search

IBM / ibmcloud-cos-cli

13 stars 11 forks source link

RFE: Read COS HMAC credentials from environment variables #8

Open mriedem opened 1 year ago

mriedem commented 1 year ago

The ibmcloud cos config hmac command prompts for the access key and secret access key. In a container environment where one might want to set the credentials it'd be nice if those could be read in from the environment.

For example, with rclone you can set env_auth=true in the config and it will read from standard AWS env vars (also usable for IBM COS):

https://rclone.org/s3/#authentication

Runtime configuration (env_auth = true in the config file):
  Export the following environment variables before running rclone:
    Access Key ID: AWS_ACCESS_KEY_ID or AWS_ACCESS_KEY
    Secret Access Key: AWS_SECRET_ACCESS_KEY or AWS_SECRET_KEY

We have a use case where we want to use the ibmcloud cos CLI from a kubernetes cron job. We have the ibmcloud cli built into the container image and need to read the HMAC keys from environment variables in the container. Our alternative hack workaround right now is to write out ~/.bluemix/plugins/cloud-object-storage/config.json ourselves.

IBMalok commented 1 year ago

Thanks for reporting it. I've created an internal ticket for it, and I'll take it to management.

mriedem commented 4 months ago

@IBMalok Hi, any updates on this? It's coming up as an issue again because we are now trying to run the ibmcloud COS CLI in a read-only container environment and our workaround of writing out the values to a config.json file are not working as a result. We might be able to mount a volume and write the config.json file there but ideally we could just have the CLI read from the environment.

If we can't get this to work we'll probably need to move away from the CLI completely and just use the raw REST API.

IBMalok commented 4 months ago

@mriedem - I looked at the code and discussed it with the team, and I found that changes to the code are required. Right now, we cannot take this item and develop it, at least not by Q3. we are keeping a feature backlog.