kubernetes-sigs/aws-iam-authenticator: technical due diligence, read from its repository

The codebase carries 73 TODO, FIXME, HACK or XXX markers across 18,985 lines. These are the team's own notes about work they knew was unfinished. A high density is not automatically bad — it can mean an honest team — but every one of them is a decision deferred, and after an acquisition they are deferred onto someone who was not in the room.

Strings shaped like credentials appear only where fakes are usual: test fixtures, examples, documentation, placeholders and local stacks. They are almost always fakes. Ask someone to confirm that none of them works anywhere, because a real key in a development file is still a real key.

No USER instruction switches away from root, so the process runs with full privileges inside the container. It is a one-line fix and an ordinary expectation, which is why its absence is worth asking about: it usually says more about whether anyone has reviewed the deployment than about this container specifically.

1 places in the deployment configuration run a container privileged or in the host's network, process or IPC namespace. A compromise of that container is a compromise of the machine, and most acquirers' security reviews block it. Node agents (network, storage, monitoring) are excluded.