Skip to content

Commit 729557a

Browse files
committed
Fix AWS IAM Roles for Service Accounts permission problem.
Amazon EKS supports IAM Roles for Service Accounts. It mounts tokens files to `/var/run/secrets/eks.amazonaws.com/serviceaccount/token`. Unfortunately, external-dns runs as 'nobody' so it cannot access this file. External DNS is then unable to make any AWS API calls to work. See: https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts-technical-overview.html Below are the file permissions mounted on External DNS pod: ``` ~ $ ls -al /var/run/secrets/eks.amazonaws.com/serviceaccount/ total 0 drwxrwxrwt 3 root root 100 Sep 11 06:40 . drwxr-xr-x 3 root root 28 Sep 11 06:40 .. drwxr-xr-x 2 root root 60 Sep 11 06:40 ..2019_09_11_06_40_49.865776187 lrwxrwxrwx 1 root root 31 Sep 11 06:40 ..data -> ..2019_09_11_06_40_49.865776187 lrwxrwxrwx 1 root root 12 Sep 11 06:40 token -> ..data/token ~ $ ls -al /var/run/secrets/eks.amazonaws.com/serviceaccount/..data/token -rw------- 1 root root 1028 Sep 11 06:40 /var/run/secrets/eks.amazonaws.com/serviceaccount/..data/token ```
1 parent 8da3b34 commit 729557a

File tree

2 files changed

+0
-8
lines changed

2 files changed

+0
-8
lines changed

Dockerfile

-4
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,4 @@ RUN apk add --no-cache ca-certificates && \
3131

3232
COPY --from=builder /github.com/kubernetes-incubator/external-dns/build/external-dns /bin/external-dns
3333

34-
# Run as UID for nobody since k8s pod securityContext runAsNonRoot can't resolve the user ID:
35-
# https://github.com/kubernetes/kubernetes/issues/40958
36-
USER 65534
37-
3834
ENTRYPOINT ["/bin/external-dns"]

Dockerfile.mini

-4
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,4 @@ FROM gcr.io/distroless/static
2929
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
3030
COPY --from=builder /github.com/kubernetes-incubator/external-dns/build/external-dns /bin/external-dns
3131

32-
# Run as UID for nobody since k8s pod securityContext runAsNonRoot can't resolve the user ID:
33-
# https://github.com/kubernetes/kubernetes/issues/40958
34-
USER 65534
35-
3632
ENTRYPOINT ["/bin/external-dns"]

0 commit comments

Comments
 (0)