Support EKS Pod Identity credentials #3416
Conversation
jackkleeman
force-pushed
the
eks-pod-identity
branch
3 times, most recently
from
9032e5e
to
a414ee1
Compare
|
This looks great! Someone from our team will do a detailed review next week. The one missing piece is a e2e integration test. You can see examples here: https://github.com/smithy-lang/smithy-rs/tree/6e3e010e912874262b37727d900d7fae170efaed/aws/rust-runtime/aws-config/test-data/default-provider-chain/ecs_credentials_invalid_profile |
jackkleeman
force-pushed
the
eks-pod-identity
branch
from
8b1ed5f
to
41c72e0
Compare
|
done @rcoh |
jackkleeman
force-pushed
the
eks-pod-identity
branch
from
41c72e0
to
111307e
Compare
| .await | ||
| .expect("localhost is the loopback interface"); | ||
| validate_full_uri("http://169.254.170.2.backname.io:8888/creds", dns.clone()) |
There was a problem hiding this comment.
This definitely works, but I'm a little hesitant to have our tests rely on backname.io since it adds some level of risk to our release process if backname.io happens to go down for a period of time. Could you refactor the test to use a fake ResolveDns trait implementation instead of the real one?
There was a problem hiding this comment.
this test is skipped because it already relies on dns resolution (of amazon.com)
see comment // ignored by default because it relies on actual DNS resolution
Is there some release process that is unskipping it?
There was a problem hiding this comment.
Oh, nope. I just didn't see that comment. Looks good then.
This brings this provider in line with other sdks by supporting AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE as well as permitting http IPs to be non-loopback if they are the EKS pod identity IPs. Signed-off-by: Jack Kleeman <jackkleeman@gmail.com>
Signed-off-by: Jack Kleeman <jackkleeman@gmail.com>
Co-authored-by: John DiSanti <john@vinylsquid.com>
jackkleeman
force-pushed
the
eks-pod-identity
branch
from
9186416
to
9b353f7
Compare
github-merge-queue
bot
removed this pull request from the merge queue due to failed status checks
Motivation and Context
I would like to support EKS Pod Identity credentials in the Rust SDKs
Description
This brings the ECS provider in line with other sdks (eg, Go) by supporting AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE as well as permitting http IPs to be non-loopback if they are the EKS pod identity IPs.
Testing
I have added various new unit tests, and I have updated the existing integration test to also create pods with eks pod identity creds, which I have used to test in a real EKS cluster as well.
Checklist
CHANGELOG.next.tomlif I made changes to the smithy-rs codegen or runtime cratesBy submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.