Provide an example configuration

[benbooth493]

I'm really struggling to fit the pieces together here. Is is possible to provide a real-world example for say listing the contents of an S3 bucket?

[jtblin]

There are several examples in the readme including one that lists the content of an s3 bucket...

[jtblin]

---
apiVersion: v1
kind: Pod
metadata:
  name: aws-cli
  labels:
    name: aws-cli
  annotations:
    iam.amazonaws.com/role: role-name
spec:
  containers:
  - image: fstab/aws-cli
    command:
      - "/home/aws/aws/env/bin/aws"
      - "s3"
      - "ls"
      - "some-bucket"
    name: aws-cli

[benbooth493]

The issue I have is that if I copy the examples obviously replace the ARNs with valid ones, I always get "AccessDenied when calling the ListObjects operation".

In the annotation you specify a role called: role-name
Is this a role I need to create in addition to the roles in the example?

[struz]

role-name should be the name of the role that can access the s3 bucket. It is the role assumed by the pod that runs the commands.

[benbooth493]

So the 2nd "AssumeRole" policy in the readme also needs actions for s3 or do I need another policy that trusts that?

[struz]

There are two roles. Role 1, the default role assumed by every kubernetes worker (this assumes that you are running your kube cluster on aws). Role 2, the role that will be assumed. Role 2 needs to trust role 1 so that it can assume it. Role 2 also needs to have aws permissions to manipulate the s3 bucket.

Role 1 needs to have permissions to be able to assume other roles.

The annotation needs to refer to role 2.

I hope that helps.

[benbooth493]

So I have the following role attached to the worker as an instance profile:

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "",
			"Effect": "Allow",
			"Principal": {
				"AWS": "*"
			},
			"Action": "sts:AssumeRole"
		}
	]
}

And this "pod" role which I am specifying in the pod annotation :

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "",
			"Effect": "Allow",
			"Principal": {
				"Service": "ec2.amazonaws.com"
			},
			"Action": "sts:AssumeRole"
		},
		{
			"Sid": "",
			"Effect": "Allow",
			"Principal": {
				"AWS": "<arn of worker role above>"
			},
			"Action": "sts:AssumeRole"
		}
	]
}

I have then attached the permissions policy AmazonS3FullAccess to the pod role, and I get Access Denied

I would have assumed this would work? Am I missing something else here?

[benbooth493]

Further investigation shows that the pod is always getting the worker role. Even if I run kube2iam with --default-role set to the pod role

[jtblin]

Have you setup iptables?

…

On 17 Mar. 2017 12:54 am, "Ben Booth" ***@***.***> wrote: Further investigation shows that the pod is always getting the worker role. Even if I run kube2iam with --default-role set to the pod role — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub <#58 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABUxrmnJRqxuRGiVAnrW255YipDfiGedks5rmT76gaJpZM4Md8IX> .

[benbooth493]

@i'm on CoreOS, and yes, I've specified --iptables=true --host-ip=$(HOST_IP) and played with both --host-interface=docker0 and --host-interface=flannel.1
I have hostNetwork: true enabled also.

$ iptables -n -t nat -L shows DNAT rules configured for the PREROUTING chain:

DNAT       tcp  --  0.0.0.0/0            169.254.169.254      tcp dpt:80 to:x.x.x.x:8181
DNAT       tcp  --  0.0.0.0/0            169.254.169.254      tcp dpt:80 to:x.x.x.x:8181

(of course x.x.x.x matches the host ip)

[benbooth493]

Ok so I set --host-interface=cni0 and now I see the correct credentials getting passed to the pod.
👍

I now have an issue with NoCredentialsError: Unable to local credentials when doing s3 ls

Will dig a little.

[benbooth493]

Sorted. I had commented out the annotation during debugging 👎

Thanks for your help