feat: add support for a credentials chain for minio access #31051
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
If a static access key id and secret are not provided, instead fallback to a pulling credentials from other places, in priority order: 1. MINIO_ prefixed environment variables 2. AWS_ prefixed environment variables 3. a minio credentials file 4. an aws credentials file 5. EC2 instance metadata This enables using temporary credentials that are auto-refreshed upon expiration.
GiteaBot
added
the
lgtm/need 2
pull-request-size
bot
added
the
size/S
techknowlogick
approved these changes
May 22, 2024
GiteaBot
added
lgtm/need 1
|
Thanks! Would you be able to add this to the documentation (app.ini example and config cheatsheet) as well? (the body of the PR is more than suitable to be used) |
pull-request-size
bot
added
size/M
|
I updated the en-us config cheatsheet and app.ini example to document the changes in minio credentials logic. I don't know how to translate this for the zh-cn config cheatsheet. Is there a process for translating these? |
delvh
approved these changes
May 23, 2024
GiteaBot
added
lgtm/done
|
Can we have a test? |
pull-request-size
bot
added
size/L
bohde
force-pushed
the
rb/minio-credentials-chain
branch
from
1cbf1ae
to
79a01e9
Compare
bohde
force-pushed
the
rb/minio-credentials-chain
branch
from
79a01e9
to
1a4127f
Compare
|
I added a test that verifies correct credentials are pulled from all of the possible credential providers in the chain. |
lunny
added
the
reviewed/wait-merge
GiteaBot
removed
the
reviewed/wait-merge
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We wanted to be able to use the IAM role provided by the EC2 instance metadata in order to access S3 via the Minio configuration. To do this, a new credentials chain is added that will check the following locations for credentials when an access key is not provided. In priority order, they are: