Missing feature: Assuming an IAM role via AWS EKS pod identity

[danopia]

Looking at the options and code in this repo, there is support for retrieving short-lived credentials from EC2 Metadata service (and thus kube2iam, kiam, etc) but the newer Kubernetes method of using Web Identity files is not implemented yet.

Here's a technical overview of IAM pod identity: https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-technical-overview.html

The fundamental difference with web identity is that a new environment variable points to a file on disk, which contains a JWT that can be submitted to the sts:AssumeRoleWithWebIdentity API, returning a 1-hr credential that can then be used just like normal instance metadata credentials. The file on disk gets rotated every ~12 hours by default so it does have to be re-read at some interval.

Obviously there's a bit of new complexity getting a usable credential this way, but it's more reliable and less hacky than solutions like kube2iam, so there's reason to add it.

I'll probably make my own attempt at this soon, so I'm filing this ticket now for awareness and to solicit input on the best place to implement this.

[MosAmokhtari]

@danopia, did you make any progress on this ?

[danopia]

Hello, I haven't actually started editing code on this plugin, as it's kinda more of a 'nice to have' value-add to kong in my situation.

I think the main concerns from me are getting the environment variables and reading the OS file that the variables point to. It looks like this feature would only work with additional nginx directives such as env AWS_REGION; env AWS_ROLE_ARN; env AWS_WEB_IDENTITY_TOKEN_FILE; and I'm not sure right now how to specify such a directive list to Kong via Kong's own environment variables.

The environment variables could be worked around by requiring the user to copy their values into the plugin config, but the proper method would be using them as-is since the variables are injected by EKS and the real AWS SDKs use them directly.

[Tieske]

@danopia I do not think that is the case. The environment variables are not accessible from the workers, but then again, you only need to read them once at system startup, so you should be able to collect them in the init phase. Like the other credential handlers do (they also rely on env variables).

[Tieske]

see https://github.com/Kong/kong-plugin-aws-lambda/blob/master/kong/plugins/aws-lambda/iam-ecs-credentials.lua#L13

[xdejonghe]

Hi all,

I'm working to develop the code to retrieve credentials in the EKS environment from AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE. I also add a configuration variable (config.aws_role_session_name) to assume another role than the role defined in AWS_ROLE_ARN.

I'm not sure if I will ever create a PR for the reasons below but it might help someone:

• this is my first development in LUA and I am not sure of the quality of the code (even if lint pass)
• I need to double-check the assume role with the configuration variable
• I didn't test in a real environment with Kong

Branch: retrieve credentials in EKS environment from service account or given role

[xdejonghe]

@Tieske , eventually, I finished the development and made a PR Lambda/web token identity and refacto to review the code.
Here it is the changes:

• refactored the code to pass the plugin configuration to the providers (required to get the region, aws_role_session_name, and aws_assume_role_arn)
• implemented a new web token identity credentials provider for EKS. Either using service account role or a given role to assume (for cross account usage)

What I didn't tests:

• read file from filesystem (event if it's developed)
• deploy the plugin in AWS (ECS, EKS) and call a lambda

[kherock]

Any chance that [the PR in the last comment](Lambda/web token identity and refacto would be accepted if it were rebased here? The lack of support for this was a big surprise for us.

[Tieske]

This plugin has not yet switched to using the AWS SDK, which it should (instead of duplicating the auth code here). That would automatically enable the identity files; see https://github.com/Kong/lua-resty-aws/blob/main/src/resty/aws/credentials/TokenFileWebIdentityCredentials.lua

[muthugomu-kong]

Is there an ETA by when the above changes to the plugin will be made available? Which Release?

[hbagdi]

Is anyone willing to submit a patch and make a contribution to make this happen?

[ghost]

Is anyone willing to submit a patch and make a contribution to make this happen?

If this matter is not urgent, I will try to deal with it starting from next week.

[Tieske]

my 2cts: remove all auth-code and replace it with the AWS-SDK credential classes. The AWS base class defaults to the aws:CredentialProviderChain which will cover most usecases.

Assuming roles can be done with the ChainedTemporaryCredentials.

[windmgc]

Done in #11350