fix(aws-lambda): let plugin level proxy take effect on EKS IRSA credential provider #11551
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
windmgc
force-pushed
the
fix-aws-eks-irsa-cred-proxy
branch
2 times, most recently
from
808be20 to
9c1c58a
Compare
windmgc
added a commit
to Kong/lua-resty-aws
that referenced
this pull request
Sep 13, 2023
…ed config options as well (#79) Prerequisite for Kong/kong#11551 FTI-5242
windmgc
force-pushed
the
fix-aws-eks-irsa-cred-proxy
branch
from
9c1c58a to
d6786d4
Compare
windmgc
added a commit
that referenced
this pull request
Sep 15, 2023
…ntial provider (#11551) This PR contains a fix to let aws-lambda plugin-level proxy configuration take effect when fetching IAM credentials in an EKS environment. The EKS IRSA credential provider(aka TokenFileWebIdentityCredentials) will fire a request to AWS STS service when fetching the credential, and the request itself may need to go through the plugin-level proxy configuration. Here we check if a proxy is configured and whether the plugin is running inside the EKS environment with IRSA related configuration provided, then we replace the provider with a new TokenFileWebIdentityCredentials that supports proxy. FTI-5242
3 tasks
windmgc
added a commit
that referenced
this pull request
Nov 2, 2023
…ntial provider (#11551) This PR contains a fix to let aws-lambda plugin-level proxy configuration take effect when fetching IAM credentials in an EKS environment. The EKS IRSA credential provider(aka TokenFileWebIdentityCredentials) will fire a request to AWS STS service when fetching the credential, and the request itself may need to go through the plugin-level proxy configuration. Here we check if a proxy is configured and whether the plugin is running inside the EKS environment with IRSA related configuration provided, then we replace the provider with a new TokenFileWebIdentityCredentials that supports proxy. FTI-5242
3 tasks
windmgc
added a commit
that referenced
this pull request
Nov 3, 2023
…ntial provider (#11551) This PR contains a fix to let aws-lambda plugin-level proxy configuration take effect when fetching IAM credentials in an EKS environment. The EKS IRSA credential provider(aka TokenFileWebIdentityCredentials) will fire a request to AWS STS service when fetching the credential, and the request itself may need to go through the plugin-level proxy configuration. Here we check if a proxy is configured and whether the plugin is running inside the EKS environment with IRSA related configuration provided, then we replace the provider with a new TokenFileWebIdentityCredentials that supports proxy. FTI-5242
3 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR contains a fix to let aws-lambda plugin-level proxy configuration take effect when fetching IAM credentials in an EKS environment. The EKS IRSA credential provider(aka
TokenFileWebIdentityCredentials) will fire a request to AWS STS service when fetching the credential, and the request itself may need to go through the plugin-level proxy configuration. Here we check if a proxy is configured and whether the plugin is running inside the EKS environment with IRSA related configuration provided, then we replace the provider with a newTokenFileWebIdentityCredentialsthat supports proxy.Checklist
CHANGELOG/unreleased/kongor addingskip-changeloglabel on PR if unnecessary. README.mdFull changelog
Issue reference
FTI-5242, this is currently an urgent blocker