Worker on Kubernetes with IAM ServiceAccounts

[Drupi]

Hello,

We are using the Concourse Workers running in EKS cluster. I've had an idea to create a ServiceAccount for the workers with AWS IAM role enabled. Is there any option to be able to pass the Token and AWS_ROLE parametr to every task running within those workers ?

Concourse worker pod has two parameters that are missing within the task:
AWS_WEB_IDENTITY_TOKEN_FILE=/var/run/secrets/eks.amazonaws.com/serviceaccount/token
AWS_ROLE=arn:aws:iam::ACCOUNT_ID:role/concourse

[pablokbs]

Hey @Drupi did you manage to solve this?

[taylorsilva]

@Drupi I don't think Concourse will ever have a way of doing that, it goes against Concourse being platform agnostic. The only thing Concourse will currently pass from host to containers is /etc/resolv.conf.

[jghiloni]

Luv 2 jump in to extremely old issues. What if there were a setting on the worker that would allow a list of env vars to be set that would be passed from worker host to container? In this case, there'd need to be a way to create "host" inputs, so the files could also be mapped in, but just a thought. It'd solve this issue while still being platform agnostic.