whitelist two environment variables for AWS IAM roles in Kubernetes

[mattwillsher]

• AWS_WEB_IDENTITY_TOKEN_FILE
• AWS_ROLE_ARN

Such that the AWS CodeCommit git credential helper can be used in the fluxcd container so that static git credentials are not needed. This does require additional components in the fluxcd container. For example:

FROM fluxcd/flux:1.20.0

ARG PY3PIP_VERSION=20.1.1-r0
ARG AWSCLI_VERSION=1.18.55-r0
ARG GITREMOTECODECOMMIT_VERSION=1.13

RUN /sbin/apk add --no-cache py3-pip="$PY3PIP_VERSION" aws-cli="$AWSCLI_VERSION"
RUN pip3 install git-remote-codecommit=="$GITREMOTECODECOMMIT_VERSION"
RUN git config --global credential.helper '!aws codecommit credential-helper $@' \
    && git config --global credential.UseHttpPath true

An IAM role for the service account can then be used to authentication to CodeCommit (https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html), with --git-url set to the HTTPS URL of the CodeCommit repo as given by aws, and a patch to the flux ServiceAccount giving the IAM role ARN:

---
apiVersion: v1
kind: ServiceAccount
metadata:
  namespace: flux
  name: flux
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/MyFluxRole

This goes someway to address #2895

[mattwillsher]

I see the build job didn't return here. Is there anything I can do to get that passed?

[stefanprodan]

/rebase

[jamesinc]

Keen for this PR to be merged

[kingdonb]

This sounds like an important feature, for AWS CodeCommit users 👍

[kingdonb]

I'd like to consider including this in the next release, but there are some CI checks which are still marked as failing.

@mattwillsher can you rebase this and add signoff according to instructions that the DCO merge check will provide? (Basically just git commit -s or git commit --amend -s if you want to skip a step, you can rebase and sign off.)

If you are still interested in merging this, the rebase update should trigger CI to run again. I will add it to the 1.21.3 milestone for now. Thanks.

[kingdonb]

Hi,

I want to include this in the next release, but I don't use AWS CodeCommit and can't test it by myself

Also, the DCO bot won't let me merge it if it isn't rebased, and signed-off

Would you be willing to rebase and amend the commit with --sign-off?

[mattwillsher]

Would you be willing to rebase and amend the commit with --sign-off?

Done

[kingdonb]

Thank you, that helps. Using the Github UI to catch up the branch...

[kingdonb]

I will rebase this into a release branch later, and update this PR with the final status when it gets merged in 1.22.0.

👍 thanks for your contribution!

[kingdonb]

/rebase

[kingdonb]

I changed the language of this PR to say, from:

This goes someway to resolve #2895

to:

This goes someway to address #2895

because the former is a hotword that will close #2895 when this PR is merged, but the language in the PR indicates it has other issues blocking #2895

[kingdonb]

LGTM