Otdfbt

Transfer over $10k

Has any spacecraft ever had the ability to directly communicate with civilian air traffic control?

Why was Germany not as successful as other Europeans in establishing overseas colonies?

What happened to Ghost?

Airbnb - host wants to reduce rooms, can we get refund?

Is it the same airport YUL and YMQ in Canada?

Does the time required to copy a spell into a spellbook have to be consecutive, or is that just the cumulative time required?

Can fracking help reduce CO2?

A non-technological, repeating, visible object in the sky, holding its position in the sky for hours

When do aircrafts become solarcrafts?

How to avoid grep command finding commented out strings in the source file?

Write to EXCEL from SQL DB using VBA script

Selecting a secure PIN for building access

Visualizing a complicated Region

Surprising behavior of Part[ ]

How did Arya manage to disguise herself?

Is this homebrew race based on Draco Volans balanced?

Authors and contributors of forked project

Short story about people living in a different time streams

How to compensate for height when using a ranged attack

Survey Confirmation - Emphasize the question or the answer?

Floor tile layout process?

Is lying to get "gardening leave" fraud?

You look catfish vs You look like a catfish?

Setting environment variable in kubernetes before pulling an image

ECR IAM policy document for EKS node accessHow to estimate storage and traffic used for docker images in AWS ECR?Errors when using Google Container Engine (GKE) with Google Container Registry (GCR)kube-dns fails open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directoryCan't see pod logs in Stackdriver UI for cluster deployed on GKEAWS could not get token: AccessDenied: User: ARN is not authorized to perform: sts:AssumeRole on resource: Role:ARNWhat makes a kubernetes node unhealthy?In Kubernetes, how can a container created from a CronJob find out when it was scheduled?Kubernetes CrashLoopBackOff after pod create pulling image from Docker HubImagePullBackOff Kubernetes from Google Cloud Container RegistryECR IAM policy document for EKS node access

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

0

Is there a way to set the environment variables in kubernetes before it pulls the container image?

For some context, I'm looking for alternatives to what I've asked in ECR IAM policy document for EKS node access. According to the kubernetes docs (https://kubernetes.io/docs/concepts/containers/images/#using-aws-ec2-container-registry), it sounds like what I want to do is not possible by default since if I give the node role permission to read from ECR, any user that can create jobs/pods on the EKS cluster will be able to pull any image that the node role can pick up. The line from the k8s docs in question is:

All users of the cluster who can create pods will be able to run pods that use any of the images in the ECR registry.

As an alternative, I'm trying to see if there's a way to set the environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) in the pod before it pulls the image. I'm not entirely sure on the implementation/integration for kubernetes with ECR, but if I think if I'm able to set those environment variables and the image pull process does a aws ecr get-login ... before actually pulling the image, then I might be able to restrict which images can be pulled by setting those variables.

I found some documentation on how to set variables in the container after the image has been pulled but nothing before.

• envFrom/SecretEnvSource: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.10/#envfromsource-v1-core
  


• env: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/#define-an-environment-variable-for-a-container
  

amazon-web-services kubernetes amazon-ecr

share|improve this question

asked Apr 22 at 12:54

Ai SuAi Su

61

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Probably this might work for your use case : medium.com/merapar/… Hope it helps!
  
  – Piyush Baderia
  12 hours ago
  

  
  
  
  

add a comment | 

0

Is there a way to set the environment variables in kubernetes before it pulls the container image?

For some context, I'm looking for alternatives to what I've asked in ECR IAM policy document for EKS node access. According to the kubernetes docs (https://kubernetes.io/docs/concepts/containers/images/#using-aws-ec2-container-registry), it sounds like what I want to do is not possible by default since if I give the node role permission to read from ECR, any user that can create jobs/pods on the EKS cluster will be able to pull any image that the node role can pick up. The line from the k8s docs in question is:

All users of the cluster who can create pods will be able to run pods that use any of the images in the ECR registry.

As an alternative, I'm trying to see if there's a way to set the environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) in the pod before it pulls the image. I'm not entirely sure on the implementation/integration for kubernetes with ECR, but if I think if I'm able to set those environment variables and the image pull process does a aws ecr get-login ... before actually pulling the image, then I might be able to restrict which images can be pulled by setting those variables.

I found some documentation on how to set variables in the container after the image has been pulled but nothing before.

• envFrom/SecretEnvSource: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.10/#envfromsource-v1-core
  


• env: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/#define-an-environment-variable-for-a-container
  

amazon-web-services kubernetes amazon-ecr

share|improve this question

asked Apr 22 at 12:54

Ai SuAi Su

61

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Probably this might work for your use case : medium.com/merapar/… Hope it helps!
  
  – Piyush Baderia
  12 hours ago
  

  
  
  
  

add a comment | 

Is there a way to set the environment variables in kubernetes before it pulls the container image?

For some context, I'm looking for alternatives to what I've asked in ECR IAM policy document for EKS node access. According to the kubernetes docs (https://kubernetes.io/docs/concepts/containers/images/#using-aws-ec2-container-registry), it sounds like what I want to do is not possible by default since if I give the node role permission to read from ECR, any user that can create jobs/pods on the EKS cluster will be able to pull any image that the node role can pick up. The line from the k8s docs in question is:

All users of the cluster who can create pods will be able to run pods that use any of the images in the ECR registry.

As an alternative, I'm trying to see if there's a way to set the environment variables (AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY) in the pod before it pulls the image. I'm not entirely sure on the implementation/integration for kubernetes with ECR, but if I think if I'm able to set those environment variables and the image pull process does a aws ecr get-login ... before actually pulling the image, then I might be able to restrict which images can be pulled by setting those variables.

I found some documentation on how to set variables in the container after the image has been pulled but nothing before.

• envFrom/SecretEnvSource: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.10/#envfromsource-v1-core
  


• env: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/#define-an-environment-variable-for-a-container
  

amazon-web-services kubernetes amazon-ecr

share|improve this question

asked Apr 22 at 12:54

Ai SuAi Su

61

share|improve this question

asked Apr 22 at 12:54

Ai SuAi Su

61

share|improve this question

asked Apr 22 at 12:54

Ai SuAi Su

61

asked Apr 22 at 12:54

Ai SuAi Su

61

asked Apr 22 at 12:54

Ai SuAi Su

61