-
Notifications
You must be signed in to change notification settings - Fork 565
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(credential-provider-node): add support for web identity provider #2260
Conversation
e7c94cc
to
186fea0
Compare
77cac09
to
608cc2a
Compare
@AllanZhengYP I'm a tad stumped on this particular error getting thrown. Looks like you ran into something similar in #2055. Unfortunately adding to |
Hi @ejhayes, The original issue should already be fixed:
Now the |
Thanks for the quick response @AllanZhengYP --
This works fine with the cli:
|
Same issue here, we can't have our code to seamlessly work between local environments and EKS because of the lack of "auto-config" using ENV vars. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The reason to the failed CI is from the circular dependency you introduced in the credential-provider-web-identity
package. I provided some explanation for why it's the case and how to fix it.
Codecov Report
@@ Coverage Diff @@
## main #2260 +/- ##
=======================================
Coverage ? 60.06%
=======================================
Files ? 472
Lines ? 24838
Branches ? 5883
=======================================
Hits ? 14918
Misses ? 9920
Partials ? 0 Continue to review full report at Codecov.
|
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
Thanks for the input @AllanZhengYP! Looks like all tests are passing now |
@AllanZhengYP Is this something that could be merged in? Would be great to have this functionality supported in the default credential provider! |
Co-authored-by: AllanZhengYP <zheallan@amazon.com>
Hey @trivikr or @AllanZhengYP -- any way these changes could be merged in? Would be great to have this SDK working in EKS using the environment variables that are automatically set rather than having to create a config file! |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@ejhayes This looks awesome. 🚢 Thank you a lot for the contribution!
Thanks @AllanZhengYP! Looks like this is still blocked from merging. What else is needed to merge these changes in? |
This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs and link to relevant comments in this thread. |
Issue
Fixes #2148
Description
Adds default support for web identity credentials. This is useful when using this SDK with IAM Roles for Service accounts in EKS which set
AWS_ROLE_ARN
andAWS_WEB_IDENTITY_TOKEN_FILE
behind the scenes. Without this the default behavior of the SDK is to use credentials from IMDS.Testing
Tests have been updated.
Additional context
Additional updates include:
README.md
to include web identity params and default load order information (fixes typo)init
param offromTokenFile
to optional. Default to the default web identity assume role function fromclient-sts
if not providedBy submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.