baalajimaestro/traefik
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

Fix ECS config for OIDC + IRSA

Browse source
This commit is contained in:
Michael 2024-07-01 16:50:04 +02:00 committed by GitHub
parent 8946dd1898
commit f3479f532b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 20 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

33
pkg/provider/ecs/ecs.go
View file

@ -3,18 +3,21 @@ package ecs
import ( import (
"context" "context"
"fmt" "fmt"
"os"
"strings" "strings"
"text/template" "text/template"
"time" "time"
"github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws"
"github.com/aws/aws-sdk-go/aws/credentials" "github.com/aws/aws-sdk-go/aws/credentials"
"github.com/aws/aws-sdk-go/aws/credentials/stscreds"
"github.com/aws/aws-sdk-go/aws/defaults" "github.com/aws/aws-sdk-go/aws/defaults"
"github.com/aws/aws-sdk-go/aws/ec2metadata" "github.com/aws/aws-sdk-go/aws/ec2metadata"
"github.com/aws/aws-sdk-go/aws/session" "github.com/aws/aws-sdk-go/aws/session"
"github.com/aws/aws-sdk-go/service/ec2" "github.com/aws/aws-sdk-go/service/ec2"
"github.com/aws/aws-sdk-go/service/ecs" "github.com/aws/aws-sdk-go/service/ecs"
"github.com/aws/aws-sdk-go/service/ssm" "github.com/aws/aws-sdk-go/service/ssm"
"github.com/aws/aws-sdk-go/service/sts"
"github.com/cenkalti/backoff/v4" "github.com/cenkalti/backoff/v4"
"github.com/patrickmn/go-cache" "github.com/patrickmn/go-cache"
"github.com/traefik/traefik/v2/pkg/config/dynamic" "github.com/traefik/traefik/v2/pkg/config/dynamic"
@ -115,20 +118,24 @@ func (p *Provider) createClient(logger log.Logger) (*awsClient, error) {
p.Region = identity.Region p.Region = identity.Region
} }
cfg := &aws.Config{ cfg := aws.NewConfig().
Credentials: credentials.NewChainCredentials( WithCredentials(credentials.NewChainCredentials([]credentials.Provider{
[]credentials.Provider{ &credentials.StaticProvider{
&credentials.StaticProvider{ Value: credentials.Value{
Value: credentials.Value{ AccessKeyID: p.AccessKeyID,
AccessKeyID: p.AccessKeyID, SecretAccessKey: p.SecretAccessKey,
SecretAccessKey: p.SecretAccessKey,
},
}, },
&credentials.EnvProvider{}, },
&credentials.SharedCredentialsProvider{}, &credentials.EnvProvider{},
defaults.RemoteCredProvider(*(defaults.Config()), defaults.Handlers()), &credentials.SharedCredentialsProvider{},
}), defaults.RemoteCredProvider(*(defaults.Config()), defaults.Handlers()),
} stscreds.NewWebIdentityRoleProviderWithOptions(
sts.New(sess),
os.Getenv("AWS_ROLE_ARN"),
"",
stscreds.FetchTokenPath(os.Getenv("AWS_WEB_IDENTITY_TOKEN_FILE")),
),
}))
// Set the region if it is defined by the user or resolved from the EC2 metadata. // Set the region if it is defined by the user or resolved from the EC2 metadata.
if p.Region != "" { if p.Region != "" {