Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Missing WebIdentityTokenFileCredentialsProvider Authentication makes using IRSA on EKS for S3 authentication difficult #637

Open
scottaubrey opened this issue Nov 29, 2023 · 0 comments

Comments

@scottaubrey
Copy link

We're using cantaloupe on EKS within AWS environment as a frontend to an S3 Bucket.

For best practice and security, we'd like to use the authentication mechanism built into EKS to allow IAM permissions to be granted to workloads rather than the cluster, or having to embed credentials in a secret. That mechanism is supported by the AWS SDK by default, but is not included in the overridden authentication provider chain in cantaloupe.

We have been running with a patched version of cantaloupe in production for over a year and it works well, but I'm no Java developer and I couldn't get it to build as a multiplatform image using the build scripts linked in that repo, useful as a number of our team use Apple Silicon macs.

I will create a pull request with this patch, in the hopes that it does actually satisfy and work for the build process to create a multi-platform image and we can drop our patched build.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant