This webhook is for mutating pods that will require AWS IAM access. After version v0.3.0, --in-cluster=true no longer works and is deprecated. Please use --in-cluster=false and manage the cluster certificate with a cert-manager or some other external certificate provisioning system. This is because certificates using the legacy-unknown signer are no longer signed when using the v1 certificates API. Create an OIDC provider in IAM for your cluster. You can find the OIDC discovery endpoint by describing your EKS cluster. Create an IAM role for your pods and modify the trust policy to allow your pod's service account to use the role. All new pod pods launched using this Service Account will be modified to use IAM for pods. Below is an example pod spec with the environment variables and volume fields added by the webhook. To ensure workloads are scheduled on windows nodes have the right environment variables, they must have a nodeSelector targeting windows it must run on.
Features
- Usage with non-root container user
- pod-identity-webhook ConfigMap
- Container images for amazon-eks-pod-identity-webhook can be found on Docker Hub
- Modify your pod's service account to be annotated with the ARN of the role you want the pod to use
- This webhook is for mutating pods that will require AWS IAM access
- Create an OIDC provider in IAM for your cluster
Project Samples
