aws / aws/amazon-eks-pod-identity-webhook

Issue working with k8s 1.19

Open
#89 2 comments 3 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
691
Forks
202
Avg merge
4h 38m
Merged PRs (30d)
1

Description

**What happened**:
Have a k8s cluster setup in a vpc. Installed the webhook and got an error "2020/11/04 19:11:15 http: TLS handshake error from 192.168.89.192:12501: no serving certificate available for the webhook, is the CSR approved?" Other service such as external-dns could not get proper permission. The same setup works with 1.18.8
**What you expected to happen**:
The csr should be approved and external-dns get proper permission
**How to reproduce it (as minimally and precisely as possible)**:
Set up a k8s cluster in a vpc. install pod-identity-webhook on it
**Anything else we need to know?**:
Look like the webhook need an update as It should be setting the signerName since it is now required, but it's not:
https://github.com/kubernetes/client-go/blob/master/util/certificate/certificate_manager.go
**Environment**:
- AWS Region:us-east-1
- EKS Platform version (if using EKS, run `aws eks describe-cluster --name --query cluster.platformVersion`):
- Kubernetes version (if using EKS, run `aws eks describe-cluster --name --query cluster.version`):1.19.0
- Webhook Version:latest

Contributor guide

Open the contributing guide

Research direction

Reproduce the pod-identity-webhook setup on Kubernetes 1.19 in a VPC and compare it with 1.18.8. Start with the webhook's CSR handling and the client-go certificate_manager.go reference mentioned in the issue, focusing on signerName. Done means the CSR is approved, the webhook has a serving certificate, and external-dns receives the expected permissions.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, go, kubernetes
Domain
authentication, cloud, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.