aws / aws/eks-anywhere

Inject IAM Roles Anywhere credentials into pod running on EKSA Cluster

Open
#7,733 0 comments 2 reactions 0 assignees View on GitHub
external kind/enhancement
Dominant language
Go
Stars
2.1k
Forks
328
Avg merge
1d 4h
Merged PRs (30d)
9

Description

**What would you like to be added**:

We have EKS Pod identity webhook that injects IAM credentials into pod running on EKSA cluster.

This allows granular per pod/deployment credentials configuration.

Considering EKSA is deployed on on-premise, we want to have IAM Roles anywhere credentials injector for pods.

**Why is this needed**:

For security purposes to get granular IAM credentials on pod level.

Workaround:

```
./aws_signing_helper credential-process \
--certificate /path/to/certificate.pem \
--private-key /path/to/private-key.pem \
--trust-anchor-arn \
--profile-arn \
--role-arn
```

Run above script as init container for application pod and store the credentials in a config file.

configure application to parse these credentails and authenticate with AWS cloud.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing how the EKS Pod Identity webhook injects credentials into pods and how the `aws_signing_helper` is used in the documented init-container workaround. Define the injector’s pod-level configuration and credential delivery behavior for EKS Anywhere; done means applications can obtain IAM Roles Anywhere credentials without manually writing a config file.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes
Domain
cloud, infrastructure, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.