docs(mesh): AWS IAM workload validation ECS #3593
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add docs for workload label validation in Kong Mesh 2.13.x when MeshIdentity uses kuma.io/workload in SPIFFE ID path. IAM roles need matching workload tag, dataplanes need workload in metadata labels (not inbound tags). Backward compatible - only enforced when MeshIdentity with workload label exists. Based on Kong/kong-mesh 8757 Signed-off-by: Marcin Skalski <[email protected]>
✅ Deploy Preview for kongdeveloper ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Replace legacy {:.note} with {:.info} per Vale linting rules
Signed-off-by: Marcin Skalski <[email protected]>
Wrap label workload example in raw tags to prevent Jekyll parsing error Signed-off-by: Marcin Skalski <[email protected]>
Update to /mesh/policies/meshidentity/ Signed-off-by: Marcin Skalski <[email protected]>
Automaat
force-pushed
the
docs/mesh-ecs-workload-validation
branch
from
d8d61c2 to
fb691e4
Compare
doc page does not exist, causes 404s Signed-off-by: Marcin Skalski <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation
EC2 instances use IAM roles to issue DPP tokens. Kong Mesh 2.13.x enforces workload label validation for consistency and security when MeshIdentity with workload label is configured.
Implementation information
Updated ECS documentation to reflect new AWS IAM workload label validation:
kuma.io/workloadSupporting documentation
Based on Kong/kong-mesh#8757
Fix: #3399