Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Move CredentialProvider into its own package #363

Merged
merged 9 commits into from
Feb 3, 2025
Merged

Move CredentialProvider into its own package #363

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
8d7c40e
Add `Merge` method to `Environment`
unexge Jan 30, 2025
314f370
Move `CredentialProvider` into its own package
unexge Jan 30, 2025
3366f93
Move IMDS call to pre-warm the cache into `driver.go`
unexge Feb 3, 2025
289caec
Make GoDocs more clear
unexge Feb 3, 2025
038d88c
Move `env := envprovider.Default()` into the first place its modified
unexge Feb 3, 2025
da36e6d
Fix the typo in `credentials`
unexge Feb 3, 2025
482d130
Fix typo
unexge Feb 3, 2025
57a0817
Add `SetWriteAndEnvPath` method to `ProvideContext`
unexge Feb 3, 2025
ccbabcc
Move calling `envprovider.Default()` further down
unexge Feb 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 11 additions & 34 deletions pkg/driver/driver.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,12 +21,11 @@ import (
"fmt"
"net"
"os"
"time"

"github.com/awslabs/aws-s3-csi-driver/pkg/driver/node"
"github.com/awslabs/aws-s3-csi-driver/pkg/driver/node/credentialprovider"
"github.com/awslabs/aws-s3-csi-driver/pkg/driver/node/mounter"
"github.com/awslabs/aws-s3-csi-driver/pkg/driver/version"
"github.com/awslabs/aws-s3-csi-driver/pkg/util"
"github.com/container-storage-interface/spec/lib/go/csi"
"google.golang.org/grpc"
"k8s.io/client-go/kubernetes"
Expand All @@ -35,15 +34,11 @@ import (
)

const (
driverName = "s3.csi.aws.com"
webIdentityTokenEnv = "AWS_WEB_IDENTITY_TOKEN_FILE"
driverName = "s3.csi.aws.com"

grpcServerMaxReceiveMessageSize = 1024 * 1024 * 2 // 2MB

unixSocketPerm = os.FileMode(0700) // only owner can write and read.

// This is the plugin directory for CSI driver mounted in the container.
containerPluginDir = "/csi"
)

type Driver struct {
Expand Down Expand Up @@ -74,13 +69,19 @@ func NewDriver(endpoint string, mpVersion string, nodeID string) (*Driver, error
klog.Infof("Driver version: %v, Git commit: %v, build date: %v, nodeID: %v, mount-s3 version: %v, kubernetes version: %v",
version.DriverVersion, version.GitCommit, version.BuildDate, nodeID, mpVersion, kubernetesVersion)

systemd_mounter, err := mounter.NewSystemdMounter(mpVersion, kubernetesVersion)
// `credentialprovider.RegionFromIMDSOnce` is a `sync.OnceValues` and it only makes request to IMDS once,
// this call is basically here to pre-warm the cache of IMDS call.
go func() {
_, _ = credentialprovider.RegionFromIMDSOnce()
}()

credProvider := credentialprovider.New(clientset.CoreV1(), credentialprovider.RegionFromIMDSOnce)
systemdMounter, err := mounter.NewSystemdMounter(credProvider, mpVersion, kubernetesVersion)
if err != nil {
klog.Fatalln(err)
}

credentialProvider := mounter.NewCredentialProvider(clientset.CoreV1(), containerPluginDir, mounter.RegionFromIMDSOnce)
nodeServer := node.NewS3NodeServer(nodeID, systemd_mounter, credentialProvider)
nodeServer := node.NewS3NodeServer(nodeID, systemdMounter)

return &Driver{
Endpoint: endpoint,
Expand All @@ -90,14 +91,6 @@ func NewDriver(endpoint string, mpVersion string, nodeID string) (*Driver, error
}

func (d *Driver) Run() error {
ctx, cancel := context.WithCancel(context.Background())
defer cancel()
tokenFile := os.Getenv(webIdentityTokenEnv)
if tokenFile != "" {
klog.Infof("Found AWS_WEB_IDENTITY_TOKEN_FILE, syncing token")
go tokenFileTender(ctx, tokenFile, "/csi/token")
}
Comment on lines -93 to -99
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This logic has been moved to provideStsWebIdentityCredentialsFromDriver function in pkg/driver/node/credentialprovider/provider_driver.go. Since we enabled requiresRepublish as part of Pod-level identity support, Kubernetes will call NodePublishVolume periodically to update existing service account tokens before they expire, and the credential provider will be called as part of this method. Another reason for this change is that, this assumes a single location for service account tokens for Driver-level identity, but with containerization this won't be the case. See the note regarding credential provider in the original PR description for more context.


scheme, addr, err := ParseEndpoint(d.Endpoint)
if err != nil {
return err
Expand Down Expand Up @@ -150,22 +143,6 @@ func (d *Driver) Stop() {
d.Srv.Stop()
}

func tokenFileTender(ctx context.Context, sourcePath string, destPath string) {
for {
timer := time.After(10 * time.Second)
err := util.ReplaceFile(destPath, sourcePath, 0600)
if err != nil {
klog.Infof("Failed to sync AWS web token file: %v", err)
}
select {
case <-timer:
continue
case <-ctx.Done():
return
}
}
}

func kubernetesVersion(clientset *kubernetes.Clientset) (string, error) {
version, err := clientset.ServerVersion()
if err != nil {
Expand Down
120 changes: 0 additions & 120 deletions pkg/driver/node/awsprofile/aws_profile.go
View file
Open in desktop

This file was deleted.

112 changes: 0 additions & 112 deletions pkg/driver/node/awsprofile/aws_profile_test.go
View file
Open in desktop

This file was deleted.

Loading
Loading