aws / aws/amazon-vpc-resource-controller-k8s

vpc-resource-validating-webhook causing pods to fail to create sporadically even though we're not using it

Open
#38 5 comments 0 reactions 1 assignee Claimed by @yash97 View on GitHub
bug
Dominant language
Go
Stars
106
Forks
71
Avg merge
10h 28m
Merged PRs (30d)
6

Description

**Describe the Bug**:

We don't use the security group for pods feature, so we should not get errors creating pods.

We tried to create the a regular pod but recieved the following error message from the webhook

https://github.com/aws/amazon-vpc-resource-controller-k8s/blob/master/webhooks/core/pod_webhook.go#L94

```
kubernetes.client.exceptions.ApiException: (403)
Reason: Forbidden
HTTP response headers: HTTPHeaderDict({'Audit-Id': 'b1fea4b3-b577-4845-a4ff-9bd167448adf', 'Cache-Control': 'no-cache, private', 'Content-Type': 'application/json', 'Date': 'Wed, 23 Jun 2021 20:00:19 GMT', 'Content-Length': '290'})
HTTP response body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"admission webhook \"mpod.vpc.k8s.aws\" denied the request: Webhood encountered error to Get or List object from k8s cache.","reason":"Webhood encountered error to Get or List object from k8s cache.","code":403}
```

I didn't even know that this admission webhook was installed by default on the EKS clusters until we got this error message.

**Observed Behavior**:

We got an error from this webhook when trying to create a pod.

**Expected Behavior**:

I expect that admission webhook to not cause any issues especially since we're not using the pod security group feature

**How to reproduce it (as minimally and precisely as possible)**:

We're not sure how to reproduce it, this issue happens rarely after creating lots of pods over time.

**Additional Context**:

**Environment**:
- Kubernetes version (use `kubectl version`): v1.19.6-eks-49a6c0
- CNI Version: v1.7.5-eksbuild.1
- OS (Linux/Windows): Amazon Linux 2

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.