kubernetes-sigs/cluster-api-provider-aws

For Cluster API Quickstart, encode nil credentials in clusterawsadm iff it is determined that credentials are sourced from IMDS

Open

#2,380 opened on Apr 29, 2021

View on GitHub
 (12 comments) (0 reactions) (1 assignee)Go (689 forks)auto 404
area/securityhelp wantedkind/featurelifecycle/stalepriority/important-soon

Repository metrics

Stars
 (723 stars)
PR merge metrics
 (PR metrics pending)

Description

/kind feature

Describe the solution you'd like [A clear and concise description of what you want to happen.]

If I'm bootstrapping Cluster API using the clusterctl quick start, and I'm doing so on an EC2 instance with an instance profile with sufficient permissions, then I don't need any credentials in the capa-system secret, and CAPA running on the kind cluster will default to the EC2 instance profile. In addition, when the cluster is pivoted and with #2377, CAPA will execute with the control-plane IAM role that has everything it needs to run Cluster API.

Anything else you would like to add: [Miscellaneous information that will assist in solving the issue.]

Environment:

  • Cluster-api-provider-aws version: v0.6.5
  • Kubernetes version: (use kubectl version):
  • OS (e.g. from /etc/os-release):

Contributor guide

Research direction
Tech stack
Domain
Issue type
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Prerequisites
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.