search

lyft / metadataproxy

A proxy for AWS's metadata service that gives out scoped IAM credentials from STS
Other
456 stars 69 forks source link

Add option to match container to ip via given docker network. #101

Closed mrrusof closed 4 years ago

mrrusof commented 4 years ago

For the purpose of matching request ip to its swarm container, add the option to look for the container in the inspect JSON for swarm bridge network. See corresponding issue https://github.com/lyft/metadataproxy/issues/102.

Changes

  1. Add environment variable DOCKER_NETWORK. The variable gives the name of the docker network to use to match request ip to its container.
  2. Method roles.find_container_by_network(ip, network_name) that returns either the container corresponding to ip or None.
  3. Apply previous method to container lookup in roles.find_container(ip).

Tests

Tested in swarm node by running my-swarm-container-that-asks-for-a-role and running metadataproxy-container in the following way:

$ docker run -d --net=host --env DOCKER_NETWORK=docker_gwbridge -v /var/run/docker.sock:/var/run/docker.sock --name metadataproxy-container metadataproxy-image
$ iptables PREROUTING -d 169.254.169.254/32 -i docker_gwbridge -p tcp -m tcp --dport 80 -j DNAT --to-destination $LOCAL_IPV4:8000