search

yandex-cloud / geesefs

Finally, a good FUSE FS implementation over S3
Other
693 stars 45 forks source link

iam authentication stopped working #84

Closed FractalizeR closed 1 year ago

FractalizeR commented 1 year ago

I can no longer mount S3 with iam. Logs from syslog:

Aug 5 07:57:09 xxxxxxx-ru-central1-a /usr/bin/geesefs[4126199]: s3.INFO Bad response while trying to get IAM token from http://169.254.169.254/latest/meta-data/iam/security-credentials/default: invalid character 'T' looking for beginning of value Aug 5 07:57:29 xxxxxxx-ru-central1-a /usr/bin/geesefs[4126199]: message repeated 2 times: [ s3.INFO Bad response while trying to get IAM token from http://169.254.169.254/latest/meta-data/iam/security-credentials/default: invalid character 'T' looking for beginning of value] Aug 5 07:57:39 xxxxxxx-ru-central1-a /usr/bin/geesefs[4126199]: s3.INFO Bad response while trying to get IAM token from http://169.254.169.254/latest/meta-data/iam/security-credentials/default: invalid character 'T' looking for beginning of value Aug 5 07:57:49 xxxxxxx-ru-central1-a /usr/bin/geesefs[4126199]: s3.INFO Bad response while trying to get IAM token from http://169.254.169.254/latest/meta-data/iam/security-credentials/default: invalid character 'T' looking for beginning of value Aug 5 07:59:19 xxxxxxx-ru-central1-a /usr/bin/geesefs[4126199]: message repeated 9 times: [ s3.INFO Bad response while trying to get IAM token from http://169.254.169.254/latest/meta-data/iam/security-credentials/default: invalid character 'T' looking for beginning of value] Aug 5 07:59:29 xxxxxxx-ru-central1-a /usr/bin/geesefs[4126199]: s3.INFO Bad response while trying to get IAM token from http://169.254.169.254/latest/meta-data/iam/security-credentials/default: invalid

GeeseFS is '0.36.2'

FractalizeR commented 1 year ago

Google Compute Engine metadata format is not supported is the cause.

vitalif commented 1 year ago

Hi, it's supported, it's just not the default option. Use --iam-flavor gcp

vitalif commented 1 year ago

Hm. Oops. It's listed as default in my own help :-)

vitalif commented 1 year ago

Hm. For me, the latest version actually selects gcp by default and requests metadata from http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token So you should probably recheck that you're using the latest version...

FractalizeR commented 1 year ago

SmartSelect_20230807_174513_Browser

I have this answer from Yandex Cloud Support.

FractalizeR commented 1 year ago

Ticket number is AB926054

vitalif commented 1 year ago

I'm a more reliable source because I wrote that code :-) GCP metadata is supported, I retested it in Yandex Cloud just now. I mounted the FS with the only --iam option, even without --iam-flavor.

FractalizeR commented 1 year ago

Yeah, testing now with GCP. Looks like it works ok. It's hard to say why it failed with latest GeeseFS that time. Thanks a lot!