Inject IAM Roles Anywhere credentials into pod running on EKSA Cluster
- Dominant language
- Go
- Stars
- 2.1k
- Forks
- 328
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 9
Description
**What would you like to be added**:
We have EKS Pod identity webhook that injects IAM credentials into pod running on EKSA cluster.
This allows granular per pod/deployment credentials configuration.
Considering EKSA is deployed on on-premise, we want to have IAM Roles anywhere credentials injector for pods.
**Why is this needed**:
For security purposes to get granular IAM credentials on pod level.
Workaround:
```
./aws_signing_helper credential-process \
--certificate /path/to/certificate.pem \
--private-key /path/to/private-key.pem \
--trust-anchor-arn \
--profile-arn \
--role-arn
```
Run above script as init container for application pod and store the credentials in a config file.
configure application to parse these credentails and authenticate with AWS cloud.
Contributor guide
Research direction
Start by reviewing how the EKS Pod Identity webhook injects credentials into pods and how the `aws_signing_helper` is used in the documented init-container workaround. Define the injector’s pod-level configuration and credential delivery behavior for EKS Anywhere; done means applications can obtain IAM Roles Anywhere credentials without manually writing a config file.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, kubernetes
- Domain
- cloud, infrastructure, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100