{"id":21042779,"url":"https://github.com/aws-observability/aws-sigv4-proxy-admission-controller","last_synced_at":"2025-05-15T17:31:08.675Z","repository":{"id":37723178,"uuid":"288855626","full_name":"aws-observability/aws-sigv4-proxy-admission-controller","owner":"aws-observability","description":"This project creates a mutation admission controller that injects AWS SIGv4 proxy as a sidecar.","archived":false,"fork":false,"pushed_at":"2024-03-19T14:22:03.000Z","size":178,"stargazers_count":27,"open_issues_count":3,"forks_count":11,"subscribers_count":26,"default_branch":"master","last_synced_at":"2025-04-03T12:11:37.370Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/aws-observability.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2020-08-19T23:03:26.000Z","updated_at":"2024-06-17T10:32:51.000Z","dependencies_parsed_at":"2023-02-13T05:15:47.056Z","dependency_job_id":"8d17d782-20e6-4d79-980f-0a2e15868ce8","html_url":"https://github.com/aws-observability/aws-sigv4-proxy-admission-controller","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aws-observability%2Faws-sigv4-proxy-admission-controller","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aws-observability%2Faws-sigv4-proxy-admission-controller/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aws-observability%2Faws-sigv4-proxy-admission-controller/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aws-observability%2Faws-sigv4-proxy-admission-controller/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/aws-observability","download_url":"https://codeload.github.com/aws-observability/aws-sigv4-proxy-admission-controller/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254388060,"owners_count":22062979,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-19T14:09:00.635Z","updated_at":"2025-05-15T17:31:08.381Z","avatar_url":"https://github.com/aws-observability.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# AWS SIGv4 Proxy Admission Controller\n\nThe mutation admission controller will inject the [AWS SIGv4 Proxy](https://github.com/awslabs/aws-sigv4-proxy) as a sidecar into a pod if there are annotations specified in a container's deployment.yaml file or specific namespace labels.\n\n## Getting Started\n\nA helm chart exists to deploy all the resources needed to use the admission controller here: https://github.com/aws/eks-charts/tree/master/stable/aws-sigv4-proxy-admission-controller/.\n\n### Installing the Controller via Helm Chart\n\nAdd the EKS repository to Helm:\n\n```bash\nhelm repo add eks https://aws.github.io/eks-charts\n```\n\nInstall the AWS SIGv4 Admission Controller chart with default configuration:\n\n```bash\nhelm install aws-sigv4-proxy-admission-controller eks/aws-sigv4-proxy-admission-controller --namespace \u003cnamespace\u003e\n```\n\n### Uninstalling the Helm Chart\n\nTo uninstall/delete the `aws-sigv4-proxy-admission-controller` release:\n\n```bash\nhelm uninstall aws-sigv4-proxy-admission-controller --namespace \u003cnamespace\u003e\n```\n\n### Doing It Yourself\n\nIf you wish to build the image on your own, change the variables in Makefile for your image repo, image name, and tag.\n\nBuild and push image\n```\nmake all\n```\n\nBuild image\n```\nmake build-image\n```\n\nPush image\n```\nmake push-image\n```\n\nRun tests\n```\nmake test\n```\n\nYou can override the admission controller image and other parameters in the [admission controller helm chart](https://github.com/aws/eks-charts/tree/master/stable/aws-sigv4-proxy-admission-controller).\n\n## Usage\n\n### Configuration\n\nFor each row in the chart below, you only need either the annotation or namespace label.\n\n| Annotation | Namespace Label | Required\n| - | - | -\n| `sidecar.aws.signing-proxy/inject: true` | `sidecar-inject=true` | ✔\n| `sidecar.aws.signing-proxy/host: \u003cAWS_SIGV4_PROXY_HOST\u003e` | `sidecar-host=\u003cAWS_SIGV4_PROXY_HOST\u003e` | ✔\n| `sidecar.aws.signing-proxy/name: \u003cAWS_SIGV4_PROXY_NAME\u003e` | `sidecar-host=\u003cAWS_SIGV4_PROXY_NAME\u003e` |\n| `sidecar.aws.signing-proxy/region: \u003cAWS_SIGV4_PROXY_REGION\u003e` | `sidecar-host=\u003cAWS_SIGV4_PROXY_REGION\u003e` |\n| `sidecar.aws.signing-proxy/role-arn: \u003cAWS_SIGV4_PROXY_ROLE_ARN\u003e` | `sidecar-role-arn=\u003cAWS_SIGV4_PROXY_ROLE_ARN\u003e` |\n| `sidecar.aws.signing-proxy/unsigned-payload: \u003cAWS_SIGV4_PROXY_UNSIGNED_PAYLOAD\u003e` | `unsigned-payload=\u003cAWS_SIGV4_PROXY_UNSIGNED_PAYLOAD\u003e` |\n| `sidecar.aws.signing-proxy/upstream-url-scheme: \u003cAWS_SIGV4_PROXY_UPSTREAM_URL_SCHEME\u003e` | `upstream-url-scheme=\u003cAWS_SIGV4_PROXY_UPSTREAM_URL_SCHEME\u003e` |\n\nFor more information on the above annotations / namespace labels, please refer to the documentation in the [AWS SIGv4 Proxy](https://github.com/awslabs/aws-sigv4-proxy) repository.\n\n#### Example Deployment\n```\napiVersion: apps/v1\nkind: Deployment\nmetadata:\n  name: sleep\n  namespace: sidecar\nspec:\n  replicas: 1\n  selector:\n    matchLabels:\n      app: sleep\n  template:\n    metadata:\n      annotations:\n        sidecar.aws.signing-proxy/inject: \"true\"\n        sidecar.aws.signing-proxy/host: \"aps.us-west-2.amazonaws.com\"\n        sidecar.aws.signing-proxy/name: \"aps\"\n        sidecar.aws.signing-proxy/region: \"us-west-2\"\n        sidecar.aws.signing-proxy/role-arn: \"arn:aws:iam::123456789:role/assume-role\"\n        sidecar.aws.signing-proxy/unsigned-payload: \"false\"\n      labels:\n        app: sleep\n    spec:\n      containers:\n      - name: sleep\n        image: tutum/curl\n        command: [\"/bin/sleep\",\"infinity\"]\n        imagePullPolicy: IfNotPresent\n```\n\nTo see the AWS SIGv4 Proxy installed as a sidecar in this deployment: save the above lines as a yaml file, make sure the admission controller helm chart is installed in your Kubernetes cluster, and run the following:\n\n```bash\nkubectl create namespace sidecar\nkubectl create -f test-deploy.yaml\nkubectl get pod -n sidecar\n```\n\n2 pods should be visible within the sleep pod.\n\n## Security\n\nSee [CONTRIBUTING](CONTRIBUTING.md#security-issue-notifications) for more information.\n\n## License\n\nThis project is licensed under the Apache-2.0 License.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faws-observability%2Faws-sigv4-proxy-admission-controller","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faws-observability%2Faws-sigv4-proxy-admission-controller","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faws-observability%2Faws-sigv4-proxy-admission-controller/lists"}