Docs

Volcengine Kubernetes Engine

Security add-ons

pod-identity-webhook

As an automated add-on in VKE clusters, pod-identity-webhook assists in implementing IRSA capabilities. This topic describes how to deploy and use the pod-identity-webhook add-on in a cluster.

Add-on overview

The pod-identity-webhook is an auxiliary add-on for the IAM Role for Service Account (IRSA) feature. Its core capabilities and advantages are as follows:

Automated injection of IRSA configuration: During the Mutating Admission stage of Pod creation, IRSA-related configurations are automatically injected into eligible Pods, allowing users to use IRSA capabilities without manually modifying Pod YAML.

Flexible configuration: Fine-grained management can be achieved through namespace labels, ServiceAccount annotations, and Pod annotations. For example, enabling or disabling automatic injection, specifying associated IAM roles, setting OIDC token validity periods, and limiting which containers are injection targets.

Feature compatibility: Environment variable injection and Volume injection are supported.

The pod-identity-webhook is a managed add-on. By default, it does not deploy specific Kubernetes resources in your business cluster and does not consume compute resources on cluster nodes.

Add-on versions

For information about the historical release records of the add-on, as well as new features and optimization descriptions for each version, see Add-on release records.

Install the add-on

In the left navigation pane, click Cluster. Click the target cluster name to go to the management page of this cluster.

In the left navigation pane, click Addons. On the page that appears, click the Security tab.

Move the pointer over the add-on card and click Deploy.

In the pod-identity-webhook Parameter configuration dialog box, you can choose whether to enable Extended environment variables.

Disabled: After the add-on is installed, the system automatically injects the IRSA OIDC environment variables enabled for the cluster only into newly created Pods.

Enabled: You can specify custom IRSA extended variables by specifying the Variable name and Variable value parameters. After the add-on is installed, the system injects both IRSA OIDC environment variables and IRSA extended variables into newly created Pods.

tip

To configure IRSA extended environment variables, upgrade the pod-identity-webhook add-on to v0.1.3 or later.

If you modify the Variable name or Variable value parameters for the extended environment variables, the configuration automatically takes effect only for newly created Pods. The configurations of existing running Pods are not automatically updated. You can trigger configuration loading by redeploying Pods or by deleting and recreating Pods to make the updated environment variables take effect.

Click Confirm.

Upgrading add-ons

You do not need to be concerned about upgrade issues for system-managed add-ons. System-managed add-ons prevent issues such as add-on faults and unsatisfactory performance caused by user-side factors. This reduces user O&M costs and enhances add-on stability.