Comments (6)
What I think is missing really is a way to annotate a provider-aws pod with proper annotation as that is done via ControllerConfig and Provider abstractions.
@martin-ducar-gd as you mention, this can be done with a ControllerConfig
(previously you could only annotate the Deployment
and ServiceAccount
, but the coming v1.1.0
Crossplane release will update ControllerConfig
to have a spec.metadata
field to annotate the Pod
. You can see an example of doing that here.). I believe tou can fall back on default credential chain in provider-aws
with source: None
in your AWS ProviderConfig
. Does this fit your use case?
from provider-aws.
Oh great that seems like exactly what might enable that functionality. Thank you @hasheddan
from provider-aws.
Of note, I believe the standard configuration flow for AWS Clients is as follows:
IniConfig
EnvFallback
IAMFallback
Fail
from provider-aws.
@hasheddan is this fixed now with #126?
from provider-aws.
@prasek yep! Thanks for flagging 👍
from provider-aws.
A question here. I see the Service account role support has been added that means you can annotate service account and that will in the end bring ENV variables like AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE to provider-aws pod which it will use to authenticate to AWS API. Which is good but it becomes really hard to do cross account assume. EKS webidentity is somehow fixed to that account where the EKS cluster lives. And unless I'm mistaken, assuming role in another account is done as 2 step process (Call assume role of another account inside pod explicitly leveraging existing Service account role). What was I think instead meant here is with tools like kube2iam kiam its much more simpler to cross account assume without POD even knowing it all you do is add annotation to pod: iam.amazonaws.com/role: "arn:aws:iam::<account_id>:role/<role_name>"
and if your kiam or kube2iam is able to assume that role it will give it to provider-aws via redirecting metadata call to 169.254.169.254... all it needs to do is use aws-sdk with fallback to ec2rolecreds. What I think is missing really is a way to annotate a provider-aws pod with proper annotation as that is done via ControllerConfig
and Provider
abstractions. Is there any way to define that now or really its needed to modify the crossplane logic?
from provider-aws.
Related Issues (20)
- Release v0.46.0 December 15, 2023
- IAM Role constant updates due to AWS-initialized `CreateDate` and `PermissionsBoundaryType` HOT 1
- How to reference a new ec2 to a new TargetGroup dynamically HOT 2
- RDS instance in modify loop due to Crossplane checking AWS initialized fields. (version 0.45) HOT 4
- EKS NodeGroup taints not updating
- Project status HOT 4
- Allow Listener's API to add additional Rules and conditions for load balancers HOT 1
- database.RDSInstance does not update tags
- Dynamic AMI Lookup in Crossplane AWS Provider HOT 1
- ec2: resizing of EBS blockDevice not getting passed to AWS HOT 1
- IAM Role possible update-loop due to `RoleLastUsed`
- Support eks pod identity association HOT 1
- Support the ability to create the same ECR Repository in multiple regions HOT 3
- Secret MR does not get deleted directly anymore
- Release v0.47.0 February 14, 2023
- Allow use of EKS pod identities as an authentication method HOT 2
- Tags are not updated for rdsinstance resource on update operation HOT 2
- [ec2/vpcpeeringconnection] Invalid memory address Provider AWS crashes with CrashLoopBackOff HOT 1
- Update-Loop when setting `awsAccountId` to just account ID HOT 1
- Issue "failed to satisfy constraint: Member must have length greater than or equal to 20" while creating Policy HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from provider-aws.