Skip to content

Commit 88f5066

Browse files
qswinsondprotaso
authored and
maschmid
committed
feat: Supporting using pod default credentials for Integration Source and Sink (knative#8731)
* Supporting using pod default credentials for Integration Source and Sink * use different environment variables * increase timeout in TLS test to allow cert manager to clean itself up --------- Co-authored-by: Dave Protasowski <dprotaso@gmail.com>
1 parent 18756e6 commit 88f5066

10 files changed

Lines changed: 469 additions & 2 deletions

File tree

‎config/core/resources/integrationsink.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -323,6 +323,9 @@ spec:
323323
name:
324324
description: 'Secret name'
325325
type: string
326+
serviceAccountName:
327+
description: 'Optional ServiceAccount to assign to pod. This enables the pod default credentials to be used instead of the auth secret.'
328+
type: string
326329
status:
327330
description: Status represents the current state of the IntegrationSink. This data may be out of date.
328331
type: object

‎config/core/resources/integrationsource.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -322,6 +322,9 @@ spec:
322322
name:
323323
description: 'Secret name'
324324
type: string
325+
serviceAccountName:
326+
description: 'Optional ServiceAccount to assign to pod. This enables the pod default credentials to be used instead of the auth secret.'
327+
type: string
325328
status:
326329
type: object
327330
properties:

‎pkg/apis/common/integration/v1alpha1/auth.go‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,13 @@ type Auth struct {
2525

2626
// SecretKey is the AWS secret access key.
2727
SecretKey string `json:"secretKey,omitempty"`
28+
29+
ServiceAccountName string `json:"serviceAccountName,omitempty"`
2830
}
2931

3032
func (a *Auth) HasAuth() bool {
31-
return a != nil && a.Secret != nil &&
32-
a.Secret.Ref != nil && a.Secret.Ref.Name != ""
33+
return a != nil && ((a.Secret != nil &&
34+
a.Secret.Ref != nil && a.Secret.Ref.Name != "") || a.ServiceAccountName != "")
3335
}
3436

3537
type Secret struct {

‎pkg/apis/sinks/v1alpha1/integration_sink_validation_test.go‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,23 @@ func TestIntegrationSinkSpecValidation(t *testing.T) {
6363
},
6464
want: nil,
6565
},
66+
{
67+
name: "valid AWS S3 sink with service account and region",
68+
spec: IntegrationSinkSpec{
69+
Aws: &Aws{
70+
S3: &v1alpha1.AWSS3{
71+
AWSCommon: v1alpha1.AWSCommon{
72+
Region: "us-east-1",
73+
},
74+
Arn: "example-bucket",
75+
},
76+
Auth: &v1alpha1.Auth{
77+
ServiceAccountName: "aws-service-account",
78+
},
79+
},
80+
},
81+
want: nil,
82+
},
6683
{
6784
name: "valid AWS SQS sink with auth and region",
6885
spec: IntegrationSinkSpec{
@@ -84,6 +101,23 @@ func TestIntegrationSinkSpecValidation(t *testing.T) {
84101
},
85102
want: nil,
86103
},
104+
{
105+
name: "valid AWS SQS sink with service account and region",
106+
spec: IntegrationSinkSpec{
107+
Aws: &Aws{
108+
SQS: &v1alpha1.AWSSQS{
109+
AWSCommon: v1alpha1.AWSCommon{
110+
Region: "us-east-1",
111+
},
112+
Arn: "example-queue",
113+
},
114+
Auth: &v1alpha1.Auth{
115+
ServiceAccountName: "aws-service-account",
116+
},
117+
},
118+
},
119+
want: nil,
120+
},
87121
{
88122
name: "multiple sinks set (invalid)",
89123
spec: IntegrationSinkSpec{
@@ -188,6 +222,21 @@ func TestIntegrationSinkSpecValidation(t *testing.T) {
188222
},
189223
want: apis.ErrMissingField("aws.auth.secret.ref.name"),
190224
},
225+
{
226+
name: "AWS sink without auth credentials (invalid)",
227+
spec: IntegrationSinkSpec{
228+
Aws: &Aws{
229+
S3: &v1alpha1.AWSS3{
230+
AWSCommon: v1alpha1.AWSCommon{
231+
Region: "us-east-1",
232+
},
233+
Arn: "example-bucket",
234+
},
235+
Auth: &v1alpha1.Auth{},
236+
},
237+
},
238+
want: apis.ErrMissingField("aws.auth.secret.ref.name"),
239+
},
191240
{
192241
name: "AWS S3 sink without region (invalid)",
193242
spec: IntegrationSinkSpec{

‎pkg/apis/sources/v1alpha1/integration_validation_test.go‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,23 @@ func TestIntegrationSourceSpecValidation(t *testing.T) {
6464
},
6565
want: nil,
6666
},
67+
{
68+
name: "valid AWS S3 source with service account and region",
69+
spec: IntegrationSourceSpec{
70+
Aws: &Aws{
71+
S3: &v1alpha1.AWSS3{
72+
AWSCommon: v1alpha1.AWSCommon{
73+
Region: "us-east-1",
74+
},
75+
Arn: "example-bucket",
76+
},
77+
Auth: &v1alpha1.Auth{
78+
ServiceAccountName: "aws-service-account",
79+
},
80+
},
81+
},
82+
want: nil,
83+
},
6784
{
6885
name: "valid AWS SQS source with auth and region",
6986
spec: IntegrationSourceSpec{
@@ -85,6 +102,23 @@ func TestIntegrationSourceSpecValidation(t *testing.T) {
85102
},
86103
want: nil,
87104
},
105+
{
106+
name: "valid AWS SQS source with service account and region",
107+
spec: IntegrationSourceSpec{
108+
Aws: &Aws{
109+
SQS: &v1alpha1.AWSSQS{
110+
AWSCommon: v1alpha1.AWSCommon{
111+
Region: "us-east-1",
112+
},
113+
Arn: "example-queue",
114+
},
115+
Auth: &v1alpha1.Auth{
116+
ServiceAccountName: "aws-service-account",
117+
},
118+
},
119+
},
120+
want: nil,
121+
},
88122
{
89123
name: "valid AWS DDBStreams source with auth and region",
90124
spec: IntegrationSourceSpec{
@@ -106,6 +140,23 @@ func TestIntegrationSourceSpecValidation(t *testing.T) {
106140
},
107141
want: nil,
108142
},
143+
{
144+
name: "valid AWS DDBStreams source with service account and region",
145+
spec: IntegrationSourceSpec{
146+
Aws: &Aws{
147+
DDBStreams: &v1alpha1.AWSDDBStreams{
148+
AWSCommon: v1alpha1.AWSCommon{
149+
Region: "us-east-1",
150+
},
151+
Table: "example-table",
152+
},
153+
Auth: &v1alpha1.Auth{
154+
ServiceAccountName: "aws-service-account",
155+
},
156+
},
157+
},
158+
want: nil,
159+
},
109160
{
110161
name: "multiple sources set (invalid)",
111162
spec: IntegrationSourceSpec{
@@ -172,6 +223,35 @@ func TestIntegrationSourceSpecValidation(t *testing.T) {
172223
},
173224
want: apis.ErrMissingField("aws.sqs.arn"),
174225
},
226+
{
227+
name: "AWS SQS source without Auth (invalid)",
228+
spec: IntegrationSourceSpec{
229+
Aws: &Aws{
230+
SQS: &v1alpha1.AWSSQS{
231+
AWSCommon: v1alpha1.AWSCommon{
232+
Region: "us-east-1",
233+
},
234+
Arn: "example-queue",
235+
},
236+
},
237+
},
238+
want: apis.ErrMissingField("aws.auth.secret.ref.name"),
239+
},
240+
{
241+
name: "AWS SQS source without Auth credentials (invalid)",
242+
spec: IntegrationSourceSpec{
243+
Aws: &Aws{
244+
SQS: &v1alpha1.AWSSQS{
245+
AWSCommon: v1alpha1.AWSCommon{
246+
Region: "us-east-1",
247+
},
248+
Arn: "example-queue",
249+
},
250+
Auth: &v1alpha1.Auth{},
251+
},
252+
},
253+
want: apis.ErrMissingField("aws.auth.secret.ref.name"),
254+
},
175255
{
176256
name: "AWS DDBStreams source without Table (invalid)",
177257
spec: IntegrationSourceSpec{

‎pkg/reconciler/integration/sink/resources/container_image.go‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,6 +93,7 @@ func MakeDeploymentSpec(sink *v1alpha1.IntegrationSink, featureFlags feature.Fla
9393
},
9494
},
9595
},
96+
ServiceAccountName: makeServiceAccountName(sink),
9697
},
9798
},
9899
},
@@ -182,6 +183,11 @@ func makeEnv(sink *v1alpha1.IntegrationSink, featureFlags feature.Flags) []corev
182183
integration.MakeSecretEnvVar("CAMEL_KAMELET_AWS_S3_SINK_ACCESSKEY", commonv1a1.AwsAccessKey, secretName),
183184
integration.MakeSecretEnvVar("CAMEL_KAMELET_AWS_S3_SINK_SECRETKEY", commonv1a1.AwsSecretKey, secretName),
184185
}...)
186+
} else {
187+
envVars = append(envVars, corev1.EnvVar{
188+
Name: "CAMEL_KAMELET_AWS_S3_SINK_USE_DEFAULT_CREDENTIALS_PROVIDER",
189+
Value: "true",
190+
})
185191
}
186192
return envVars
187193
}
@@ -194,6 +200,11 @@ func makeEnv(sink *v1alpha1.IntegrationSink, featureFlags feature.Flags) []corev
194200
integration.MakeSecretEnvVar("CAMEL_KAMELET_AWS_SQS_SINK_ACCESSKEY", commonv1a1.AwsAccessKey, secretName),
195201
integration.MakeSecretEnvVar("CAMEL_KAMELET_AWS_SQS_SINK_SECRETKEY", commonv1a1.AwsSecretKey, secretName),
196202
}...)
203+
} else {
204+
envVars = append(envVars, corev1.EnvVar{
205+
Name: "CAMEL_KAMELET_AWS_SQS_SINK_USE_DEFAULT_CREDENTIALS_PROVIDER",
206+
Value: "true",
207+
})
197208
}
198209
return envVars
199210
}
@@ -206,6 +217,11 @@ func makeEnv(sink *v1alpha1.IntegrationSink, featureFlags feature.Flags) []corev
206217
integration.MakeSecretEnvVar("CAMEL_KAMELET_AWS_SNS_SINK_ACCESSKEY", commonv1a1.AwsAccessKey, secretName),
207218
integration.MakeSecretEnvVar("CAMEL_KAMELET_AWS_SNS_SINK_SECRETKEY", commonv1a1.AwsSecretKey, secretName),
208219
}...)
220+
} else {
221+
envVars = append(envVars, corev1.EnvVar{
222+
Name: "CAMEL_KAMELET_AWS_SNS_SINK_USE_DEFAULT_CREDENTIALS_PROVIDER",
223+
Value: "true",
224+
})
209225
}
210226
return envVars
211227
}
@@ -214,6 +230,13 @@ func makeEnv(sink *v1alpha1.IntegrationSink, featureFlags feature.Flags) []corev
214230
return envVars
215231
}
216232

233+
func makeServiceAccountName(sink *v1alpha1.IntegrationSink) string {
234+
if sink.Spec.Aws != nil && sink.Spec.Aws.Auth != nil && sink.Spec.Aws.Auth.ServiceAccountName != "" {
235+
return sink.Spec.Aws.Auth.ServiceAccountName
236+
}
237+
return ""
238+
}
239+
217240
func selectImage(sink *v1alpha1.IntegrationSink) string {
218241
// Injected in ./config/core/deployments/controller.yaml
219242
switch {

0 commit comments

Comments
 (0)