aws / aws/amazon-vpc-resource-controller-k8s
vpc-resource-validating-webhook causing pods to fail to create sporadically even though we're not using it
- Dominant language
- Go
- Stars
- 106
- Forks
- 71
- Avg merge
- 10h 28m
- Merged PRs (30d)
- 6
Description
**Describe the Bug**:
We don't use the security group for pods feature, so we should not get errors creating pods.
We tried to create the a regular pod but recieved the following error message from the webhook
https://github.com/aws/amazon-vpc-resource-controller-k8s/blob/master/webhooks/core/pod_webhook.go#L94
```
kubernetes.client.exceptions.ApiException: (403)
Reason: Forbidden
HTTP response headers: HTTPHeaderDict({'Audit-Id': 'b1fea4b3-b577-4845-a4ff-9bd167448adf', 'Cache-Control': 'no-cache, private', 'Content-Type': 'application/json', 'Date': 'Wed, 23 Jun 2021 20:00:19 GMT', 'Content-Length': '290'})
HTTP response body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"admission webhook \"mpod.vpc.k8s.aws\" denied the request: Webhood encountered error to Get or List object from k8s cache.","reason":"Webhood encountered error to Get or List object from k8s cache.","code":403}
```
I didn't even know that this admission webhook was installed by default on the EKS clusters until we got this error message.
**Observed Behavior**:
We got an error from this webhook when trying to create a pod.
**Expected Behavior**:
I expect that admission webhook to not cause any issues especially since we're not using the pod security group feature
**How to reproduce it (as minimally and precisely as possible)**:
We're not sure how to reproduce it, this issue happens rarely after creating lots of pods over time.
**Additional Context**:
**Environment**:
- Kubernetes version (use `kubectl version`): v1.19.6-eks-49a6c0
- CNI Version: v1.7.5-eksbuild.1
- OS (Linux/Windows): Amazon Linux 2
Contributor guide
Assessment
This issue has not been assessed yet.