nginxinc / nginx-s3-gateway

NGINX S3 Caching Gateway
Apache License 2.0
488 stars 127 forks source link

add eks pod identity credentials support #252

Closed tieum closed 3 months ago

tieum commented 3 months ago

Proposed changes

Add support of EKS pod identities

Checklist

github-actions[bot] commented 3 months ago

✅ All required contributors have signed the F5 CLA for this PR. Thank you!
Posted by the CLA Assistant Lite bot.

tieum commented 3 months ago

I have hereby read the F5 CLA and agree to its terms

4141done commented 3 months ago

Thank you for your contribution, @tieum 🎉 I will make some time to understand and review this week.
Based on my quick look, can you confirm some things for me?

  1. This change will require the addition of a new config variable AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE?
  2. Can you tell me a bit more about your use case? I have not tried this in eks and I'm curious to understand how widely applicable this might be
tieum commented 3 months ago

👋 @4141done

  1. The AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE environnement variable is available in the container when using EKS Pod Identity, the same way than AWS_WEB_IDENTITY_TOKEN_FILE is available when using IRSA I've updated the getting_started.md on how to set it up

  2. EKS Pod Identity was released in December 2023 and provides an alternative way to grant workload access to AWS, the differences with IAM Roles for Services Accounts can be found here, a Datadog Security Labs blog post also sums it up nicely

4141done commented 3 months ago

Thank you for the explanation and for the very clean pull request. I think this is a great addition to the library. I have two requests before we merge:

  1. Can you try to add a test for this? There's an example to follow here. I know that our test suite isn't very standard since it's run using the njs binary so let me know if you have questions or would like me to jump in.
  2. Can you take a look at this file and see if we need to look for the file in the VM case too? I'm guessing not since this is EKS but I'd like to get your more informed take on whether it could be necessary in some situations.
tieum commented 3 months ago
  1. I added a test let me know what you think
  2. I checked the standalone install script and you are right, in the VM case this auth mechanism won't be available / there is no need to check for it