recognize if AWS Pod Identity is present (#452)

Signed-off-by: Peter Jakubis <[email protected]>
kyverno · Jun 12, 2024 · 7d9f219 · 7d9f219
1 parent b30f020
commit 7d9f219
Showing 1 changed file with 6 additions and 3 deletions.
diff --git a/pkg/config/target_factory.go b/pkg/config/target_factory.go
@@ -926,10 +926,13 @@ func NewTargetFactory(secretClient secrets.Client) *TargetFactory {
 }
 
 func hasAWSIdentity() bool {
-	arn := os.Getenv("AWS_ROLE_ARN")
-	file := os.Getenv("AWS_WEB_IDENTITY_TOKEN_FILE")
+	irsa_arn := os.Getenv("AWS_ROLE_ARN")
+	irsa_file := os.Getenv("AWS_WEB_IDENTITY_TOKEN_FILE")
 
-	return arn != "" && file != ""
+	pod_identity_file := os.Getenv("AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE")
+	pod_identity_uri := os.Getenv("AWS_CONTAINER_CREDENTIALS_FULL_URI")
+
+	return (irsa_arn != "" && irsa_file != "") || (pod_identity_file != "" && pod_identity_uri != "")
 }
 
 func checkAWSConfig(name string, config AWSConfig, parent AWSConfig) error {