Invalid k8s service account token

[fhalde]

What happened:
The file /var/run/secrets/eks.amazonaws.com/serviceaccount/token contained a malformed token of the form

<token> 11:11:49.782386   40364 v3.go:79] EOF

What you expected to happen:
The token should not have been malformed

How to reproduce it (as minimally and precisely as possible):
Not reproducible

Anything else we need to know?:
Since the token was malformed, and since we use EKS IRSA, the AWS STS call was failing

Environment: EKS

• AWS Region: sa-east-1
• EKS Platform version (if using EKS, run aws eks describe-cluster --name <name> --query cluster.platformVersion): eks.7
• Kubernetes version (if using EKS, run aws eks describe-cluster --name <name> --query cluster.version): 1.29
• Webhook Version: unsure

[fhalde]

hi, could someone be able to help here?

[ccx0lw]

I had the same problem.

Use the pod

AWS_WEB_IDENTITY_TOKEN_FILE:  /var/run/secrets/eks.amazonaws.com/serviceaccount/token

Token requests STS to report the following error

<ErrorResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
  <Error>
    <Type>Sender</Type>
    <Code>InvalidIdentityToken</Code>
    <Message>Incorrect token audience</Message>
  </Error>
  <RequestId>b214072d-5c22-46e6-a6bd-b6a28c08a7f2</RequestId>
</ErrorResponse>

[fhalde]

@ccx0lw did you check the contents of /var/run/secrets/eks.amazonaws.com/serviceaccount/token ?
was the file decodable using jwt decode "$(cat /var/run/secrets/eks.amazonaws.com/serviceaccount/token)" --json ?

[ccx0lw]

@ccx0lw did you check the contents of /var/run/secrets/eks.amazonaws.com/serviceaccount/token ? was the file decodable using jwt decode "$(cat /var/run/secrets/eks.amazonaws.com/serviceaccount/token)" --json ?

It's all right now.

I checked the IAM as described in the documentation here.
https://docs.aws.amazon.com/eks/latest/userguide/pod-configuration.html

It turns out to be the OIDC Audience, with no sts.amazonaws.com
It

[ccx0lw]

@ccx0lw did you check the contents of /var/run/secrets/eks.amazonaws.com/serviceaccount/token ? was the file decodable using jwt decode "$(cat /var/run/secrets/eks.amazonaws.com/serviceaccount/token)" --json ?

thank you