grpc: Add AWS IAM grpc credentials extension #7532

lavignes · 2019-07-11T03:41:28Z

This is the PR that ties together all the pieces that me and my colleagues contributed to add an AWS IAM gRPC authentication extension (#5215).

Note that I put mattklein123 as a CODEOWNER. This was just a default to get the PR open. I'm not sure who else should be listed. My other team-member who helped repackage my code into previous commits for this feature is no longer working with App Mesh, so obviously can't commit to helping maintain the extension as well. :-)

Risk Level: Medium
Testing: Added integration tests. +Manually tested against the AWS App Mesh service.
Docs Changes: Added in protobuf.
Release Notes: Added line about added extension.
Fixes: #5215

Signed-off-by: LaVigne, Scott lavignes@amazon.com

Signed-off-by: LaVigne, Scott <lavignes@amazon.com>

alyssawilk · 2019-07-11T13:32:25Z

@mattklein123 @envoyproxy/maintainers is anyone up for co-owning this one?

lavignes · 2019-07-11T19:10:10Z

/retest

repokitteh-read-only · 2019-07-11T19:10:15Z

🔨 rebuilding ci/circleci: coverage (failed build)

🐱

Caused by: a #7532 (comment) was created by @lavignes.

see: more, trace.

alyssawilk · 2019-07-11T20:40:52Z

At some point can you do a master merge, and move your release note to 1.12.0? Thanks!

lavignes · 2019-07-11T20:59:24Z

@alyssawilk Yup! I just realized 1.11 was cut.

* origin/master: bazel: adapt cc_wraper.py to python3 (#7519) Remove exclusive tag from aws_metadata_fetcher_integration_test (#7545) Common: Consume, proxy and insert metadata from downstream to upstream (#5656) quiche: add EnvoyQuicPacketWriter with sendmsg to set source address (#7416) config dump, listeners are added to warming list if workers are not started yet (#7511) Fix crash in request hedging handling. (#7530) build: simplify cc_configure and static link for libc++ (#7329) tools: update our release scripts (#7493) test: hopefully deflaking lua test (#7542) release: kicking off 1.12 (#7544) release: bump to 1.11.0 (#7538) Bump c-ARES version to include important fixes. (#7539) bazel: Update to 0.28.0 (#7533) tests: remove redundant std::move() (#7535) docs: cleanup for 1.11 release (#7522) build: remove -lc++fs from linkopts (#7534) Signed-off-by: LaVigne, Scott <lavignes@amazon.com>

Signed-off-by: LaVigne, Scott <lavignes@amazon.com>

lavignes · 2019-07-11T23:50:56Z

/retest

repokitteh-read-only · 2019-07-11T23:51:00Z

🔨 rebuilding ci/circleci: coverage (failed build)

🐱

Caused by: a #7532 (comment) was created by @lavignes.

see: more, trace.

mattklein123 · 2019-07-13T21:11:56Z

@lavignes i'm happy to review this one, but let's chat offline because if AWS is going to continue to submit extensions to the OSS repo we would appreciate one of you working to become a maintainer so that you can both help the project in a general sense and also help with self reviews. Thank you!

mattklein123 · 2019-07-18T17:11:27Z

Sorry am traveling will get to this next week. (Note also needs a master merge.)

…m_auth_plugin * refs/remotes/origin/master: (41 commits) clang-tidy: modernize-deprecated-headers (#7626) ci: use local_memory_estimate (#7558) listener: keep ListenerFactoryContext small (#7528) build: remove ranlib workaround (#7620) server: skip lifecycle notifications on early envoy shutdown (#7585) load balancer: fix?: panic mode is disabled only when healthy_panic_threshold is 0% (#7478) ci: speed up release and mac run (#7612) stats: rename StatDataAllocator and friends, paying down some tech-debt. (#7591) test: remove unused function in lua_integration_test.cc (#7590) clang-tidy: bugprone-unused-raii (#7605) admin: Add socket options (#7562) fix coverage publish script (#7608) Set zipkin_service_name to LocalInfo::clusterName(). (#7354) test: separate AdsIntegrationTest to a library (#7581) access log: Add AccessLoggers::Common::ImplBase base class to handle AccessLog::Filter evaluation (#7359) build: remove cc_configure and cc_wrapper (#7555) dispatcher: fix comment. (#7597) coverage: use LLVM and bazel native coverage (#7552) test: adding tests for set-cookie being handled correctly (#7541) Revert "ci: Enable bazel limited download flags (#7563)" (#7593) ... Signed-off-by: LaVigne, Scott <lavignes@amazon.com>

mattklein123

LGTM from a quick skim. A few small comments. Thank you!

/wait

docs/root/intro/version_history.rst

api/envoy/config/grpc_credential/v2alpha/aws_iam.proto

source/extensions/grpc_credentials/aws_iam/config.cc

source/extensions/grpc_credentials/aws_iam/config.h

test/extensions/grpc_credentials/aws_iam/aws_iam_grpc_credentials_test.cc

stale · 2019-07-30T00:05:25Z

This pull request has been automatically marked as stale because it has not had activity in the last 7 days. It will be closed in 7 days if no further activity occurs. Please feel free to give a status update now, ping for review, or re-open when it's ready. Thank you for your contributions!

lavignes · 2019-08-05T00:35:55Z

been on vacation for the last week or so. Will address comments tomorrow.

dio · 2019-08-05T03:36:23Z

Thanks @lavignes 🙏

@yanavlasov

* origin/master: (112 commits) docs: fix incorrect comment (#7827) docs: link to GetEnvoy.io for pre-built binaries (#7814) ci: compile_time_options in Azure RBE (#7817) docs: fix minor style issue in tracing.rst (#7821) clang-tidy: modernize-loop-convert (#7790) Fix comment (#7816) config: do not finish initialization on stream disconnection (#7427) ci: roll forward build image (#7809) security: add @yanavlasov to Envoy security team. (#7811) zookeeper: parse server responses (#7574) clang-tidy modernize-use-nullptr (#7791) fuzz: remove header prefix from Bootstrap (#7803) bump abseil to latest version (#7802) docs: fix custom header example (#7806) ci: partially revert #7786 to fix post submit (#7807) Add flag when open file (#7445) ci: use small image and use remote_jdk (#7786) docs: RBE, Docker sandbox and bazel fixes (#7657) [xds] refactor config provider framework (#7704) Dependency: update PGV, opencensus-proto, nghttp2, msgpack-c, bazel-gazelle & cleanup (#7787) ... Signed-off-by: LaVigne, Scott <lavignes@amazon.com>

* Update proto docs to mention AWS_REGION environment variable * Add aws_iam.proto to extension docs * fix nitpicks Signed-off-by: LaVigne, Scott <lavignes@amazon.com>

repokitteh-read-only · 2019-08-05T23:36:57Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to api/.

🐱

Caused by: #7532 was synchronize by lavignes.

see: more, trace.

Signed-off-by: LaVigne, Scott <lavignes@amazon.com>

repokitteh-read-only · 2019-08-05T23:41:15Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to api/.

🐱

Caused by: #7532 was synchronize by lavignes.

see: more, trace.

Signed-off-by: LaVigne, Scott <lavignes@amazon.com>

repokitteh-read-only · 2019-08-05T23:46:54Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to api/.

🐱

Caused by: #7532 was synchronize by lavignes.

see: more, trace.

Signed-off-by: LaVigne, Scott <lavignes@amazon.com>

repokitteh-read-only · 2019-08-06T00:12:00Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to api/.

🐱

Caused by: #7532 was synchronize by lavignes.

see: more, trace.

Signed-off-by: LaVigne, Scott <lavignes@amazon.com>

* origin/master: codec: add metadata_not_supported_error to HTTP/1 codec stats (#7801) accesslog: Add buffering and flushing to gRPC access log (#7755) tracing: Update OpenCensus. (#7797) Signed-off-by: LaVigne, Scott <lavignes@amazon.com>

repokitteh-read-only · 2019-08-06T20:07:54Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to api/.

🐱

Caused by: #7532 was synchronize by lavignes.

see: more, trace.

Signed-off-by: LaVigne, Scott <lavignes@amazon.com>

repokitteh-read-only · 2019-08-06T21:06:07Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to api/.

🐱

Caused by: #7532 was synchronize by lavignes.

see: more, trace.

repokitteh-read-only · 2019-08-08T18:24:35Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to api/.

🐱

Caused by: #7532 was synchronize by lavignes.

see: more, trace.

mattklein123

LGTM with one small doc request. Thank you!

/wait

docs/root/intro/version_history.rst

Signed-off-by: Scott LaVigne <lavignes@amazon.com>

repokitteh-read-only · 2019-08-08T22:13:05Z

CC @envoyproxy/api-shepherds: Your approval is needed for changes made to api/.

🐱

Caused by: #7532 was synchronize by lavignes.

see: more, trace.

mattklein123

Thanks!

lavignes added 2 commits July 10, 2019 20:09

grpc: Add AWS IAM grpc credentials extension

8e1c479

Signed-off-by: LaVigne, Scott <lavignes@amazon.com>

Add "override" to overriden method

d9bc6b1

Signed-off-by: LaVigne, Scott <lavignes@amazon.com>

lavignes added 2 commits July 11, 2019 14:47

Update version history for 1.12

f760f00

Signed-off-by: LaVigne, Scott <lavignes@amazon.com>

mattklein123 self-assigned this Jul 13, 2019

mattklein123 added the no stalebot Disables stalebot from closing an issue label Jul 18, 2019

mattklein123 requested changes Jul 22, 2019

View reviewed changes

repokitteh-read-only bot added the waiting label Jul 22, 2019

mattklein123 removed the no stalebot Disables stalebot from closing an issue label Jul 22, 2019

stale bot added the stale stalebot believes this issue/PR has not been touched recently label Jul 30, 2019

stale bot removed the stale stalebot believes this issue/PR has not been touched recently label Aug 5, 2019

lavignes added 2 commits August 5, 2019 10:20

Address PR comments

a86bf98

* Update proto docs to mention AWS_REGION environment variable * Add aws_iam.proto to extension docs * fix nitpicks Signed-off-by: LaVigne, Scott <lavignes@amazon.com>

repokitteh-read-only bot removed the waiting label Aug 5, 2019

fixing formatting

b669956

Signed-off-by: LaVigne, Scott <lavignes@amazon.com>

Actually fix formatting

5ad3573

Signed-off-by: LaVigne, Scott <lavignes@amazon.com>

Only build aws_iam grpc credential test when using Google Gprc client

32b9ce5

Signed-off-by: LaVigne, Scott <lavignes@amazon.com>

lavignes added 2 commits August 6, 2019 13:06

Fix clang-tidy errors

e5d4847

Signed-off-by: LaVigne, Scott <lavignes@amazon.com>

Fix more clang-tidy issues

b054361

Signed-off-by: LaVigne, Scott <lavignes@amazon.com>

This was referenced Aug 7, 2019

How does app mesh handle sig v4? aws/aws-app-mesh-examples#187

Closed

xDS gRPC credentials for AWS IAM #5215

Closed

Merge branch 'master' into aws_iam_auth_plugin

cf8260c

mattklein123 requested changes Aug 8, 2019

View reviewed changes

docs/root/intro/version_history.rst Outdated Show resolved Hide resolved

repokitteh-read-only bot added the waiting label Aug 8, 2019

Add link to proto docs from version_history

3a2a34c

Signed-off-by: Scott LaVigne <lavignes@amazon.com>

repokitteh-read-only bot removed the waiting label Aug 8, 2019

mattklein123 approved these changes Aug 9, 2019

View reviewed changes

mattklein123 merged commit c92b8ba into envoyproxy:master Aug 9, 2019

bcelenza mentioned this pull request Aug 26, 2019

Allow AWS SigV4 for SDS Authentication #8042

Closed

dastbe mentioned this pull request Nov 5, 2019

Feature Request: Running App Mesh outside of docker aws/aws-app-mesh-roadmap#131

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

grpc: Add AWS IAM grpc credentials extension #7532

grpc: Add AWS IAM grpc credentials extension #7532

lavignes commented Jul 11, 2019

alyssawilk commented Jul 11, 2019

lavignes commented Jul 11, 2019

repokitteh-read-only bot commented Jul 11, 2019

alyssawilk commented Jul 11, 2019

lavignes commented Jul 11, 2019

lavignes commented Jul 11, 2019

repokitteh-read-only bot commented Jul 11, 2019

mattklein123 commented Jul 13, 2019

mattklein123 commented Jul 18, 2019

mattklein123 left a comment

stale bot commented Jul 30, 2019

lavignes commented Aug 5, 2019

dio commented Aug 5, 2019

repokitteh-read-only bot commented Aug 5, 2019

repokitteh-read-only bot commented Aug 5, 2019

repokitteh-read-only bot commented Aug 5, 2019

repokitteh-read-only bot commented Aug 6, 2019

repokitteh-read-only bot commented Aug 6, 2019

repokitteh-read-only bot commented Aug 6, 2019

repokitteh-read-only bot commented Aug 8, 2019

mattklein123 left a comment

repokitteh-read-only bot commented Aug 8, 2019

mattklein123 left a comment

grpc: Add AWS IAM grpc credentials extension #7532

grpc: Add AWS IAM grpc credentials extension #7532

Conversation

lavignes commented Jul 11, 2019

alyssawilk commented Jul 11, 2019

lavignes commented Jul 11, 2019

repokitteh-read-only bot commented Jul 11, 2019

alyssawilk commented Jul 11, 2019

lavignes commented Jul 11, 2019

lavignes commented Jul 11, 2019

repokitteh-read-only bot commented Jul 11, 2019

mattklein123 commented Jul 13, 2019

mattklein123 commented Jul 18, 2019

mattklein123 left a comment

Choose a reason for hiding this comment

stale bot commented Jul 30, 2019

lavignes commented Aug 5, 2019

dio commented Aug 5, 2019

repokitteh-read-only bot commented Aug 5, 2019

repokitteh-read-only bot commented Aug 5, 2019

repokitteh-read-only bot commented Aug 5, 2019

repokitteh-read-only bot commented Aug 6, 2019

repokitteh-read-only bot commented Aug 6, 2019

repokitteh-read-only bot commented Aug 6, 2019

repokitteh-read-only bot commented Aug 8, 2019

mattklein123 left a comment

Choose a reason for hiding this comment

repokitteh-read-only bot commented Aug 8, 2019

mattklein123 left a comment

Choose a reason for hiding this comment