Skip to content

Commit f71a7eb

Browse files
J12934Weltraumschaf
J12934
authored and
Weltraumschaf
committed
Rename aws authType for better clarity w/ Pod Identity support
Pod Identity Auth was already working with the IRSA setting, which is somewhat confusing. The old value remains supported for now as renaming it would break installations. Related cleanup ticket for the next breaking change release: #3327 Signed-off-by: Jannik Hollenbach <jannik.hollenbach@iteratec.com>
1 parent b048727 commit f71a7eb

6 files changed

Lines changed: 18 additions & 11 deletions

File tree

‎documentation/docs/getting-started/installation.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -172,7 +172,7 @@ Depending on the expected scan duration in your setup, this limitation can pose
172172
enabled: false
173173
s3:
174174
enabled: true
175-
authType: "aws-irsa" # Note: secureCodeBox still uses this config name even for Pod Identity
175+
authType: "aws-iam"
176176
bucket: <your-bucket-name>
177177
endpoint: "s3.<your-region>.amazonaws.com"
178178
```
@@ -261,7 +261,7 @@ Depending on the expected scan duration in your setup, this limitation can pose
261261
enabled: false
262262
s3:
263263
enabled: true
264-
authType: "aws-irsa"
264+
authType: "aws-iam"
265265
bucket: <your-bucket-name>
266266
endpoint: "s3.<your-region>.amazonaws.com"
267267
serviceAccount:

‎operator/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -104,8 +104,8 @@ helm install securecodebox-operator oci://ghcr.io/securecodebox/helm/operator
104104
| probes.liveness | object | `{"httpGet":{"path":"/healthz","port":"healthchecks"},"initialDelaySeconds":15,"periodSeconds":20}` | Liveness probe configuration |
105105
| probes.readiness | object | `{"httpGet":{"path":"/readyz","port":"healthchecks"},"initialDelaySeconds":5,"periodSeconds":10}` | Readiness probe configuration |
106106
| resources | object | `{"limits":{"cpu":"100m","memory":"30Mi"},"requests":{"cpu":"100m","memory":"20Mi"}}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) |
107-
| s3.authType | string | `"access-secret-key"` | Authentication method. Supports access-secret-key (used by most s3 endpoint) and aws-irsa (Used by AWS EKS IAM Role to Kubenetes Service Account Binding. Support for AWS IRSA is considered experimental in the secureCodeBox) |
108-
| s3.awsStsEndpoint | string | `"https://sts.amazonaws.com"` | STS Endpoint used in AWS IRSA Authentication. Change this to the sts endpoint of your aws region. Only used when s3.authType is set to "aws-irsa" |
107+
| s3.authType | string | `"access-secret-key"` | Authentication method. Supports `access-secret-key` (used by most s3 endpoints) and `aws-iam`` (Used by AWS EKS IAM Role to Kubernetes Service Account Binding (IRSA) and EKS Pod Identity Authentication. Support for AWS IRSA is considered experimental in the secureCodeBox) |
108+
| s3.awsStsEndpoint | string | `"https://sts.amazonaws.com"` | STS Endpoint used in AWS IRSA Authentication. Change this to the sts endpoint of your aws region. Only used when s3.authType is set to "aws-iam". Usually not required, even in IRSA or Pod Identity setups as the region gets injected by AWS into the pod. |
109109
| s3.bucket | string | `"my-bucket"` | |
110110
| s3.enabled | bool | `false` | |
111111
| s3.endpoint | string | `"fra1.digitaloceanspaces.com"` | |

‎operator/controllers/execution/scans/scan_controller.go‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -261,13 +261,18 @@ func (r *ScanReconciler) initS3Connection() *minio.Client {
261261

262262
var creds *credentials.Credentials
263263

264-
if authType, ok := os.LookupEnv("S3_AUTH_TYPE"); ok && strings.ToLower(authType) == "aws-irsa" {
264+
// todo(v6): remove support for authType = "aws-irsa" and only support "aws-iam": https://github.com/secureCodeBox/secureCodeBox/issues/3327
265+
if authType, ok := os.LookupEnv("S3_AUTH_TYPE"); ok && (strings.ToLower(authType) == "aws-irsa" || strings.ToLower(authType) == "aws-iam") {
265266
stsEndpoint := ""
267+
// todo(v6): remove support for S3_AWS_STS_ENDPOINT env var and only support S3_AWS_IRSA_STS_ENDPOINT: https://github.com/secureCodeBox/secureCodeBox/issues/3327
266268
if configuredStsEndpoint, ok := os.LookupEnv("S3_AWS_IRSA_STS_ENDPOINT"); ok {
267269
stsEndpoint = configuredStsEndpoint
268270
}
271+
if configuredStsEndpoint, ok := os.LookupEnv("S3_AWS_STS_ENDPOINT"); ok {
272+
stsEndpoint = configuredStsEndpoint
273+
}
269274

270-
r.Log.Info("Using AWS IRSA ServiceAccount Bindung for S3 Authentication", "sts", stsEndpoint)
275+
r.Log.Info("Using AWS IAM ServiceAccount Binding for S3 Authentication (IRSA or EKS Pod Identity)", "sts", stsEndpoint)
271276
creds = credentials.NewIAM(stsEndpoint)
272277
} else {
273278
creds = credentials.NewEnvMinio()

‎operator/docs/README.ArtifactHub.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -109,8 +109,8 @@ helm install securecodebox-operator oci://ghcr.io/securecodebox/helm/operator
109109
| probes.liveness | object | `{"httpGet":{"path":"/healthz","port":"healthchecks"},"initialDelaySeconds":15,"periodSeconds":20}` | Liveness probe configuration |
110110
| probes.readiness | object | `{"httpGet":{"path":"/readyz","port":"healthchecks"},"initialDelaySeconds":5,"periodSeconds":10}` | Readiness probe configuration |
111111
| resources | object | `{"limits":{"cpu":"100m","memory":"30Mi"},"requests":{"cpu":"100m","memory":"20Mi"}}` | CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/) |
112-
| s3.authType | string | `"access-secret-key"` | Authentication method. Supports access-secret-key (used by most s3 endpoint) and aws-irsa (Used by AWS EKS IAM Role to Kubenetes Service Account Binding. Support for AWS IRSA is considered experimental in the secureCodeBox) |
113-
| s3.awsStsEndpoint | string | `"https://sts.amazonaws.com"` | STS Endpoint used in AWS IRSA Authentication. Change this to the sts endpoint of your aws region. Only used when s3.authType is set to "aws-irsa" |
112+
| s3.authType | string | `"access-secret-key"` | Authentication method. Supports `access-secret-key` (used by most s3 endpoints) and `aws-iam`` (Used by AWS EKS IAM Role to Kubernetes Service Account Binding (IRSA) and EKS Pod Identity Authentication. Support for AWS IRSA is considered experimental in the secureCodeBox) |
113+
| s3.awsStsEndpoint | string | `"https://sts.amazonaws.com"` | STS Endpoint used in AWS IRSA Authentication. Change this to the sts endpoint of your aws region. Only used when s3.authType is set to "aws-iam". Usually not required, even in IRSA or Pod Identity setups as the region gets injected by AWS into the pod. |
114114
| s3.bucket | string | `"my-bucket"` | |
115115
| s3.enabled | bool | `false` | |
116116
| s3.endpoint | string | `"fra1.digitaloceanspaces.com"` | |

‎operator/templates/manager/manager.yaml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,9 @@ spec:
106106
name: {{ .Values.s3.keySecret }}
107107
key: {{ .Values.s3.secretAttributeNames.secretkey }}
108108
{{- end }}
109-
{{- if eq .Values.s3.authType "aws-irsa" }}
109+
# todo(v6): remove support for authType = "aws-irsa" and only support "aws-iam": https://github.com/secureCodeBox/secureCodeBox/issues/3327
110+
{{- if or (eq .Values.s3.authType "aws-irsa") (eq .Values.s3.authType "aws-iam") }}
111+
{{- if .Values.s3.awsStsEndpoint }}
110112
- name: S3_AWS_IRSA_STS_ENDPOINT
111113
value: {{ .Values.s3.awsStsEndpoint | quote }}
112114
{{- end }}

‎operator/values.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -167,7 +167,7 @@ s3:
167167
bucket: "my-bucket"
168168
# Implicit 443. You probably only need to change this when the system uses a non default port
169169
port: null
170-
# s3.authType -- Authentication method. Supports access-secret-key (used by most s3 endpoint) and aws-irsa (Used by AWS EKS IAM Role to Kubenetes Service Account Binding. Support for AWS IRSA is considered experimental in the secureCodeBox)
170+
# s3.authType -- Authentication method. Supports `access-secret-key` (used by most s3 endpoints) and `aws-iam`` (Used by AWS EKS IAM Role to Kubernetes Service Account Binding (IRSA) and EKS Pod Identity Authentication. Support for AWS IRSA is considered experimental in the secureCodeBox)
171171
authType: access-secret-key
172172
# Name to a k8s secret in the same namespace as this release with credentials to the s3 bucket. Only used when s3.authType is set to "access-secret-key"
173173
# By default this assumes to have 'accesskey' and 'secretkey' as attributes
@@ -178,7 +178,7 @@ s3:
178178
secretAttributeNames:
179179
accesskey: accesskey
180180
secretkey: secretkey
181-
# s3.awsStsEndpoint -- STS Endpoint used in AWS IRSA Authentication. Change this to the sts endpoint of your aws region. Only used when s3.authType is set to "aws-irsa"
181+
# s3.awsStsEndpoint -- STS Endpoint used in AWS IRSA Authentication. Change this to the sts endpoint of your aws region. Only used when s3.authType is set to "aws-iam". Usually not required, even in IRSA or Pod Identity setups as the region gets injected by AWS into the pod.
182182
awsStsEndpoint: "https://sts.amazonaws.com"
183183

184184
# -- Go Template that generates the path used to store raw result file and findings.json file in the s3 bucket. Can be used to store the files in a subfolder of the s3 bucket

0 commit comments

Comments
 (0)