athens icon indicating copy to clipboard operation
athens copied to clipboard

Add support for IAM proxies for S3

Open aaqel-s opened this issue 5 years ago • 4 comments

What is the problem I am trying to address? Adding support for AWS IAM proxies in Kubernetes

Currently, S3 support in S3s only supports AWS configuration using Hardcoded credentials. Our application of K8s uses KIAM avoid using hardcoded creds for AWS by having AWS requests proxied through a sidecar that injects credentials based on the IAM role of the pod.

How is the fix applied?

Added an environment variable to enable support for IAM proxies and then added an if statement in s3.go to bypass the AWS cred provider (which is not needed when using a proxy.

Added two flags to Helm to configure IAM support and the particular role a user wants the proxy attached to.

Verified with make docker and running in our k8s cluster.

Mention the issue number it fixes or add the details of the changes if it doesn't have a specific issue.

Fixes #1452

aaqel-s avatar Dec 05 '19 21:12 aaqel-s

@aaqel-s just wanted to check in and see if you saw the other changes requested.

ghost avatar Jan 20 '20 21:01 ghost

Sorry folks, I got sidetracked with other stuff at work, I'll try to get back to this asap.

aaqel-s avatar Jan 21 '20 21:01 aaqel-s

Oh, one more thing @aaqel-s - can you please change the version field in Chart.yaml to 0.4.4?

arschles avatar Feb 19 '20 23:02 arschles

Just doing a quick review since this is in the post 0.13.x milestone:

  • This probably requires an update to the docs: https://docs.gomods.io/configuration/storage/#configuration-4
  • This branch needs a rebase since it was ~4 years ago

I'm willing to take this change over if @aaqel-s doesn't have time. I don't really have a way to test it however as this requires a specific Kubernetes setup.

matt0x6F avatar Jan 13 '24 04:01 matt0x6F