Fix AWS IRSA #21930
Closed
Fix AWS IRSA #21930
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bdwyertech
requested review from
a team,
modrake and
randyhdev
and removed request for
a team
|
@bdwyertech Hello, thanks for the contribution. I think a better resolution might be to revert the behavior of go-secure-stdlib's GenerateCredentialChain as per my PR. That way we shouldn't have to make any changes anywhere else. |
|
@bdwyertech You should be able to build a Vault image to test my changes to go-secure-stdlib by running |
|
Closing in favor of #21951 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Resolves: #21465 #21478
Related: hashicorp/go-secure-stdlib#80
The issue is because of how awsutil is used to derive credentials. The NewCredentialsConfig constructor method needs to be called instead of starting with an empty struct. The logic to determine which method to use to derive credentials has been moved from GenerateCredentialChain to NewCredentialsConfig. hashicorp/go-secure-stdlib@1a4b955
The go-kms-wrapping library needs to be updated also to fix the KMS auto unseal.
AWS - Use NewCredentialsConfig go-kms-wrapping#178
Vault itself needs to be updated to call NewCredentialsConfig instead of sucking in an empty struct.
I have a test image up at
ghcr.io/bdwyertech/vault:dev-ui-560d81d