auth/aws: AWS CodeCommit IAM authentication#1142
auth/aws: AWS CodeCommit IAM authentication#1142taraspos wants to merge 3 commits intofluxcd:mainfrom
Conversation
taraspos
changed the title
taraspos
force-pushed
the
taras/aws-codecommit
branch
4 times, most recently
from
ba8d4f8 to
c69e541
Compare
makkes
changed the title
taraspos
force-pushed
the
taras/aws-codecommit
branch
3 times, most recently
from
304978e to
1043954
Compare
There was a problem hiding this comment.
Hey @matheuscscp I added the integration tests. Current state is following:
--- FAIL: TestGitCloneUsingProvider (130.58s)
--- PASS: TestGitCloneUsingProvider/controller-level_workload_identity (8.31s)
--- FAIL: TestGitCloneUsingProvider/object-level_workload_identity_(impersonation) (122.27s)
--- SKIP: TestGitCloneUsingProvider/object-level_workload_identity_(direct_access) (0.00s)
--- SKIP: TestGitCloneUsingProvider/object-level_workload_identity_(impersonation,_federation) (0.00s)
--- SKIP: TestGitCloneUsingProvider/object-level_workload_identity_(direct_access,_federation) (0.00s)
=== RUN TestGitCloneUsingSSH
git_test.go:87: Skipping git test, not supported for provider
--- SKIP: TestGitCloneUsingSSH (0.00s)
The "impersonation" test is failing with:
panic: failed to create provider access token for service account 'default/test-workload-id': an AWS region is required for authenticating with a service account. please configure one in the object spec
goroutine 1 [running]:
main.checkGit({0x1ceb7d8, 0xb32a9dc8230})
/Users/taraspos/code/fluxcd/pkg/tests/integration/testapp/main.go:243 +0x554
main.main()
/Users/taraspos/code/fluxcd/pkg/tests/integration/testapp/main.go:156 +0x934
I'm not sure if this thing is expected to work with AWS IRSA; however, I can't say that I have a full understanding of what it's trying to do here. I would appreciate your review and assistance when you have a moment.
There was a problem hiding this comment.
Nice @taraspos, thanks very much for working on this! We're busy with some urgent bugfixes in helm-controller due to Helm 4 upgrade this week, I'm gonna try to make some time next week to review this. Thanks!
There was a problem hiding this comment.
Sounds good, thanks. Just want to make sure this change can still land in Flux 2.9 :)
There was a problem hiding this comment.
@taraspos so you managed to run successfully the test with controller-level workload identity by cloning from CodeCommit? Is the issue with object-level only?
There was a problem hiding this comment.
Hey @matheuscscp, wanted to drop a quick reminder about this PR :)
Let me know if I can do anything to move this forward!
There was a problem hiding this comment.
Hi @taraspos, no need to worry here, this will definitely get in for the next Flux release. I'm keeping a tab open, I will reach this soon.
There was a problem hiding this comment.
This PR is just a first step. We need this integrated into source-controller & image-automation-controller, and also docs.
There was a problem hiding this comment.
This PR is just a first step. We need this integrated into source-controller & image-automation-controller, and also docs.
And potentially Flux CLI as well?
I can start raising draft PRs in there when I have time.
|
@taraspos CI is failing, can you pls take a look? |
|
Seems like setup-envtest released a new version that depends on Go 1.26.0 Not related to my change, but I can raise a PR with a fix. Let me do it in a separate branch. |
We just merged #1158, pls rebase and let's see if this gets fixed 🙏 |
This comment was marked as resolved.
This comment was marked as resolved.
taraspos
force-pushed
the
taras/aws-codecommit
branch
from
d1b5536 to
5ba3c17
Compare
Signed-off-by: Taras <9948629+taraspos@users.noreply.github.com>
Signed-off-by: Taras <9948629+taraspos@users.noreply.github.com>
taraspos
force-pushed
the
taras/aws-codecommit
branch
from
5ba3c17 to
328d851
Compare
Signed-off-by: Taras <9948629+taraspos@users.noreply.github.com>
matheuscscp
left a comment
matheuscscp
left a comment
There was a problem hiding this comment.
Started the review, will continue tomorrow 👌
4 participants
Summary
This PR implements IAM role based authentification for AWS CodeCommit Git HTTPS URLs
Testing
Verified locally that generated username and password works AWS CodeCommit repositories.