search

jtblin / kube2iam

kube2iam provides different AWS IAM roles for pods running on Kubernetes
BSD 3-Clause "New" or "Revised" License
1.97k stars 318 forks source link

Ability to provide the external-id via a secret #301

Open costimuraru opened 3 years ago

costimuraru commented 3 years ago

Currently, it's possible to specify an optional ExternalId, which will be used as part of the assume role, to increase security. The external-id can only be provided via an annotation at this moment.

  annotations:
    iam.amazonaws.com/role: role-arn
    iam.amazonaws.com/external-id: external-id

Given that the desire is to keep this ExternalId opaque, we would like to avoid exposing its value in the kubernetes manifest, in our CI/CD tool (Spinnaker). As such, it would increase security if we would be able to somehow provide this via a secret. Any ideas?