From 3b9e63251be1053e2a3142d90d4ed25347e75d8b Mon Sep 17 00:00:00 2001 From: Brian Ristuccia Date: Thu, 22 Aug 2024 16:43:49 -0400 Subject: [PATCH 1/3] Allow short-lived AWS credentials Add SESSION_TOKEN to aws-secret and the pod environment. (Fixes #3) --- README.md | 1 + charts/irsa-manager/README.md | 1 + charts/irsa-manager/README.md.gotmpl | 1 + charts/irsa-manager/templates/deployment.yaml | 5 +++++ config/manager/manager.yaml | 6 ++++++ 5 files changed, 14 insertions(+) diff --git a/README.md b/README.md index 85b1c1b..bcb7336 100644 --- a/README.md +++ b/README.md @@ -92,6 +92,7 @@ Create a secret for irsa-manager to access AWS: kubectl create secret generic aws-secret -n irsa-manager-system \ --from-literal=aws-access-key-id= \ --from-literal=aws-secret-access-key= \ + --from-literal=aws-session-token= # Optional \ --from-literal=aws-region= \ --from-literal=aws-role-arn= # Optional: Set this if you want to switch roles diff --git a/charts/irsa-manager/README.md b/charts/irsa-manager/README.md index 95ec85d..fd0bb27 100644 --- a/charts/irsa-manager/README.md +++ b/charts/irsa-manager/README.md @@ -22,6 +22,7 @@ helm install irsa-manager kkb0318/irsa-manager -n irsa-manager-system --create-n kubectl create secret generic aws-secret -n irsa-manager-system \ --from-literal=aws-access-key-id= \ --from-literal=aws-secret-access-key= \ + --from-literal=aws-session-token= # Optional \ --from-literal=aws-region= \ --from-literal=aws-role-arn= # Optional: Set this if you want to switch roles diff --git a/charts/irsa-manager/README.md.gotmpl b/charts/irsa-manager/README.md.gotmpl index f318312..b70834f 100644 --- a/charts/irsa-manager/README.md.gotmpl +++ b/charts/irsa-manager/README.md.gotmpl @@ -22,6 +22,7 @@ helm install irsa-manager kkb0318/irsa-manager -n irsa-manager-system --create-n kubectl create secret generic aws-secret -n irsa-manager-system \ --from-literal=aws-access-key-id= \ --from-literal=aws-secret-access-key= \ + --from-literal=aws-session-token= # Optional \ --from-literal=aws-region= \ --from-literal=aws-role-arn= # Optional: Set this if you want to switch roles diff --git a/charts/irsa-manager/templates/deployment.yaml b/charts/irsa-manager/templates/deployment.yaml index a712ba7..54de97a 100644 --- a/charts/irsa-manager/templates/deployment.yaml +++ b/charts/irsa-manager/templates/deployment.yaml @@ -37,6 +37,11 @@ spec: secretKeyRef: key: aws-secret-access-key name: aws-secret + - name: AWS_SESSION_TOKEN + valueFrom: + secretKeyRef: + key: aws-session-token + name: aws-secret - name: AWS_REGION valueFrom: secretKeyRef: diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml index ef0de88..6bcd1bb 100644 --- a/config/manager/manager.yaml +++ b/config/manager/manager.yaml @@ -59,6 +59,12 @@ spec: name: aws-secret key: aws-secret-access-key # optional: true + - name: AWS_SESSION_TOKEN + valueFrom: + secretKeyRef: + name: aws-secret + key: aws-session-token + # optional: true - name: AWS_REGION valueFrom: secretKeyRef: From bdb64afe5cf3b38342ae2f9b071f96f7c84399d3 Mon Sep 17 00:00:00 2001 From: kkb0318 Date: Sun, 25 Aug 2024 12:33:10 +0900 Subject: [PATCH 2/3] fix: #2 us-east-1 support --- internal/aws/aws.go | 20 ++++++++++++++------ internal/controller/irsasetup_controller.go | 4 ++-- 2 files changed, 16 insertions(+), 8 deletions(-) diff --git a/internal/aws/aws.go b/internal/aws/aws.go index 9556a13..4e76472 100644 --- a/internal/aws/aws.go +++ b/internal/aws/aws.go @@ -122,12 +122,20 @@ func (a *AwsS3Client) PutObjectPublic(ctx context.Context, input ObjectInput) er func (a *AwsS3Client) CreateBucketPublic(ctx context.Context) error { log.Printf("creating S3 bucket... Name: %s, Region: %s \n", a.bucketName, a.Region()) bucket := aws.String(a.bucketName) - _, err := a.Client.CreateBucket(ctx, &s3.CreateBucketInput{ - Bucket: bucket, - CreateBucketConfiguration: &s3types.CreateBucketConfiguration{ - LocationConstraint: s3types.BucketLocationConstraint(a.Region()), - }, - }) + var input *s3.CreateBucketInput + if a.Region() == "us-east-1" { + input = &s3.CreateBucketInput{ + Bucket: bucket, + } + } else { + input = &s3.CreateBucketInput{ + Bucket: bucket, + CreateBucketConfiguration: &s3types.CreateBucketConfiguration{ + LocationConstraint: s3types.BucketLocationConstraint(a.Region()), + }, + } + } + _, err := a.Client.CreateBucket(ctx, input) if err != nil { var bucketAlreadyOwnedByYou *s3types.BucketAlreadyOwnedByYou if errors.As(err, &bucketAlreadyOwnedByYou) { diff --git a/internal/controller/irsasetup_controller.go b/internal/controller/irsasetup_controller.go index ad55884..d253f43 100644 --- a/internal/controller/irsasetup_controller.go +++ b/internal/controller/irsasetup_controller.go @@ -88,11 +88,11 @@ func (r *IRSASetupReconciler) Reconcile(ctx context.Context, req ctrl.Request) ( } defer func() { - if err := r.Get(ctx, req.NamespacedName, &irsav1alpha1.IRSASetup{}); err != nil { + if e := r.Get(ctx, req.NamespacedName, &irsav1alpha1.IRSASetup{}); e != nil { return } statusHandler := handler.NewStatusHandler(kubeClient) - if err := statusHandler.Patch(ctx, obj); err != nil { + if e := statusHandler.Patch(ctx, obj); e != nil { return } }() From b117a13dbd6d5eff9311f726eeb1ac4a0e34b4d2 Mon Sep 17 00:00:00 2001 From: Brian Ristuccia Date: Wed, 11 Sep 2024 19:28:01 -0400 Subject: [PATCH 3/3] make secrets for AWS_ environment variables optional --- charts/irsa-manager/templates/deployment.yaml | 4 ++++ config/manager/manager.yaml | 8 ++++---- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/charts/irsa-manager/templates/deployment.yaml b/charts/irsa-manager/templates/deployment.yaml index 54de97a..7bf85b6 100644 --- a/charts/irsa-manager/templates/deployment.yaml +++ b/charts/irsa-manager/templates/deployment.yaml @@ -32,21 +32,25 @@ spec: secretKeyRef: key: aws-access-key-id name: aws-secret + optional: true - name: AWS_SECRET_ACCESS_KEY valueFrom: secretKeyRef: key: aws-secret-access-key name: aws-secret + optional: true - name: AWS_SESSION_TOKEN valueFrom: secretKeyRef: key: aws-session-token name: aws-secret + optional: true - name: AWS_REGION valueFrom: secretKeyRef: key: aws-region name: aws-secret + optional: true - name: AWS_ROLE_ARN valueFrom: secretKeyRef: diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml index 6bcd1bb..f70479b 100644 --- a/config/manager/manager.yaml +++ b/config/manager/manager.yaml @@ -52,25 +52,25 @@ spec: secretKeyRef: name: aws-secret key: aws-access-key-id - # optional: true + optional: true - name: AWS_SECRET_ACCESS_KEY valueFrom: secretKeyRef: name: aws-secret key: aws-secret-access-key - # optional: true + optional: true - name: AWS_SESSION_TOKEN valueFrom: secretKeyRef: name: aws-secret key: aws-session-token - # optional: true + optional: true - name: AWS_REGION valueFrom: secretKeyRef: name: aws-secret key: aws-region - # optional: true + optional: true - name: AWS_ROLE_ARN valueFrom: secretKeyRef: