auth/aws: AWS CodeCommit IAM authentication#1142
auth/aws: AWS CodeCommit IAM authentication#1142taraspos wants to merge 3 commits intofluxcd:mainfrom
Conversation
taraspos
changed the title
taraspos
force-pushed
the
taras/aws-codecommit
branch
4 times, most recently
from
ba8d4f8 to
c69e541
Compare
makkes
changed the title
taraspos
force-pushed
the
taras/aws-codecommit
branch
3 times, most recently
from
304978e to
1043954
Compare
There was a problem hiding this comment.
Hey @matheuscscp I added the integration tests. Current state is following:
--- FAIL: TestGitCloneUsingProvider (130.58s)
--- PASS: TestGitCloneUsingProvider/controller-level_workload_identity (8.31s)
--- FAIL: TestGitCloneUsingProvider/object-level_workload_identity_(impersonation) (122.27s)
--- SKIP: TestGitCloneUsingProvider/object-level_workload_identity_(direct_access) (0.00s)
--- SKIP: TestGitCloneUsingProvider/object-level_workload_identity_(impersonation,_federation) (0.00s)
--- SKIP: TestGitCloneUsingProvider/object-level_workload_identity_(direct_access,_federation) (0.00s)
=== RUN TestGitCloneUsingSSH
git_test.go:87: Skipping git test, not supported for provider
--- SKIP: TestGitCloneUsingSSH (0.00s)
The "impersonation" test is failing with:
panic: failed to create provider access token for service account 'default/test-workload-id': an AWS region is required for authenticating with a service account. please configure one in the object spec
goroutine 1 [running]:
main.checkGit({0x1ceb7d8, 0xb32a9dc8230})
/Users/taraspos/code/fluxcd/pkg/tests/integration/testapp/main.go:243 +0x554
main.main()
/Users/taraspos/code/fluxcd/pkg/tests/integration/testapp/main.go:156 +0x934
I'm not sure if this thing is expected to work with AWS IRSA; however, I can't say that I have a full understanding of what it's trying to do here. I would appreciate your review and assistance when you have a moment.
There was a problem hiding this comment.
Nice @taraspos, thanks very much for working on this! We're busy with some urgent bugfixes in helm-controller due to Helm 4 upgrade this week, I'm gonna try to make some time next week to review this. Thanks!
There was a problem hiding this comment.
Sounds good, thanks. Just want to make sure this change can still land in Flux 2.9 :)
There was a problem hiding this comment.
@taraspos so you managed to run successfully the test with controller-level workload identity by cloning from CodeCommit? Is the issue with object-level only?
|
@taraspos CI is failing, can you pls take a look? |
|
Seems like setup-envtest released a new version that depends on Go 1.26.0 Not related to my change, but I can raise a PR with a fix. Let me do it in a separate branch. |
We just merged #1158, pls rebase and let's see if this gets fixed 🙏 |
|
I also raised this PR that pins |
taraspos
force-pushed
the
taras/aws-codecommit
branch
from
d1b5536 to
5ba3c17
Compare
Signed-off-by: Taras <9948629+taraspos@users.noreply.github.com>
Signed-off-by: Taras <9948629+taraspos@users.noreply.github.com>
taraspos
force-pushed
the
taras/aws-codecommit
branch
from
5ba3c17 to
328d851
Compare
Signed-off-by: Taras <9948629+taraspos@users.noreply.github.com>
4 participants
Summary
This PR implements IAM role based authentification for AWS CodeCommit Git HTTPS URLs
Testing
Verified locally that generated username and password works AWS CodeCommit repositories.