Still authenticated after removing creds_helpers from Finch VM configuration
#480
Assignees
Labels
bug
Something isn't working
Comments
ginglis13
changed the title
creds_helpers from finch VM configurationcreds_helpers from Finch VM configuration
|
I have also recently stumbled across this too. I was slightly confused if the user should be configuring the The 2 scenarios I hit:
|
|
Hi, Team |
haytok
added a commit
to haytok/finch
that referenced
this issue
Jun 5, 2024
Suppose we have configured the `creds_helpers` in `~/.finch/finch.yaml` as
follows, and subsequently initialized a VM (`finch vm init`).
```
cpus: 6
creds_helpers:
- ecr-login
memory: 8GiB
vmType: vz
rosetta: true
```
As a result, `~/.finch/config.json` is created, and it contains the
following:
```
{"credsStore":"ecr-login"}
```
This allows us to utilize the Amazon ECR Docker Credential Helper within Finch.
Subsequently, suppose we stop and remove the VM
(`finch vm stop` && `finch vm remove`), and then remove the
`creds_helpers` configuration from `finch.yaml`.
We then configure the `finch.yaml` file as follows:
```
cpus: 6
memory: 8GiB
vmType: vz
rosetta: true
```
As a result, when we reinitialize the VM (`finch vm init`), the expected
behavior is that it will no longer use the Amazon ECR Docker Credential Helper.
However, when initializing the VM, despite the absence of `creds_helpers`
configuration in `finch.yaml`, the `"credsStore": "ecr-login"` remains in
`config.json`, allowing the continued use of the Amazon ECR Docker
Credential Helper.
This behavior has been reported in the following issue:
- runfinch#480
Furthermore, this issue occurs when we stop the VM (`finch vm stop`),
modify `finch.yaml`, and subsequently start the VM (`finch vm start`).
Consequently, we will modify the behavior to update `config.json` in
accordance with the `creds_helpers` configuration in `finch.yaml` when
initiating or starting the VM.
Signed-off-by: Hayato Kiwata <haytok@amazon.co.jp>
1 task
haytok
added a commit
to haytok/finch
that referenced
this issue
Jun 8, 2024
Suppose we have configured the `creds_helpers` in `~/.finch/finch.yaml` as
follows, and subsequently initialized a VM (`finch vm init`).
```
cpus: 6
creds_helpers:
- ecr-login
memory: 8GiB
vmType: vz
rosetta: true
```
As a result, `~/.finch/config.json` is created, and it contains the
following:
```
{"credsStore":"ecr-login"}
```
This allows us to utilize the Amazon ECR Docker Credential Helper within Finch.
Subsequently, suppose we stop and remove the VM
(`finch vm stop` && `finch vm remove`), and then remove the
`creds_helpers` configuration from `finch.yaml`.
We then configure the `finch.yaml` file as follows:
```
cpus: 6
memory: 8GiB
vmType: vz
rosetta: true
```
As a result, when we reinitialize the VM (`finch vm init`), the expected
behavior is that it will no longer use the Amazon ECR Docker Credential Helper.
However, when initializing the VM, despite the absence of `creds_helpers`
configuration in `finch.yaml`, the `"credsStore": "ecr-login"` remains in
`config.json`, allowing the continued use of the Amazon ECR Docker
Credential Helper.
This behavior has been reported in the following issue:
- runfinch#480
Furthermore, this issue occurs when we stop the VM (`finch vm stop`),
modify `finch.yaml`, and subsequently start the VM (`finch vm start`).
Consequently, we will modify the behavior to update `config.json` in
accordance with the `creds_helpers` configuration in `finch.yaml` when
initiating or starting the VM.
Note that in this pull request, the commits are divided as follows:
- Implement the logic to update `config.json` according to `finch.yaml`
and change the function name (loadFinchConfig) in the config package
- Modify to call the logic to update `config.json` according to
`finch.yaml` on the VM side
- Add unit tests for the credhelper package and modify unit tests for the
config package
- Modify and add Behavior-Driven Development (BDD) Tests using Ginkgo on
the VM side
- Add e2e tests
On the other hand, in this commit, the logic to update `config.json`
according to `finch.yaml` is implemented and the function name
(loadFinchConfig) is changed in the config package.
Signed-off-by: Hayato Kiwata <haytok@amazon.co.jp>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Follow up from #462 #462 (comment), non-blocking for releasing the ECR credential helper integration with Finch.
Describe the bug
Unexpected behavior in successfully pulling an image from a private ECR repo after removing
ecr-logincredential helper from Finch configuration.I no longer have Finch configured with a credsStore in
~/.finch/finch.yaml, but I am still able to auth, push and pull with Finch. This is because~/.finch/config.jsonstill contains the"credsStore":"ecr-login"entry between inits/removals of VMs. Finch should set/remove this entry automatically by cross referencing~/.finch/finch.yamland~/.finch/config.jsonon VM initialization.Steps to reproduce
finch vm stop && finch vm removeecr-logincredential helper in finch.yaml:finch vm initfinch vm stop && finch vm removecreds_helpers,ecr-loginfrom finch.yamlfinch vm initExpected behavior
finch vm initcross referencesfinch.yamlwith the credential config in~/.finch/config.jsonScreenshots or logs
n/a
Additional context
n/a
The text was updated successfully, but these errors were encountered: