{"repo":"jtblin/kube2iam","free":true,"listed":false,"github":"https://github.com/jtblin/kube2iam","clone":"git clone https://github.com/jtblin/kube2iam.git","description":"kube2iam provides different AWS IAM roles for pods running on Kubernetes","language":"HTML","stars":2042,"topics":["kubernetes","aws"],"license":"BSD-3-Clause","category":"deployment-docker-iac","readme_excerpt":"kube2iam Provide IAM credentials to containers running inside a kubernetes cluster based on annotations. IAM roles for service accounts vs kube2iam If you are using EKS, IAM roles for service accounts should be a drop-in-replacement for kube2iam and should be preferred. Please read #368. Context Traditionally in AWS, service level isolation is done using IAM roles. IAM roles are attributed through instance profiles and are accessible by services through the transparent usage by the aws-sdk of the ec2 metadata API. When using the aws-sdk, a call is made to the EC2 metadata API which provides temporary credentials that are then used to make calls to the AWS service. Problem statement The problem is that in a multi-tenanted containers based world, multiple containers will be sharing the underlying nodes. Given containers will share the same underlying nodes, providing access to AWS resources via IAM roles would mean that one needs to create an IAM role which is a union of all IAM roles. This is not acceptable from a security perspective. Solution The solution is to redirect the traffic that is going to the ec2 metadata API for docker containers to a container running on each instance, make a call to the AWS API to retrieve temporary credentials and return these to the caller. Other calls will be proxied to the EC2 metadata API. This container will need to run with host networking enabled so that it can call the EC2 metadata API itself. Usage IAM roles It is necessary to create a","default_branch":null,"files":null,"tree":[],"storefront":"/r/jtblin","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/jtblin/kube2iam/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}