IMDSv1 and IMDSv2 abstraction for the retrieval of HANA DB Credentials from AWS Secrets Manager #112
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
added 3 commits
March 28, 2023 17:54
…t IMDSv1 and IMDSv2.
…t IMDSv1 and IMDSv2.
…t IMDSv1 and IMDSv2.
arbulu89
reviewed
Mar 30, 2023
There was a problem hiding this comment.
Hey @schniber
I'm afraid we cannot include this change so easily. The package ec2_metadata is not directly part of the repository where this package is published.
That's why we opted for the regular requests package. Would be some way to continue using requests?
PD:
In any case:
- I think that the tests would break
- The
requirements.txtandspecfile should be updated
|
Hey @arbulu89, Thanks a lot for your feedback that I took into account in the latest commit. below is the executing of the tests with the makefile: PR is ready for your review. Thanks a lot. Bests. |
…t IMDSv1 and IMDSv2.
arbulu89
requested changes
Apr 3, 2023
There was a problem hiding this comment.
@schniber we should have tests on this new code.
That the old ones are passing is just a coincidence, as most probably the first requests return code is 200 in the tests.
We should mock with the unauthorized return code and see that the proper call are done
Besides that, I would've put some comment on that new if condition.
I guess that if it returns unauthorized, it means that we are using IMDSv2 version. It would be nice to comment that down
|
damn, now it looks like |
Hey @arbulu89, just to be sure, you ask @schniber do replace all |
|
Hi @wombelix and @schniber, only changing the https://github.com/SUSE/hanadb_exporter/blob/master/.github/workflows/exporter-ci.yml file to This is a temporary workaround. I have opened #113 for fixing this in the future. |
|
Thanks a lot @diegoakechi for the clarification, @schniber can you please replace |
|
Hello all, I have just pushed changes related to our last discussion. Please feel free to run a peer review and provide feedback. Thanks a lot ! Bests. |
Thanks a lot @arbulu89, He's on vacation until next week, but we talked about the topic last week and he mentioned that some help in regards to the testing would be highly appreciated. So if you have some capacity to take his test cases and improve them, that would be really great. I'm also willing to contribute, feel free to let me know how I can help. |
|
@schniber added me as contributor to his fork, I will give it a shot to improve the tests a little |
Signed-off-by: Dominik Wombacher <domwom@amazon.de>
Based on feedback during PR review and pseudo code provided by arbulu89. Mocks for both get requests via side_effects and addition of mock for put. One assert added to verify if imdsv2 get included the test token. Signed-off-by: Dominik Wombacher <domwom@amazon.de>
Signed-off-by: Dominik Wombacher <domwom@amazon.de>
|
@arbulu89 I tried to brush up the tests, indentation and things like whitespaces and line width a little. Please let me know if I understood your recommendations correctly and if you think further improvements is required or if the PR can be merged. Result of local test run: |
IMDSv2 assert get assert extended to cover call to meta service with and without token header. Put assert added to verify submission of metadata token ttl header. Signed-off-by: Dominik Wombacher <domwom@amazon.de>
'side_effects' changed to 'side_effect', redundant return_value assignments removed. Signed-off-by: Dominik Wombacher <domwom@amazon.de>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hello,
This is a proposed quickfix for #111 that allows the use of the python library ec2-metadata to read the region name as opposed to querying the instance metadata services directly with the requests library.
This will allow users running on EC2 instances that are configure to use IMDSv2 (as well as IMDSv1) to use the prometheus hana db exporter while safely storing the HANA DB Credentials in AWS Secrets Manager.
Thanks for your peer review.
Bests.