aws / aws/amazon-eks-pod-identity-webhook
Issue working with k8s 1.19
- Dominant language
- Go
- Stars
- 691
- Forks
- 202
- Avg merge
- 4h 38m
- Merged PRs (30d)
- 1
Description
**What happened**:
Have a k8s cluster setup in a vpc. Installed the webhook and got an error "2020/11/04 19:11:15 http: TLS handshake error from 192.168.89.192:12501: no serving certificate available for the webhook, is the CSR approved?" Other service such as external-dns could not get proper permission. The same setup works with 1.18.8
**What you expected to happen**:
The csr should be approved and external-dns get proper permission
**How to reproduce it (as minimally and precisely as possible)**:
Set up a k8s cluster in a vpc. install pod-identity-webhook on it
**Anything else we need to know?**:
Look like the webhook need an update as It should be setting the signerName since it is now required, but it's not:
https://github.com/kubernetes/client-go/blob/master/util/certificate/certificate_manager.go
**Environment**:
- AWS Region:us-east-1
- EKS Platform version (if using EKS, run `aws eks describe-cluster --name --query cluster.platformVersion`):
- Kubernetes version (if using EKS, run `aws eks describe-cluster --name --query cluster.version`):1.19.0
- Webhook Version:latest
Contributor guide
Research direction
Reproduce the pod-identity-webhook setup on Kubernetes 1.19 in a VPC and compare it with 1.18.8. Start with the webhook's CSR handling and the client-go certificate_manager.go reference mentioned in the issue, focusing on signerName. Done means the CSR is approved, the webhook has a serving certificate, and external-dns receives the expected permissions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, go, kubernetes
- Domain
- authentication, cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100