github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-24 20:24:09 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #104314 from sjenning/pick-238

Browse Source 
legacy-cloud-providers: aws: Add support for consuming web identity credentials
This commit is contained in:
Kubernetes Prow Robot 2021-09-01 23:48:09 -07:00 committed by GitHub
commit b0836a65f2
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 33 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

58
staging/src/k8s.io/legacy-cloud-providers/aws/aws.go
View File

@ -35,7 +35,6 @@ import (
"github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws"
"github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/aws/awserr"
"github.com/aws/aws-sdk-go/aws/credentials" "github.com/aws/aws-sdk-go/aws/credentials"
"github.com/aws/aws-sdk-go/aws/credentials/ec2rolecreds"
"github.com/aws/aws-sdk-go/aws/credentials/stscreds" "github.com/aws/aws-sdk-go/aws/credentials/stscreds"
"github.com/aws/aws-sdk-go/aws/ec2metadata" "github.com/aws/aws-sdk-go/aws/ec2metadata"
"github.com/aws/aws-sdk-go/aws/endpoints" "github.com/aws/aws-sdk-go/aws/endpoints"
@ -822,8 +821,11 @@ func (p *awsSDKProvider) Compute(regionName string) (EC2, error) {
} }
awsConfig = awsConfig.WithCredentialsChainVerboseErrors(true). awsConfig = awsConfig.WithCredentialsChainVerboseErrors(true).
WithEndpointResolver(p.cfg.getResolver()) WithEndpointResolver(p.cfg.getResolver())
sess, err := session.NewSessionWithOptions(session.Options{
Config: *awsConfig,
SharedConfigState: session.SharedConfigEnable,
})
sess, err := session.NewSession(awsConfig)
if err != nil { if err != nil {
return nil, fmt.Errorf("unable to initialize AWS session: %v", err) return nil, fmt.Errorf("unable to initialize AWS session: %v", err)
} }
@ -844,8 +846,10 @@ func (p *awsSDKProvider) LoadBalancing(regionName string) (ELB, error) {
} }
awsConfig = awsConfig.WithCredentialsChainVerboseErrors(true). awsConfig = awsConfig.WithCredentialsChainVerboseErrors(true).
WithEndpointResolver(p.cfg.getResolver()) WithEndpointResolver(p.cfg.getResolver())
sess, err := session.NewSessionWithOptions(session.Options{
sess, err := session.NewSession(awsConfig) Config: *awsConfig,
SharedConfigState: session.SharedConfigEnable,
})
if err != nil { if err != nil {
return nil, fmt.Errorf("unable to initialize AWS session: %v", err) return nil, fmt.Errorf("unable to initialize AWS session: %v", err)
} }
@ -862,8 +866,10 @@ func (p *awsSDKProvider) LoadBalancingV2(regionName string) (ELBV2, error) {
} }
awsConfig = awsConfig.WithCredentialsChainVerboseErrors(true). awsConfig = awsConfig.WithCredentialsChainVerboseErrors(true).
WithEndpointResolver(p.cfg.getResolver()) WithEndpointResolver(p.cfg.getResolver())
sess, err := session.NewSessionWithOptions(session.Options{
sess, err := session.NewSession(awsConfig) Config: *awsConfig,
SharedConfigState: session.SharedConfigEnable,
})
if err != nil { if err != nil {
return nil, fmt.Errorf("unable to initialize AWS session: %v", err) return nil, fmt.Errorf("unable to initialize AWS session: %v", err)
} }
@ -881,8 +887,10 @@ func (p *awsSDKProvider) Autoscaling(regionName string) (ASG, error) {
} }
awsConfig = awsConfig.WithCredentialsChainVerboseErrors(true). awsConfig = awsConfig.WithCredentialsChainVerboseErrors(true).
WithEndpointResolver(p.cfg.getResolver()) WithEndpointResolver(p.cfg.getResolver())
sess, err := session.NewSessionWithOptions(session.Options{
sess, err := session.NewSession(awsConfig) Config: *awsConfig,
SharedConfigState: session.SharedConfigEnable,
})
if err != nil { if err != nil {
return nil, fmt.Errorf("unable to initialize AWS session: %v", err) return nil, fmt.Errorf("unable to initialize AWS session: %v", err)
} }
@ -912,8 +920,10 @@ func (p *awsSDKProvider) KeyManagement(regionName string) (KMS, error) {
} }
awsConfig = awsConfig.WithCredentialsChainVerboseErrors(true). awsConfig = awsConfig.WithCredentialsChainVerboseErrors(true).
WithEndpointResolver(p.cfg.getResolver()) WithEndpointResolver(p.cfg.getResolver())
sess, err := session.NewSessionWithOptions(session.Options{
sess, err := session.NewSession(awsConfig) Config: *awsConfig,
SharedConfigState: session.SharedConfigEnable,
})
if err != nil { if err != nil {
return nil, fmt.Errorf("unable to initialize AWS session: %v", err) return nil, fmt.Errorf("unable to initialize AWS session: %v", err)
} }
@ -1171,30 +1181,28 @@ func init() {
return nil, fmt.Errorf("unable to validate custom endpoint overrides: %v", err) return nil, fmt.Errorf("unable to validate custom endpoint overrides: %v", err)
} }
sess, err := session.NewSession(&aws.Config{}) sess, err := session.NewSessionWithOptions(session.Options{
Config: aws.Config{},
SharedConfigState: session.SharedConfigEnable,
})
if err != nil { if err != nil {
return nil, fmt.Errorf("unable to initialize AWS session: %v", err) return nil, fmt.Errorf("unable to initialize AWS session: %v", err)
} }
var provider credentials.Provider var creds *credentials.Credentials
if cfg.Global.RoleARN == "" { if cfg.Global.RoleARN != "" {
provider = &ec2rolecreds.EC2RoleProvider{
Client: ec2metadata.New(sess),
}
} else {
klog.Infof("Using AWS assumed role %v", cfg.Global.RoleARN) klog.Infof("Using AWS assumed role %v", cfg.Global.RoleARN)
provider = &stscreds.AssumeRoleProvider{ provider := &stscreds.AssumeRoleProvider{
Client: sts.New(sess), Client: sts.New(sess),
RoleARN: cfg.Global.RoleARN, RoleARN: cfg.Global.RoleARN,
} }
}
creds := credentials.NewChainCredentials( creds = credentials.NewChainCredentials(
[]credentials.Provider{ []credentials.Provider{
&credentials.EnvProvider{}, &credentials.EnvProvider{},
provider, provider,
&credentials.SharedCredentialsProvider{}, })
}) }
aws := newAWSSDKProvider(creds, cfg) aws := newAWSSDKProvider(creds, cfg)
return newAWSCloud(*cfg, aws) return newAWSCloud(*cfg, aws)