Aws-iam-authenticator: Doc on installing aws-iam-authenticator

[rajal-amzn]

In the Readme file, the second step to "Run the server" is not clear. Can you modify that to describe how to run the server?

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or fejta.
/lifecycle stale

[andarob]

Deployment step instructions are incomplete. Deploying the example DaemonSet will cause the the pod to end up in CrashLoopBackOff.

Logs show the following:

time="2020-02-10T16:21:13Z" level=info msg="generated a new private key and certificate" certBytes=804 keyBytes=1194
time="2020-02-10T16:21:13Z" level=info msg="saving new key and certificate" certPath=/var/aws-iam-authenticator/cert.pem keyPath=/var/aws-iam-authenticator/key.pem
time="2020-02-10T16:21:13Z" level=fatal msg="could not load/generate a certificate" error="open /var/aws-iam-authenticator/cert.pem: permission denied"

This is due to UID in container being 10000 and the DaemonSet creating the hostPaths '/etc/kubernetes/aws-iam-authenticator/' and '/var/aws-iam-authenticator/' which will be created with UID and GID as root.

Potential fixes are to instruct the user to create the directories on the host with the correct permissions prior to deploying or add an initContainer to set the permissions prior to the aws-iam-authenticator pod starting.

initContainers:
- name: chown
  image: busybox
  command: ['sh', '-c', 'chown 10000:10000 /var/aws-iam-authenticator; chown 10000:10000 /etc/kubernetes/aws-iam-authenticator']
  volumeMounts:
  - name: state
    mountPath: /var/aws-iam-authenticator/
  - name: output
    mountPath: /etc/kubernetes/aws-iam-authenticator/

[christopherhein]

/lifecycle frozen