Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

aws_credentials_http: Add support for EKS Pod Identities #9013

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 36 additions & 5 deletions include/fluent-bit/flb_aws_credentials.h
Original file line number Diff line number Diff line change
Expand Up @@ -257,18 +257,28 @@ struct flb_aws_provider *flb_aws_env_provider_create();
* used by host and path.
*/
struct flb_aws_provider *flb_http_provider_create(struct flb_config *config,
flb_sds_t host,
flb_sds_t endpoint,
flb_sds_t path,
flb_sds_t auth_token,
struct
flb_aws_client_generator
*generator);

struct flb_aws_provider *flb_local_http_provider_create(struct flb_config *config,
flb_sds_t endpoint,
flb_sds_t auth_token,
struct
flb_aws_client_generator
*generator);



/*
* ECS Provider
* The ECS Provider is just a wrapper around the HTTP Provider
* with the ECS credentials endpoint.
* Container Provider
* The Container Provider is just a wrapper around the HTTP Provider
* with the ECS/EKS credentials endpoint.
*/
struct flb_aws_provider *flb_ecs_provider_create(struct flb_config *config,
struct flb_aws_provider *flb_container_provider_create(struct flb_config *config,
struct
flb_aws_client_generator
*generator);
Expand Down Expand Up @@ -349,6 +359,27 @@ int try_lock_provider(struct flb_aws_provider *provider);

void unlock_provider(struct flb_aws_provider *provider);

/*
* HTTP Credentials Provider - retrieve credentials from a local http server
* Used to implement the Container Credentials provider.
* Equivalent to:
* https://github.com/aws/aws-sdk-go/tree/master/aws/credentials/endpointcreds
*/

struct flb_aws_provider_http {
struct flb_aws_credentials *creds;
time_t next_refresh;

struct flb_aws_client *client;

/* Endpoint to request credentials */
flb_sds_t endpoint;
flb_sds_t path;

/* Auth token */
flb_sds_t auth_token;
flb_sds_t auth_token_file;
};

#endif
#endif /* FLB_HAVE_AWS */
12 changes: 10 additions & 2 deletions include/fluent-bit/flb_aws_util.h
Original file line number Diff line number Diff line change
Expand Up @@ -144,13 +144,21 @@ flb_sds_t flb_aws_xml_error(char *response, size_t response_len);
flb_sds_t flb_aws_error(char *response, size_t response_len);

/*
* Similar to 'flb_aws_error', except it prints the JSON error type and message
* to the user in a error log.
* Similar to 'flb_aws_error', except it prints the JSON error __type and message
* field values to the user in a error log.
* 'api' is the name of the API that was called; this is used in the error log.
*/
void flb_aws_print_error(char *response, size_t response_len,
char *api, struct flb_output_instance *ins);

/*
* Similar to 'flb_aws_error', except it prints the JSON error Code and Message
* field values to the user in a error log.
* 'api' is the name of the API that was called; this is used in the error log.
*/
void flb_aws_print_error_code(char *response, size_t response_len,
char *api);

/* Similar to 'flb_aws_print_error', but for APIs that return XML */
void flb_aws_print_xml_error(char *response, size_t response_len,
char *api, struct flb_output_instance *ins);
Expand Down
6 changes: 3 additions & 3 deletions src/aws/flb_aws_credentials.c
Original file line number Diff line number Diff line change
Expand Up @@ -581,11 +581,11 @@ static struct flb_aws_provider *standard_chain_create(struct flb_config
}
}

sub_provider = flb_ecs_provider_create(config, generator);
sub_provider = flb_container_provider_create(config, generator);
if (sub_provider) {
/* ECS Provider will fail creation if we are not running in ECS */
/* HTTP Provider will fail creation if we are not running in ECS/EKS */
mk_list_add(&sub_provider->_head, &implementation->sub_providers);
flb_debug("[aws_credentials] Initialized ECS Provider in standard chain");
flb_debug("[aws_credentials] Initialized HTTP Provider in standard chain");
}

sub_provider = flb_ec2_provider_create(config, generator);
Expand Down
Loading
Loading