How to use this with EKS?

[t089]

Hey, I was wondering how one can use this framework when deploying an application on EKS (where kube2iam is installed)? In this case the AWS_CONTAINER_CREDENTIALS_RELATIVE_URI is not populated. Would it be possible to provide some value for this env in the pod configuration so that the lookup will work through kube2iam?

[tachyonics]

I am not familiar enough with EKS to know how this should work.

Are you trying to follow this documentation - https://github.com/aws-samples/aws-workshop-for-kubernetes/blob/master/04-path-security-and-networking/402-authentication-and-authorization/readme.adoc#iam-container-roles-using-kube2iam

[t089]

Ok I figured it out:

• kube2iam (and other tools like kiam) work by proxying the EC2 metadata service and make it available to a pod
• the app can query the metadata service for temporary credentials associated with a role
• the available roles are served from (newline separated role names)
  http://169.254.169.254/latest/meta-data/iam/security-credentials
• to obtain a credential associated with the s3access role you call, eg
  http://169.254.169.254/latest/meta-data/iam/security-credentials/s3access

• The Java InstanceProfileCredentialsProvider just uses the first available role to obtain credentials for the AWS SDK running on an EC2 instance.

  private static class InstanceMetadataCredentialsEndpointProvider extends CredentialsEndpointProvider {
  @Override
  public URI getCredentialsEndpoint() throws URISyntaxException, IOException {
      String host = EC2MetadataUtils.getHostAddressForEC2MetadataService();
  
      String securityCredentialsList = EC2CredentialsUtils.getInstance().readResource(new URI(host + EC2MetadataUtils.SECURITY_CREDENTIALS_RESOURCE));
      String[] securityCredentials = securityCredentialsList.trim().split("\n");
      if (securityCredentials.length == 0) {
          throw new SdkClientException("Unable to load credentials path");
      }
  
      return new URI(host + EC2MetadataUtils.SECURITY_CREDENTIALS_RESOURCE + securityCredentials[0]);
  }
  }

  https://github.com/aws/aws-sdk-java/blob/4e2522a0002f6e16e0dd07109909a4f544655aa3/aws-java-sdk-core/src/main/java/com/amazonaws/auth/InstanceProfileCredentialsProvider.java#L192

• Using smoke-aws-credentials it is possible to replicate this behavior in a custom implementation of ExpiringCredentialsRetriever and use this with an AwsRotatingCredentialsProvider to make it work 👍