[tiered-storage] Allow AWS credentials to be refreshed #9387
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jiazhai
approved these changes
Feb 1, 2021
Renkai
reviewed
Feb 1, 2021
| // Important! Delay the building of actual credentials | ||
| // until later to support tokens that may be refreshed | ||
| // such as all session tokens | ||
| AWSCredentialsProvider finalAuthChain = authChain; |
There was a problem hiding this comment.
Why do we need a new variable finalAuthChain instead of reusing authChain?
Renkai
suggested changes
Feb 1, 2021
| @@ -304,33 +305,40 @@ public ProviderMetadata getProviderMetadata() { | |||
|
|
|||
| static final CredentialBuilder AWS_CREDENTIAL_BUILDER = (TieredStorageConfiguration config) -> { | |||
| if (config.getCredentials() == null) { | |||
| AWSCredentials awsCredentials = null; | |||
| AWSCredentialsProvider authChain = null; | |||
There was a problem hiding this comment.
final AWSCredentialsProvider authChain;
try {
if (Strings.isNullOrEmpty(config.getConfigProperty(S3_ROLE_FIELD))) {
authChain = DefaultAWSCredentialsProviderChain.getInstance();
} else {
authChain =
new STSAssumeRoleSessionCredentialsProvider.Builder(
config.getConfigProperty(S3_ROLE_FIELD),
config.getConfigProperty(S3_ROLE_SESSION_NAME_FIELD)
).build();
}
// Important! Delay the building of actual credentials
// until later to support tokens that may be refreshed
// such as all session tokens
config.setProviderCredentials(() -> {
AWSCredentials newCreds = authChain.getCredentials();
Maybe like this is better?
Renkai
reviewed
Feb 1, 2021
| .sessionToken(((AWSSessionCredentials) newCreds).getSessionToken()) | ||
| .build(); | ||
| } else { | ||
| jcloudCred = new Credentials( |
There was a problem hiding this comment.
Will we, or should we still go into this if branch in our new implementation?
With the refactor of support azure, a regression occured where the AWS credentials were fetched once and then used through the entire process. This is a problem in AWS, where it is commonplace to use credentials that expire. The AWS credential provider chain takes care of this problem, but when intgrating with JClouds, that means we need the credential Supplier to return a new set of credentials each time. Luckily, AWS should intelligently cache this so we aren't thrashing the underlying credential mechanisms. This also adds a test to ensure this isn't broken in the future
addisonj
force-pushed
the
s3_expired_creds
branch
from
5180dbb to
9f6303b
Compare
Renkai
approved these changes
Feb 1, 2021
|
/pulsarbot run-failure-checks |
sijie
approved these changes
Feb 1, 2021
codelipenghui
pushed a commit
that referenced
this pull request
Feb 4, 2021
With the refactor of support azure, a regression occured where the AWS credentials were fetched once and then used through the entire process. This is a problem in AWS, where it is commonplace to use credentials that expire. The AWS credential provider chain takes care of this problem, but when intgrating with JClouds, that means we need the credential Supplier to return a new set of credentials each time. Luckily, AWS should intelligently cache this so we aren't thrashing the underlying credential mechanisms. This also adds a test to ensure this isn't broken in the future, it does a simple validation to ensure that the underlying credentials can change via AWS SystemPropertyCredentialProvider (cherry picked from commit 562b2e7)
codelipenghui
pushed a commit
that referenced
this pull request
Feb 7, 2021
With the refactor of support azure, a regression occured where the AWS credentials were fetched once and then used through the entire process. This is a problem in AWS, where it is commonplace to use credentials that expire. The AWS credential provider chain takes care of this problem, but when intgrating with JClouds, that means we need the credential Supplier to return a new set of credentials each time. Luckily, AWS should intelligently cache this so we aren't thrashing the underlying credential mechanisms. This also adds a test to ensure this isn't broken in the future, it does a simple validation to ensure that the underlying credentials can change via AWS SystemPropertyCredentialProvider (cherry picked from commit 562b2e7)
codelipenghui
pushed a commit
to streamnative/pulsar-archived
that referenced
this pull request
Feb 7, 2021
With the refactor of support azure, a regression occured where the AWS credentials were fetched once and then used through the entire process. This is a problem in AWS, where it is commonplace to use credentials that expire. The AWS credential provider chain takes care of this problem, but when intgrating with JClouds, that means we need the credential Supplier to return a new set of credentials each time. Luckily, AWS should intelligently cache this so we aren't thrashing the underlying credential mechanisms. This also adds a test to ensure this isn't broken in the future, it does a simple validation to ensure that the underlying credentials can change via AWS SystemPropertyCredentialProvider (cherry picked from commit 562b2e7) (cherry picked from commit ce191fb)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation
With the refactor of support azure, a regression occured where the AWS
credentials were fetched once and then used through the entire process.
This is a problem in AWS, where it is commonplace to use credentials
that expire.
Modifications
The AWS credential provider chain takes care of this
problem, but when intgrating with JClouds, that means we need the
credential Supplier to return a new set of credentials each time.
Luckily, AWS should intelligently cache this so we aren't thrashing the
underlying credential mechanisms.
Verifying this change
This also adds a test to ensure this isn't broken in the future, it does a simple validation to ensure that the underlying credentials can change via AWS SystemPropertyCredentialProvider
Does this pull request potentially affect one of the following parts:
If
yeswas chosen, please highlight the changesDocumentation