EKS security groups for pods

[maauso]

Hi!

I'm using kube2iam over EKS and I detected that if I want to use security groups for pods and also IAM roles through Kube2Iam, those pods can not use the IAM role.

It seems that kube2iam can not manage the roles when the pods are using security groups.

Troubleshooting information.

First off when POD is starting with the security groups, I can see in kube2iam logs that it can detect that those pods have a role

Also, I saw that the request from the pod to AWS API doesn't appear on the kube2iam logs and then Pod receive AccessDenied

An error occurred (AccessDenied) when calling the ListBuckets operation: Access Denied

Besides, running aws sts get-caller-identity into the pod:

root@7d7bc57ddc-8rckq:/# aws sts get-caller-identity
{
    "UserId": "xxxxxxxxxxxxxxx:i-xxxxxxxxxxxxx",
    "Account": "xxxxxxxxxxx",
    "Arn": "arn:aws:sts::xxxxxxxx:assumed-role/eks-cluster/i-xxxxxxx"
}

Do you know if security groups for pods it's supported by Kube2iam?

[mfreebairn-r7]

Seeing this issue too, my pods are able to assume a role fine when they are using aws eks iam roles for service accounts but not when using kube2iam. Sadly, not all of the pods I have deployed can be migrated from using kube2iam to IRSA.

[davidweizheng]

Seeing this issue too, my pods are able to assume a role fine when they are using aws eks iam roles for service accounts but not when using kube2iam. Sadly, not all of the pods I have deployed can be migrated from using kube2iam to IRSA.

I'm also seeing the same issue - IRSA works on EKS but kube2iam doesn't.