Skip to content

Commit a5c8ce8

Browse files
EItanyaEItanya
authored
Aws sts (#73)
* using fork for now * putting away for now :( * fetcher should be basically working? * compiling, need to clean up regex logic big time * finished version using callbacks * factory is working * change in factory * removed unused config code * split? * pulled out status enum, added failure callback * passing in protocol_options * filter * switched to shared_ptr * it built baby * latest * move it * more move * compiles * merge with master * added exception * changes * Merge branch 'aws-sts' of github.com:solo-io/envoy-gloo into aws-sts * switched tls over to credentials provider * added filewatcher * checking for expired * more comments * compiles * almost compiling * run all * shared_from_this * all building * copy in callbacks * init to false oops oops again * filter tests are passing again * test compile and fail * added a bunch of logging * merge with master * test crashing * temp * Merge branch 'aws-sts' of github.com:solo-io/envoy-gloo into aws-sts * broken shared ptr tls_cache * seg faults fixed * seg faults fixed * added content-type + length * test regex works * Merge branch 'aws-sts' of github.com:solo-io/envoy-gloo into aws-sts * added version param * Merge branch 'aws-sts' of github.com:solo-io/envoy-gloo into aws-sts * changed logic flow * so close * percent encoding * web token works * different heap * latest * fixes * it works * yuval comment * e2es working, added credentials provider failure tests * fixed tests and expiration string * sts_fetcher_tests * compiles, need to debug * print correct status codes, call lambdafy * oops * git is hard * add test for expiry grace period * Merge branch 'aws-sts' of github.com:solo-io/envoy-gloo into aws-sts * don't lambafy on local response * fix test mocks order * some comment fixes * filter cleanp * clean up * weird deadline * Merge branch 'aws-sts' of github.com:solo-io/envoy-gloo into aws-sts * minor fixes + changelog * Merge remote-tracking branch 'origin/master' into aws-sts * unused var clean up * format fix * make condition more explicit
1 parent 5672810 commit a5c8ce8

31 files changed

+2091
-200
lines changed

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
bazel-*
2+
ci/envoy.stripped
23
generated
34
.vscode/
45
compile_commands.json

‎api/envoy/config/filter/http/aws_lambda/v2/aws_lambda.proto‎

Lines changed: 42 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ option java_package = "io.envoyproxy.envoy.config.filter.http.aws_lambda.v2";
66
option java_outer_classname = "AwsLambdaProto";
77
option java_multiple_files = true;
88
import "google/protobuf/wrappers.proto";
9+
import "google/protobuf/duration.proto";
910
import "validate/validate.proto";
1011

1112
// [#protodoc-title: AWS Lambda]
@@ -38,15 +39,48 @@ message AWSLambdaProtocolExtension {
3839
string secret_key = 4;
3940
// The session_token for AWS this cluster
4041
string session_token = 5;
42+
// The role_arn to use when generating credentials for the mounted projected SA token
43+
string role_arn = 6;
4144
}
4245

4346
message AWSLambdaConfig {
44-
// Use AWS default credentials chain to get credentials.
45-
// This will search environment variables, ECS metadata and instance metadata
46-
// to get the credentials. credentials will be rotated automatically.
47-
//
48-
// If credentials are provided on the cluster (using the
49-
// AWSLambdaProtocolExtension), it will override these credentials. This
50-
// defaults to false, but may change in the future to true.
51-
google.protobuf.BoolValue use_default_credentials = 1;
47+
48+
oneof credentials_fetcher {
49+
// Use AWS default credentials chain to get credentials.
50+
// This will search environment variables, ECS metadata and instance metadata
51+
// to get the credentials. credentials will be rotated automatically.
52+
//
53+
// If credentials are provided on the cluster (using the
54+
// AWSLambdaProtocolExtension), it will override these credentials. This
55+
// defaults to false, but may change in the future to true.
56+
google.protobuf.BoolValue use_default_credentials = 1;
57+
58+
// Use projected service account token, and role arn to create reate temporary
59+
// credentials with which to authenticate lambda requests.
60+
// This functionality is meant to work along side EKS service account to IAM
61+
// binding functionality as outlined here:
62+
// https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.htmll
63+
//
64+
// If the following environment values are not present, this option cannot be used.
65+
// 1. AWS_WEB_IDENTITY_TOKEN_FILE
66+
// 2. AWS_ROLE_ARN
67+
//
68+
// The role arn may also be specified in the `AWSLambdaProtocolExtension` on the cluster level,
69+
// to override the environment variable.
70+
ServiceAccountCredentials service_account_credentials = 2;
71+
}
72+
73+
74+
// In order to specify the aws sts endpoint, both the cluster and uri must be set.
75+
// This is due to an envoy limitation which cannot infer the host or path from the cluster,
76+
// and therefore must be explicitly specified via the uri
77+
message ServiceAccountCredentials {
78+
// The name of the envoy cluster which represents the desired aws sts endpoint
79+
string cluster = 1 [ (validate.rules).string.min_bytes = 1 ];
80+
// The full uri of the aws sts endpoint
81+
string uri = 2 [ (validate.rules).string.min_bytes = 1 ];
82+
// timeout for the request
83+
google.protobuf.Duration timeout = 3;
84+
}
85+
5286
}

‎changelog/v1.15.0-patch3/aws-sts.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
changelog:
2+
- type: FIX
3+
description: Support assuming IAM Role using STS for AWS injected pods using AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE environment variables.
4+
issueLink: https://github.com/solo-io/gloo/issues/3309
5+
resolvesIssue: false

‎ci/Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,4 +14,4 @@ RUN mkdir -p /etc/envoy
1414
ADD envoy.stripped /usr/local/bin/envoy
1515

1616
ENTRYPOINT ["/usr/bin/dumb-init", "--", "/usr/local/bin/envoy"]
17-
CMD ["--v2-config-only", "-c", "/etc/envoy/envoy.yaml"]
17+
CMD ["-c", "/etc/envoy/envoy.yaml"]

‎cloudbuild.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ steps:
66
path: '/build'
77
env:
88
- 'COMMIT_SHA=$COMMIT_SHA'
9-
timeout: 1800s
109

1110
- name: 'gcr.io/cloud-builders/docker'
1211
entrypoint: 'bash'

‎e2e/extensions/filters/http/aws_lambda/BUILD‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,5 +18,6 @@ sh_test(
1818
"//e2e/extensions/filters/http/aws_lambda:create_config.sh",
1919
"//e2e/extensions/filters/http/aws_lambda:create_config_env.sh",
2020
"//e2e/extensions/filters/http/aws_lambda:create_config_env_token.sh",
21+
"//e2e/extensions/filters/http/aws_lambda:create_config_web_token.sh",
2122
],
2223
)

‎e2e/extensions/filters/http/aws_lambda/create_config_env.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ admin:
1717
address:
1818
socket_address:
1919
address: 127.0.0.1
20-
port_value: 19001
20+
port_value: 19000
2121
static_resources:
2222
listeners:
2323
- name: listener_0

‎e2e/extensions/filters/http/aws_lambda/create_config_env_token.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ admin:
1717
address:
1818
socket_address:
1919
address: 127.0.0.1
20-
port_value: 19001
20+
port_value: 19000
2121
static_resources:
2222
listeners:
2323
- name: listener_0

‎e2e/extensions/filters/http/aws_lambda/create_config_web_token.sh‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
#!/bin/bash
2+
#
3+
4+
set -e
5+
6+
# # create function if doesnt exist
7+
# aws lambda create-function --function-name captialize --runtime nodejs
8+
# invoke
9+
# aws lambda invoke --function-name uppercase --payload '"abc"' /dev/stdout
10+
11+
12+
# prepare envoy config file.
13+
14+
cat > envoy_env.yaml << EOF
15+
admin:
16+
access_log_path: /dev/stdout
17+
address:
18+
socket_address:
19+
address: 127.0.0.1
20+
port_value: 19000
21+
static_resources:
22+
listeners:
23+
- name: listener_0
24+
address:
25+
socket_address: { address: 127.0.0.1, port_value: 10001 }
26+
filter_chains:
27+
- filters:
28+
- name: envoy.http_connection_manager
29+
config:
30+
stat_prefix: http
31+
codec_type: AUTO
32+
route_config:
33+
name: local_route
34+
virtual_hosts:
35+
- name: local_service
36+
domains: ["*"]
37+
routes:
38+
- match:
39+
prefix: /echo
40+
route:
41+
cluster: postman-echo
42+
prefix_rewrite: /post
43+
- match:
44+
prefix: /lambda
45+
route:
46+
cluster: aws-us-east-1-lambda
47+
per_filter_config:
48+
io.solo.aws_lambda:
49+
name: uppercase
50+
qualifier: "1"
51+
- match:
52+
prefix: /latestlambda
53+
route:
54+
cluster: aws-us-east-1-lambda
55+
per_filter_config:
56+
io.solo.aws_lambda:
57+
name: uppercase
58+
qualifier: "%24LATEST"
59+
- match:
60+
prefix: /contact-empty-default
61+
route:
62+
cluster: aws-us-east-1-lambda
63+
per_filter_config:
64+
io.solo.aws_lambda:
65+
name: uppercase
66+
qualifier: "1"
67+
empty_body_override: "\"default-body\""
68+
- match:
69+
prefix: /contact
70+
route:
71+
cluster: aws-us-east-1-lambda
72+
per_filter_config:
73+
io.solo.aws_lambda:
74+
name: contact-form
75+
qualifier: "3"
76+
http_filters:
77+
- name: io.solo.aws_lambda
78+
config:
79+
service_account_credentials:
80+
cluster: aws-sts
81+
uri: sts.amazonaws.com
82+
- name: envoy.router
83+
clusters:
84+
- connect_timeout: 5.000s
85+
hosts:
86+
- socket_address:
87+
address: postman-echo.com
88+
port_value: 443
89+
name: postman-echo
90+
type: LOGICAL_DNS
91+
tls_context: {}
92+
- connect_timeout: 5.000s
93+
hosts:
94+
- socket_address:
95+
address: sts.amazonaws.com
96+
port_value: 443
97+
name: aws-sts
98+
type: LOGICAL_DNS
99+
tls_context:
100+
sni: sts.amazonaws.com
101+
- connect_timeout: 5.000s
102+
hosts:
103+
- socket_address:
104+
address: lambda.us-east-1.amazonaws.com
105+
port_value: 443
106+
name: aws-us-east-1-lambda
107+
type: LOGICAL_DNS
108+
dns_lookup_family: V4_ONLY
109+
tls_context: {}
110+
extension_protocol_options:
111+
io.solo.aws_lambda:
112+
host: lambda.us-east-1.amazonaws.com
113+
region: us-east-1
114+
EOF
115+
116+
TEMP_FILE=$(mktemp)
117+
118+
echo $AWS_WEB_TOKEN > $TEMP_FILE
119+
120+
121+
export AWS_WEB_IDENTITY_TOKEN_FILE=$TEMP_FILE
122+
export AWS_ROLE_ARN=$AWS_ROLE_ARN

‎e2e/extensions/filters/http/aws_lambda/e2e2e_test.sh‎

Lines changed: 29 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,10 @@ set -e
1212

1313
ENVOY=${ENVOY:-envoy}
1414

15-
$ENVOY --disable-hot-restart -c ./envoy.yaml --log-level debug &
15+
echo $ENVOY
16+
pwd
17+
18+
$ENVOY --concurrency 2 --disable-hot-restart -c ./envoy.yaml --log-level trace &
1619
sleep 5
1720

1821

@@ -38,11 +41,13 @@ echo testing with env credentials
3841
echo
3942

4043
. ./e2e/extensions/filters/http/aws_lambda/create_config_env.sh
41-
$ENVOY --disable-hot-restart -c ./envoy_env.yaml --log-level debug &
44+
$ENVOY --concurrency 2 --disable-hot-restart -c ./envoy_env.yaml --log-level trace &
4245
sleep 5
4346

4447
curl localhost:10001/lambda --data '"abc"' --request POST -H"content-type: application/json"|grep ABC
4548

49+
curl localhost:19000/quitquitquit -XPOST
50+
4651

4752
####################### part 3 with env + token
4853

@@ -52,9 +57,30 @@ echo testing with env credentials + token
5257
echo
5358

5459
. ./e2e/extensions/filters/http/aws_lambda/create_config_env_token.sh
55-
$ENVOY --disable-hot-restart -c ./envoy_env.yaml --log-level debug &
60+
$ENVOY --concurrency 2 --disable-hot-restart -c ./envoy_env.yaml --log-level trace &
5661
sleep 5
5762

5863
curl localhost:10001/lambda --data '"abc"' --request POST -H"content-type: application/json"|grep ABC
5964

65+
curl localhost:19000/quitquitquit -XPOST
66+
67+
echo PASS
68+
69+
70+
####################### part 4 with STS
71+
72+
# Sanity with web token:
73+
echo
74+
echo testing with STS credentials
75+
echo
76+
77+
. ./e2e/extensions/filters/http/aws_lambda/create_config_web_token.sh
78+
$ENVOY --concurrency 2 --disable-hot-restart -c ./envoy_env.yaml --log-level trace &
79+
sleep 10
80+
81+
curl localhost:10001/lambda --data '"abc"' --request POST -H"content-type: application/json"|grep ABC
82+
83+
curl localhost:19000/quitquitquit -XPOST
84+
6085
echo PASS
86+

0 commit comments

Comments
 (0)