aws-iam-authenticator for baremetal variant

[rpkelly]

Discussed in #2809

^{Originally posted by StefanTheWiz February 15, 2023}
Hi!

I'm trying to use AWS EKS as the control plane with bottlerocket baremetal nodes.
I was wondering if there was a particular reason why aws-iam-authenticator is not included in baremetal variant?

Based on the README, I was kinda expecting that it would be included (for instance for using IAM Roles Anywhere).

To start, we're focusing on the use of Bottlerocket as a host OS in AWS EKS Kubernetes clusters and Amazon ECS clusters.

As an experiment, I've built a version of baremetal that has the aws-iam-authenticator (diff here).
However, the update process might remove the authenticator, which might mean maintaining our own TUF repo and that would be a tough sell.

[rpkelly]

Documentation currently says this concerning authentication:

settings.kubernetes.authentication-mode: Which authentication method the kubelet should use to connect to the API server, and for incoming requests. Defaults to aws for AWS variants, and tls for other variants.

It does not currently mention if aws is not supported in those other variants, just that it's not the default.

[bcressey]

The mechanics of adding the package are straightforward, but I need a better understanding of the security implications of this to form an opinion on whether this is a good idea. I'll reach out to some folks internally.

[StefanTheWiz]

The mechanics of adding the package are straightforward, but I need a better understanding of the security implications of this to form an opinion on whether this is a good idea. I'll reach out to some folks internally.

Hi. Any updates on this? :)

[StefanTheWiz]

Still a blocker... 👎

[stmcginnis]

Sorry for the delay on updates here. I know there are some possible security concerns with including aws-iam-authenticator for metal variants. I know there were some reviews being requested with some AWS security folks to provide more details, but unfortunately I don't have an update on where that process stands. I will reach out to some folks and see if we can get any updates.

[cbgbt]

@StefanTheWiz thanks for your patience here. @yeazelm has merged aws-iam-authenticator which should be available in Bottlerocket 1.15.0, tracked in #3169

Would you mind giving this a shot and checking that it resolves your issues?

[yeazelm]

This was released in the 1.15.0 release

[StefanTheWiz]

Thanks! I'll check it out soon and let you know