Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add kubernetes credentials to the list of possible credentials #127

Conversation

thiagosalvatore
Copy link

We've been using AioDynamo for a while in my current company. The existing credentials work pretty well with ECS and EC2 machines. However, when running inside a Kubernetes cluster (like EKS), the metadata from the EC2 instance is not available and we don't have the credentials from AWS as environment variables because our pod basically assumes a role on AWS. We also don't have a file with credentials or anything like that. That said, we needed a way to fetch the credentials from AWS that our pod has, and luckily AWS offers us a way to do that by calling get_credentials.

This PR does the following:

  1. Creates a new KubernetesCredentials;
  2. Updates typing-extensions to support the most recent version;
  3. Add boto3-stubs to our dev dependencies;

Copy link
Contributor

@ojii ojii left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for your pull request.

Unfortunately, there's a few issues with it. Using boto3 results in blocking calls being made which is not suitable for an async library. From what I understand reading the documentation on how credentials work in EKS, what is needed to support it in aiodynamo is implementing AssumeRoleWithWebIdentity. Supporting that "natively" would be nice, but would need a much stronger test suite and not rely on mocks that much.

Also, please try to keep the code similar to the rest of the code, eg not using self.__... and using the existing logging infrastructure.

@ojii
Copy link
Contributor

ojii commented Jun 29, 2022

I think I know how to implement this natively (we have a custom credentials implementation for connecting with a saml response which is very similar) but my biggest concern is how to test this on EKS, since I've never touched either k8s or EKS. could you provide some guide how I could test the implementation?

@ojii
Copy link
Contributor

ojii commented Aug 4, 2022

I'm sorry, but I will close this PR. I'd love to add support for this, but the first step to do so would be to provide a way to test it and the implementation needs to be async native to be included in this repo.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants