allow session token in static config

grafana · Feb 9, 2023 · 9aa51c3 · 9aa51c3
1 parent f900056
commit 9aa51c3
Show file tree

Hide file tree

Showing 6 changed files with 9 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,6 +1,7 @@
 ## main / unreleased
 
 * [FEATURE] Add flag to optionally enable all available Go runtime metrics [#2005](https://github.com/grafana/tempo/pull/2005) (@andreasgerstmayr)
+* [CHANGE] Add support for s3 session token in static config [#2093](https://github.com/grafana/tempo/pull/2093) (@farodin91)
 * [BUGFIX] Suppress logspam in single binary mode when metrics generator is disabled. [#2058](https://github.com/grafana/tempo/pull/2058) (@joe-elliott)
 * [BUGFIX] Error more gracefully while reading some blocks written by an interim commit between 1.5 and 2.0 [#2055](https://github.com/grafana/tempo/pull/2055) (@mdisibio)
 * [BUGFIX] Apply `rate()` to bytes/s panel in tenant's dashboard. [#](https://github.com/grafana/tempo/pull/) (@mapno)

diff --git a/docs/sources/configuration/_index.md b/docs/sources/configuration/_index.md
@@ -643,6 +643,10 @@ storage:
             # secret key when using static credentials.
             [secret_key: <string>]
 
+            # optional.
+            # session token when using static credentials.
+            [session_token: <string>]
+
             # optional.
             # enable if endpoint is http
             [insecure: <bool>]

diff --git a/docs/sources/configuration/manifest.md b/docs/sources/configuration/manifest.md
@@ -492,6 +492,7 @@ storage:
       region: ""
       access_key: ""
       secret_key: ""
+      session_token: ""
       insecure: false
       insecure_skip_verify: false
       part_size: 0

diff --git a/modules/storage/config.go b/modules/storage/config.go
@@ -78,6 +78,7 @@ func (cfg *Config) RegisterFlagsAndApplyDefaults(prefix string, f *flag.FlagSet)
 	f.StringVar(&cfg.Trace.S3.Endpoint, util.PrefixConfig(prefix, "trace.s3.endpoint"), "", "s3 endpoint to push blocks to.")
 	f.StringVar(&cfg.Trace.S3.AccessKey, util.PrefixConfig(prefix, "trace.s3.access_key"), "", "s3 access key.")
 	f.Var(&cfg.Trace.S3.SecretKey, util.PrefixConfig(prefix, "trace.s3.secret_key"), "s3 secret key.")
+	f.Var(&cfg.Trace.S3.SessionToken, util.PrefixConfig(prefix, "trace.s3.session_token"), "s3 session token.")
 	cfg.Trace.S3.HedgeRequestsUpTo = 2
 
 	cfg.Trace.GCS = &gcs.Config{}

diff --git a/tempodb/backend/s3/config.go b/tempodb/backend/s3/config.go
@@ -12,6 +12,7 @@ type Config struct {
 	Region             string         `yaml:"region"`
 	AccessKey          string         `yaml:"access_key"`
 	SecretKey          flagext.Secret `yaml:"secret_key"`
+	SessionToken       flagext.Secret `yaml:"session_token"`
 	Insecure           bool           `yaml:"insecure"`
 	InsecureSkipVerify bool           `yaml:"insecure_skip_verify"`
 	PartSize           uint64         `yaml:"part_size"`

diff --git a/tempodb/backend/s3/s3.go b/tempodb/backend/s3/s3.go
@@ -343,6 +343,7 @@ func createCore(cfg *Config, hedge bool) (*minio.Core, error) {
 			Value: credentials.Value{
 				AccessKeyID:     cfg.AccessKey,
 				SecretAccessKey: cfg.SecretKey.String(),
+				SessionToken:    cfg.SessionToken.String(),
 			},
 		}),
 		wrapCredentialsProvider(&credentials.EnvMinio{}),