imduffy15/k8s-gke-service-account-assigner

k8s-gke-service-account-assigner does not work with GKE Metadata concealment

stepanstipl opened this issue · 3 comments

stepanstipl commented

k8s-gke-service-account-assigner does not work when GKE Metadata concealment is enabled on the cluster.

This is caused by iptables rule redirecting all the traffic to GKE's k8s-metadata-proxy that is already present and therefore takes precedence before the rule appended by k8s-gke-service-account-assigner.

imduffy15 commented

@stepanstipl Are you happy for this to be marked as resolved with your PR merged?

stepanstipl commented

Awesome, thanks a lot for merging this! 👍