Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add AWS EKS Pod Identity support #718

Closed
jonsbun opened this issue Aug 9, 2024 · 1 comment · Fixed by #721
Closed

Add AWS EKS Pod Identity support #718

jonsbun opened this issue Aug 9, 2024 · 1 comment · Fixed by #721

Comments

@jonsbun
Copy link

jonsbun commented Aug 9, 2024

AWS introduced EKS Pod Identity last year: https://aws.amazon.com/blogs/aws/amazon-eks-pod-identity-simplifies-iam-permissions-for-applications-on-amazon-eks-clusters/

EKS Pod Identity automatically injects the AWS_CONTAINER_CREDENTIALS_FULL_URI and AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE environment variables into pods. These are supported by AWS SDKs independently of Pod Identity and have been used in ECS for a long time. This mechanism is called Container credential provider: https://docs.aws.amazon.com/sdkref/latest/guide/feature-container-credentials.html

However, if I am understand correctly, https://github.com/fog/fog-aws/blob/master/lib/fog/aws/credential_fetcher.rb is ignoring these environment variables at this moment.

Explanation how EKS Pod Identity works: https://securitylabs.datadoghq.com/articles/eks-pod-identity-deep-dive/

@geemus
Copy link
Member

geemus commented Aug 9, 2024

@jonsbun thanks for the details. I don't think there is any intentional ignoring/skipping here, so much as nobody has taken the time to add this. I'm certainly open to help with a PR if you are interested in using this. Just let me know if I can help in any way.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants