Lets to get security credentials if run on AWS FarGate #2174

petlitskiy · 2023-05-24T10:00:53Z

Link to the Feature Build: SUBMODULES-0

If this PR adds or removes or alters one or more API endpoints, please review and add or update the relevant API documents as well:

API Docs updated

If this PR is related to some other PRs in this or other repositories, please provide links to those PRs:

Links to related pull requests (optional).

it-percona-cla · 2023-05-24T10:00:57Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ petlitskiy
❌ anonymous

anonymous seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

BupycHuk

Hi @petlitskiy,
thank you for your contribution.

Could you please sign the CLA, add to description what this PR is about and how it will help you?

I left a few comments what can be improved

Thank you

BupycHuk · 2023-05-24T11:07:51Z

managed/services/agents/rds.go

+        p, err := procfs.NewProc(1)
+        if err != nil {
+                log.Fatalf("could not get process: %s", err)
+        }
+
+        envs, err := p.Environ()
+        if err != nil {
+                log.Fatalf("could not get process stat: %s", err)
+        }


Suggested change

p, err := procfs.NewProc(1)

if err != nil {

log.Fatalf("could not get process: %s", err)

}

envs, err := p.Environ()

if err != nil {

log.Fatalf("could not get process stat: %s", err)

}

env := os.Environ()

if err != nil {

log.Fatalf("could not get process stat: %s", err)

}

BupycHuk · 2023-05-24T11:09:04Z

managed/services/agents/rds.go

@@ -65,6 +71,16 @@ func mergeLabels(node *models.Node, agent *models.Agent) (model.LabelSet, error)
 	return res, nil
 }

+func contains(s []string, str string) string {
+        for _, v := range s {
+                match, err := regexp.MatchString(str, v)


It can be replaced with just strings.HasPrefix

BupycHuk · 2023-05-24T11:09:52Z

managed/services/agents/rds.go

+                log.Fatalf("could not get process stat: %s", err)
+        }
+
+        result := contains(envs, "AWS_CONTAINER_CREDENTIALS_RELATIVE_URI.*")


Do we know the exact environment variable? we can use os.GetEnv for it

The exactly env variable ("AWS_CONTAINER_CREDENTIALS_RELATIVE_URI") ALWAYS is present only on AWS Fargate for PID 1 - i.e. only for "supervisord" process. It not available for "managed" process - that is why i use procfs but not os.GetEnv(). It is my opinion.

But yes - we can use os.GetEnv. I checked. It works well.

BupycHuk · 2023-05-24T15:26:04Z

managed/services/agents/rds.go

+        if result != "" {
+		return &agentpb.SetStateRequest_AgentProcess{
+			Type:               inventorypb.AgentType_RDS_EXPORTER,
+			TemplateLeftDelim:  tdp.Left,
+			TemplateRightDelim: tdp.Right,
+			Args:               args,
+			Env: []string{
+				fmt.Sprintf("AWS_CONTAINER_CREDENTIALS_RELATIVE_URI=%s", result),
+			},
+			TextFiles: map[string]string{
+				"config": "---\n" + string(b),
+			},
+			RedactWords: words,
+		}, nil
+        } else {
+		return &agentpb.SetStateRequest_AgentProcess{
+			Type:               inventorypb.AgentType_RDS_EXPORTER,
+			TemplateLeftDelim:  tdp.Left,
+			TemplateRightDelim: tdp.Right,
+			Args:               args,
+			TextFiles: map[string]string{
+				"config": "---\n" + string(b),
+			},
+			RedactWords: words,
+		}, nil
+	}


Suggested change

if result != "" {

return &agentpb.SetStateRequest_AgentProcess{

Type: inventorypb.AgentType_RDS_EXPORTER,

TemplateLeftDelim: tdp.Left,

TemplateRightDelim: tdp.Right,

Args: args,

Env: []string{

fmt.Sprintf("AWS_CONTAINER_CREDENTIALS_RELATIVE_URI=%s", result),

},

TextFiles: map[string]string{

"config": "---\n" + string(b),

},

RedactWords: words,

}, nil

} else {

return &agentpb.SetStateRequest_AgentProcess{

Type: inventorypb.AgentType_RDS_EXPORTER,

TemplateLeftDelim: tdp.Left,

TemplateRightDelim: tdp.Right,

Args: args,

TextFiles: map[string]string{

"config": "---\n" + string(b),

},

RedactWords: words,

}, nil

}

var env []string

if result != "" {

env = []string{fmt.Sprintf("AWS_CONTAINER_CREDENTIALS_RELATIVE_URI=%s", result)}

}

return &agentpb.SetStateRequest_AgentProcess{

Type: inventorypb.AgentType_RDS_EXPORTER,

TemplateLeftDelim: tdp.Left,

TemplateRightDelim: tdp.Right,

Args: args,

Env: env,

TextFiles: map[string]string{

"config": "---\n" + string(b),

},

RedactWords: words,

}, nil

To propagate AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variable to rds exporter child process. Reduced as maximum as i can.

artemgavrilov · 2023-06-28T12:58:27Z

Hi @petlitskiy , sorry for the delay. Are you still interested in this contribution? We would like to merge this change, can you please reopen this PR?

petlitskiy · 2023-06-28T18:38:57Z

Yes. I'll reopen. But i confused with your CLA assistant plugin. I have no idea what it wants from me. ср, 28 черв. 2023, 15:58 користувач Artem Gavrilov ***@***.***> пише:

…

Hi @petlitskiy <https://github.com/petlitskiy> , sorry for the delay. Are you still interested in this contribution? We would like to merge this change, can you please reopen this PR? — Reply to this email directly, view it on GitHub <#2174 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ATLN5D6O4PZ46ULYXRWIUMTXNQS73ANCNFSM6AAAAAAYNEB5QU> . You are receiving this because you were mentioned.Message ID: ***@***.***>

artemgavrilov · 2023-06-29T08:59:45Z

@petlitskiy Please check that your email in git setting matches email specified in Github account, most likely this is the case.

petlitskiy · 2023-06-30T08:22:55Z

Created again. #2334 чт, 29 черв. 2023 р. о 11:59 Artem Gavrilov ***@***.***> пише:

…

@petlitskiy <https://github.com/petlitskiy> Please check that your email in git setting matches email specified in Github account, most likely this is the case. — Reply to this email directly, view it on GitHub <#2174 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ATLN5D3PFOXUTFZU23KDIXTXNU7Y3ANCNFSM6AAAAAAYNEB5QU> . You are receiving this because you were mentioned.Message ID: ***@***.***>

petlitskiy · 2023-06-30T08:50:32Z

This a pretty small but meaningful improvement can make our work much more convenient. P.S. my colleague/chief like to update from PMM console. But to update from PMM console it the rds agent has to work inside ECS Fargate. пт, 30 черв. 2023 р. о 11:22 Олексій Петлицький ***@***.***> пише:

…

Created again. #2334 чт, 29 черв. 2023 р. о 11:59 Artem Gavrilov ***@***.***> пише: > @petlitskiy <https://github.com/petlitskiy> Please check that your email > in git setting matches email specified in Github account, most likely this > is the case. > > — > Reply to this email directly, view it on GitHub > <#2174 (comment)>, or > unsubscribe > <https://github.com/notifications/unsubscribe-auth/ATLN5D3PFOXUTFZU23KDIXTXNU7Y3ANCNFSM6AAAAAAYNEB5QU> > . > You are receiving this because you were mentioned.Message ID: > ***@***.***> >

Let to get security credentials if run on AWS FarGate

d4deb90

petlitskiy requested a review from a team as a code owner May 24, 2023 10:00

petlitskiy requested review from JiriCtvrtka and PavelKhripkov and removed request for a team May 24, 2023 10:00

petlitskiy mentioned this pull request May 24, 2023

Cannot get security credentials if run on AWS FarGate #2036

Closed

1 task

BupycHuk requested changes May 24, 2023

View reviewed changes

petlitskiy added 2 commits May 31, 2023 03:01

Update rds.go

1957411

To propagate AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variable to rds exporter child process. Reduced as maximum as i can.

Merge branch 'main' into feature/to_run_on_aws_fargate

935d53b

BupycHuk approved these changes Jun 6, 2023

View reviewed changes

BupycHuk removed the request for review from PavelKhripkov June 6, 2023 06:46

petlitskiy closed this Jun 17, 2023

petlitskiy deleted the feature/to_run_on_aws_fargate branch June 17, 2023 17:22

artemgavrilov self-requested a review June 28, 2023 12:58

artemgavrilov added the community Community contribution label Jun 28, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Lets to get security credentials if run on AWS FarGate #2174

Lets to get security credentials if run on AWS FarGate #2174

petlitskiy commented May 24, 2023

it-percona-cla commented May 24, 2023 •

edited

Loading

BupycHuk left a comment

BupycHuk May 24, 2023

BupycHuk May 24, 2023

BupycHuk May 24, 2023

petlitskiy May 25, 2023 •

edited

Loading

petlitskiy Jun 4, 2023

BupycHuk May 24, 2023

artemgavrilov commented Jun 28, 2023

petlitskiy commented Jun 28, 2023 via email

artemgavrilov commented Jun 29, 2023

petlitskiy commented Jun 30, 2023 via email

petlitskiy commented Jun 30, 2023 via email

Lets to get security credentials if run on AWS FarGate #2174

Lets to get security credentials if run on AWS FarGate #2174

Conversation

petlitskiy commented May 24, 2023

it-percona-cla commented May 24, 2023 • edited Loading

BupycHuk left a comment

Choose a reason for hiding this comment

BupycHuk May 24, 2023

Choose a reason for hiding this comment

BupycHuk May 24, 2023

Choose a reason for hiding this comment

BupycHuk May 24, 2023

Choose a reason for hiding this comment

petlitskiy May 25, 2023 • edited Loading

Choose a reason for hiding this comment

petlitskiy Jun 4, 2023

Choose a reason for hiding this comment

BupycHuk May 24, 2023

Choose a reason for hiding this comment

artemgavrilov commented Jun 28, 2023

petlitskiy commented Jun 28, 2023 via email

artemgavrilov commented Jun 29, 2023

petlitskiy commented Jun 30, 2023 via email

petlitskiy commented Jun 30, 2023 via email

it-percona-cla commented May 24, 2023 •

edited

Loading

petlitskiy May 25, 2023 •

edited

Loading