0

Is there a way to set the environment variables in kubernetes before it pulls the container image?

For some context, I'm looking for alternatives to what I've asked in ECR IAM policy document for EKS node access. According to the kubernetes docs (https://kubernetes.io/docs/concepts/containers/images/#using-aws-ec2-container-registry), it sounds like what I want to do is not possible by default since if I give the node role permission to read from ECR, any user that can create jobs/pods on the EKS cluster will be able to pull any image that the node role can pick up. The line from the k8s docs in question is:

All users of the cluster who can create pods will be able to run pods that use any of the images in the ECR registry.

As an alternative, I'm trying to see if there's a way to set the environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) in the pod before it pulls the image. I'm not entirely sure on the implementation/integration for kubernetes with ECR, but if I think if I'm able to set those environment variables and the image pull process does a aws ecr get-login ... before actually pulling the image, then I might be able to restrict which images can be pulled by setting those variables.

I found some documentation on how to set variables in the container after the image has been pulled but nothing before.

Ai Su
  • 21
  • 1
  • Probably this might work for your use case : https://medium.com/merapar/securing-iam-access-in-kubernetes-cfbcc6954de Hope it helps! – Piyush Baderia Apr 29 '19 at 09:11
  • @PiyushBaderia Thanks for the response. I looked at kube2iam (as well as some of the other similar solutions), and I think one issue here is that it's up to the user to specify the role (in the job/pod spec as an annotation). In practice, I think this means that if a user wants to pull a container they shouldn't have access to, all it takes is for them to specify a role with permissions (even if they don't have permissions and they don't have permissions to assume that specific role), then they have access to the image. – Ai Su May 02 '19 at 13:37
  • @Ai Su, Have you tried to use [InitContainers](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) in order to set those environment variables before before Pod container creation? – Nick_Kh May 30 '19 at 09:14

0 Answers0