Skip to content

5.9 Kubernetes (kubernetes.py)

The AWS deep collector · From docs/INVENTORY_INTERNALS.md on GitHub

For each ACTIVE EKS cluster with an endpoint (when Kubernetes mapping is enabled), the EKS collector calls collect_eks_workloads() in a worker thread and records a kubernetes:<cluster> coverage entry (SUCCESS with the object count, or FAILED with the error, typically an unreachable private endpoint or a missing access entry):

  • Authentication without a Kubernetes client: eks_token() presigns an STS GetCallerIdentity URL with the x-k8s-aws-id header, exactly like aws eks get-token, and sends it as a bearer token. TLS is verified against the cluster CA from DescribeCluster.
  • Reads only: KubernetesReader issues GETs, pages with limit / continue (500 per page) and stops at 5000 objects per list. Secrets are never read.
  • Mapping (_ClusterMapper): namespaces, service accounts (IRSA annotation → role), Deployments / StatefulSets / DaemonSets / CronJobs (images → repositories, service account, privileged containers, host network), Services (selector → workloads, load balancer hostnames → the ELB by DNS name), Ingresses (backends → services, hostnames → the ALB). Identifiers: k8s://<cluster ARN>/<namespace>/<Kind>/<name>.
  • Permissions: the identity cloudg runs as needs network reach to the endpoint and read access in the cluster; an access entry with AmazonEKSViewPolicy is enough. A failure does not affect the rest of the EKS collection.