Containers can still access node role about kube2iam

[jtblin]

I assume that you have setup the iptables rule correctly? The code doesn't seem to use the role passed in the url at all ( it would probably be better semantically to check and return an error if it isn't the correct role but it should not lead to assuming a role that is not allowed but maybe I'm missing something).

[TaiSHiNet]

Yeah, without the iptables rule when I curl curl -s 169.254.169.254/latest/meta-data/iam/security-credentials/ I get test as the role I should be assigned

[jtblin]

So looking in the code more, the code is probably just returning the correct role whatever you pass in the url, the url param is just totally ignored, which isn't great but not a security issue. Relevant code:

    remoteIP := parseRemoteAddr(r.RemoteAddr)
    role, err := s.getRole(remoteIP)
    if err != nil {
        http.Error(w, err.Error(), http.StatusNotFound)
        return
    }

The code is just getting the role for the remote IP whatever role is passed in the url. I'll see to change that to return an error instead.