jtblin / kube2iam

18%

master: 8%

LAST BUILD ON BRANCH 0.9.1

branch: 0.9.1

CHANGE BRANCH

x

Reset

• 0.9.1
• (HEAD detached at 0.13.0) master
• 0.10.1
• 0.10.10
• 0.10.11
• 0.10.2
• 0.10.3
• 0.10.4
• 0.10.5
• 0.10.6
• 0.10.7
• 0.10.7-rc2
• 0.10.7-rc3
• 0.10.8
• 0.10.9
• 0.11.1
• 0.7.0
• 0.8.0
• 0.8.2
• 1.10-api
• feat/add-pr-template
• feat/chart-update-docker-image
• fix-ci
• fix/sts-endpoint
• gh-page-helm-chart
• kube2iam-2.5.2
• kube2iam-2.6.0
• master
• release-0.11.2
• release-0.13.0
• release-kube2iam-2.6.0

Build # 67

Build Type

push

travis-ci

Committed by jtblin

Commit Message

Fix missing redirect on m5/c5 instances (#130)

The AWS metadata service works differently on new instance types like
m5.large and c5.large.

The behavior on old instances is that if you call:

```
169.254.169.254/latest/meta-data/iam/security-credentials
```

It will redirect to:

```
169.254.169.254/latest/meta-data/iam/security-credentials/
```

Which will respond with the IAM role name.

On new instances there is no redirect, it just responds with the IAM role name directly.

Since kube2iam didn't intercept the URL without the slash, the pod will
initially get the worker node role and then try to request credentials for that
role, which kube2iam will deny.

Fix is to intercept both versions of the URL.

Fix #127

Run Details

56 of 303 relevant lines covered (18.48%)

2.66 hits per line