetes
Domain
backend, cloud, devops
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.