Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add eks pod identity credentials support #252

Merged
merged 4 commits into from
May 21, 2024
Merged

Conversation

tieum
Copy link
Contributor

@tieum tieum commented May 15, 2024

Proposed changes

Add support of EKS pod identities

Checklist

  • I have read the contributing guidelines.

  • I have signed the F5 Contributor License Agreement (CLA).

  • If applicable, I have added tests that prove my fix is effective or that my feature works.
    --> I didn't manage to add the correct test, however I didn't find any for webIdentity auth neither

  • I have updated any relevant documentation (e.g. README.md).
    --> there is a nice .png for which I didn't have the source to add _fetchEKSPodIdentityCredentials in the list

Copy link

github-actions bot commented May 15, 2024

✅ All required contributors have signed the F5 CLA for this PR. Thank you!
Posted by the CLA Assistant Lite bot.

@tieum
Copy link
Contributor Author

tieum commented May 15, 2024

I have hereby read the F5 CLA and agree to its terms

@4141done
Copy link
Collaborator

Thank you for your contribution, @tieum 🎉 I will make some time to understand and review this week.
Based on my quick look, can you confirm some things for me?

  1. This change will require the addition of a new config variable AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE?
  2. Can you tell me a bit more about your use case? I have not tried this in eks and I'm curious to understand how widely applicable this might be

@alessfg alessfg added the enhancement New feature or request label May 15, 2024
@tieum
Copy link
Contributor Author

tieum commented May 16, 2024

👋 @4141done

  1. The AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE environnement variable is available in the container when using EKS Pod Identity, the same way than AWS_WEB_IDENTITY_TOKEN_FILE is available when using IRSA
    I've updated the getting_started.md on how to set it up

  2. EKS Pod Identity was released in December 2023 and provides an alternative way to grant workload access to AWS, the differences with IAM Roles for Services Accounts can be found here, a Datadog Security Labs blog post also sums it up nicely

@tieum tieum removed their assignment May 16, 2024
@4141done
Copy link
Collaborator

Thank you for the explanation and for the very clean pull request. I think this is a great addition to the library. I have two requests before we merge:

  1. Can you try to add a test for this? There's an example to follow here. I know that our test suite isn't very standard since it's run using the njs binary so let me know if you have questions or would like me to jump in.
  2. Can you take a look at this file and see if we need to look for the file in the VM case too? I'm guessing not since this is EKS but I'd like to get your more informed take on whether it could be necessary in some situations.

@tieum
Copy link
Contributor Author

tieum commented May 17, 2024

  1. I added a test let me know what you think
  2. I checked the standalone install script and you are right, in the VM case this auth mechanism won't be available / there is no need to check for it

Copy link
Collaborator

@4141done 4141done left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍 🎉 🐳
This all looks great. Once again we very much appreciate your contribution!

@4141done 4141done merged commit 1e0e5e7 into nginxinc:main May 21, 2024
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants