Adding chart for AWS' new EKS Pod Identity Webhook #28

max-rocket-internet · 2019-10-29T15:25:16Z

Note the chart won't run yet as we are still waiting on official docker images: aws/amazon-eks-pod-identity-webhook#5

Related issues:
aws/amazon-eks-pod-identity-webhook#4
aws/containers-roadmap#23

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

nckturner · 2019-11-04T17:40:03Z

Thanks @max-rocket-internet! Working on getting images published for this :D

valdisrigdon · 2019-12-11T19:11:14Z

stable/aws-pod-identity-webhook/templates/mutatingwebhook.yaml

@@ -0,0 +1,20 @@
+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: MutatingWebhookConfiguration
+metadata:


Could support be added here to configure annotations? We've pulled this to use it, but want to use it with self-signed certificates from cert-manager instead.

valdisrigdon · 2019-12-11T19:12:06Z

stable/aws-pod-identity-webhook/templates/deployment.yaml

+      - name: webhook
+        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        command:


Could this be updated to also templatize the port being used?

--port={{ .Values.port }}

amitlt · 2020-01-23T12:07:36Z

thanks a lot for this @max-rocket-internet ! If i could ask for one more change, could it be possible to add a namespaceOverride? There are some CD tools (i.e Spinnaker) that only use helm for it's templating capabilities and thus don't change .Release.Namespace, which means it will always be installed in the default namespace. A namespaceOverride will solve this very niche issue :) I'd be happy to add this myself if you want

max-rocket-internet · 2020-01-23T14:05:55Z

stable/aws-pod-identity-webhook/templates/mutatingwebhook.yaml

+apiVersion: admissionregistration.k8s.io/v1beta1
+kind: MutatingWebhookConfiguration
+metadata:
+  name: {{ include "aws-pod-identity-webhook.fullname" . }}


@micahhausler I think this must be pod-identity-webhook? I just checked all our clusters and this already exists in each with a webhook called iam-for-pods.amazonaws.com.

What is supposed to happen here?

Judging by what the name here I think we are supposed to overwrite the pod-identity-webhook one in the cluster?

OK now I realise this chart is not to be installed into an EKS cluster because EKS provides this service by default. This chart would be for none-EKS clusters.

max-rocket-internet · 2020-01-24T08:57:01Z

If anyone wants extra changes, just create a PR after this is merged.

@nckturner I think we merge this and just make users build their own docker images. Then if AWS releases docker images, the chart can be updated?

jinglejengel · 2020-02-04T17:03:54Z

Just personally speaking, I don't know if having a chart published that doesn't just "work" out of the box is the best approach. While I'm eagerly awaiting this awesome work, it doesn't introduce an ideal workflow for consuming something in Helm if there's a multi-step approach to have the chart actually apply. Regardless, thanks for the awesome commitment of work on this @max-rocket-internet

stable/aws-pod-identity-webhook/Chart.yaml

stable/aws-pod-identity-webhook/README.md

stable/aws-pod-identity-webhook/values.yaml

jaypipes · 2020-02-04T18:58:31Z

stable/aws-pod-identity-webhook/values.yaml

+
+tolerations: []
+
+affinity: {}


Please include the following (and add to README values listing):

serviceAccount: # serviceAccount.create: Whether to create a service account or not create: true # serviceAccount.name: The name of the service account to create or use name: "" rbac: # rbac.create: `true` if rbac resources should be created create: true # rbac.pspEnabled: `true` if PodSecurityPolicy resources should be created pspEnabled: false

This matches other charts.

Also, for other charts, we've just used a generic podAnnotations value:

https://github.com/aws/eks-charts/blob/master/stable/aws-vpc-cni/values.yaml#L29

eks-charts/stable/aws-vpc-cni/templates/daemonset.yaml

Lines 17 to 21 in 575321f

annotations:

{{- range $key, $value := .Values.podAnnotations }}

{{ $key }}: {{ $value | quote }}

{{- end }}

{{- end }}

Maybe do that for this chart as well?

OK serviceAccount thing is done.

podAnnotations thing is done.

RBAC is not optional any more I believe and I don't know how to write a PSP so perhaps this can follow in a later PR?

Yup, PSP stuff can ceertainly be done in followup

stable/aws-pod-identity-webhook/values.yaml

jaypipes · 2020-02-04T19:06:57Z

stable/aws-pod-identity-webhook/values.yaml

@@ -0,0 +1,24 @@
+tls_secret_name: pod-identity-webhook
+annotation_prefix: eks.amazonaws.com


As you alluded to, EKS already installs the pod identity webhook by default, so this EKS-specific annotation prefix is probably not appropriate as the default for this chart?

Happy to change it but I don't know what for?

jaypipes · 2020-02-04T19:13:59Z

stable/aws-pod-identity-webhook/templates/service.yaml

+    prometheus.io/port: "443"
+    prometheus.io/scheme: "https"
+    prometheus.io/scrape: "true"
+spec:


Did you want to templatize the Service's type?

Example:

eks-charts/stable/appmesh-prometheus/templates/service.yaml

Line 8 in 575321f

type: {{ .Values.service.type }}

Let's add this in a later PR

jaypipes · 2020-02-04T19:15:26Z

Thanks very much for this submission @max-rocket-internet! Left a few suggestions and comments to address inline but overall, great start.

max-rocket-internet · 2020-02-07T08:51:26Z

@jaypipes OK done.

stefanprodan · 2020-02-07T22:32:47Z

stable/aws-pod-identity-webhook/values.yaml

+
+image:
+  repository: 602401143452.dkr.ecr.us-west-2.amazonaws.com/eks/pod-identity-webhook
+  tag: latest


The tag should be a a git SHA or sem ver. With latest, the same replica set could run different "versions" of latest. How would a user suppose to upgrade the chart? Helm will see no changes in the image tag and running helm upgrade will not start a rolling update.

OK I set it to 0.2.0, the latest release. It's cosmetic anyway as the docker images don't exist yet.

k · 2020-04-08T01:27:41Z

Any update on this?

jim-barber-he · 2020-05-20T06:50:22Z

stable/aws-pod-identity-webhook/templates/service.yaml

+    prometheus.io/port: "443"
+    prometheus.io/scheme: "https"


These annotations are incorrect.
The metrics endpoint for these pods is using http on port 9999

Suggested change

prometheus.io/port: "443"

prometheus.io/scheme: "https"

prometheus.io/port: "9999"

prometheus.io/scheme: "http"

max-rocket-internet · 2020-05-25T09:14:15Z

I will close due to review process being too slow or stalled.

jinglejengel · 2020-10-07T21:50:30Z

@max-rocket-internet thow back, but it looks like they have a docker image now: https://hub.docker.com/r/amazon/amazon-eks-pod-identity-webhook

max-rocket-internet · 2020-10-16T15:35:04Z

OK I rebased my branch and opened a new PR (can't reopen this one): #286

max-rocket-internet mentioned this pull request Oct 29, 2019

[stable/aws-pod-identity-webhook] Adding chart for AWS' new EKS Pod Identity Webhook helm/charts#17099

Closed

4 tasks

nckturner added the do-not-merge label Nov 4, 2019

mohsen0 mentioned this pull request Dec 11, 2019

Adding annotation to service account #48

Merged

valdisrigdon reviewed Dec 11, 2019

View reviewed changes

hlascelles mentioned this pull request Jan 11, 2020

Helm Chart for Deployments aws/amazon-eks-pod-identity-webhook#4

Open

max-rocket-internet commented Jan 23, 2020

View reviewed changes

jaypipes suggested changes Feb 4, 2020

View reviewed changes

jaypipes assigned micahhausler and stefanprodan Feb 4, 2020

max-rocket-internet added 10 commits February 6, 2020 18:10

initial commit

2bb9a85

switch logo

6c6dbd4

update versions

2c2a036

remove engine line

6aa52e7

update readme

c398f4f

add resource request/limits

df70fe7

add serviceaccount options

09165de

adding podAnnotations

022382c

camel case

5efe239

fix request/limit error

72af785

stefanprodan reviewed Feb 7, 2020

View reviewed changes

Update values.yaml

069a0b0

jim-barber-he reviewed May 20, 2020

View reviewed changes

max-rocket-internet closed this May 25, 2020

max-rocket-internet mentioned this pull request Nov 2, 2020

[aws-pod-identity-webhook] Adding chart #286

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adding chart for AWS' new EKS Pod Identity Webhook #28

Adding chart for AWS' new EKS Pod Identity Webhook #28

max-rocket-internet commented Oct 29, 2019

nckturner commented Nov 4, 2019

valdisrigdon Dec 11, 2019

valdisrigdon Dec 11, 2019

amitlt commented Jan 23, 2020

max-rocket-internet Jan 23, 2020

max-rocket-internet Jan 23, 2020

max-rocket-internet Jan 24, 2020

max-rocket-internet commented Jan 24, 2020

jinglejengel commented Feb 4, 2020

jaypipes Feb 4, 2020

jaypipes Feb 4, 2020

max-rocket-internet Feb 6, 2020

jaypipes Feb 7, 2020

jaypipes Feb 4, 2020

max-rocket-internet Feb 6, 2020

jaypipes Feb 4, 2020

max-rocket-internet Feb 6, 2020

jaypipes commented Feb 4, 2020

max-rocket-internet commented Feb 7, 2020

stefanprodan Feb 7, 2020

max-rocket-internet Feb 10, 2020

k commented Apr 8, 2020

jim-barber-he May 20, 2020

max-rocket-internet commented May 25, 2020

jinglejengel commented Oct 7, 2020

max-rocket-internet commented Oct 16, 2020

	annotations:
	{{- range $key, $value := .Values.podAnnotations }}
	{{ $key }}: {{ $value \| quote }}
	{{- end }}
	{{- end }}

		@@ -0,0 +1,24 @@
		tls_secret_name: pod-identity-webhook
		annotation_prefix: eks.amazonaws.com


		tolerations: []

		affinity: {}

Adding chart for AWS' new EKS Pod Identity Webhook #28

Adding chart for AWS' new EKS Pod Identity Webhook #28

Conversation

max-rocket-internet commented Oct 29, 2019

nckturner commented Nov 4, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

amitlt commented Jan 23, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

max-rocket-internet commented Jan 24, 2020

jinglejengel commented Feb 4, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jaypipes commented Feb 4, 2020

max-rocket-internet commented Feb 7, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

k commented Apr 8, 2020

Choose a reason for hiding this comment

max-rocket-internet commented May 25, 2020

jinglejengel commented Oct 7, 2020

max-rocket-internet commented Oct 16, 2020