CORS-4055: migrate credential provider check to AWS SDK v2

[tthvo]

This PR is an incremental step to migrate AWS API calls to AWS SDK v2. This focuses on handlers that retrieve the source or provider of credentials, for example, via shared credential file and via environment variables.

Note: these logics are to determine whether the credential provider is static, which is safe to transfer to the cluster as-is in Mint and Passthrough credentialsMode.

[openshift-ci-robot]

@tthvo: This pull request references CORS-4055 which is a valid jira issue.

Details

In response to this:

This PR is an incremental step to migrate AWS API calls to AWS SDK v2. This focuses on handlers that retrieve the source or provider of credentials, for example, via shared credential file and via environment variables.

Note: these logics are to determine whether the credential provider is static, which is safe to transfer to the cluster as-is in Mint and Passthrough credentialsMode.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign andfasano for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tthvo]

/label platform/aws
/cc @patrickdillon @barbacbd @yunjiang29

[tthvo]

For local testing, I set credentialsMode: Passthrough in the install-config.yaml and run with various scenarios. The behaviour seems consistent with AWS SDK v1.

Credentials Setup	Provider (reported from SDK)	Result
Using a profile with long-term credentials: export AWS_PROFILE=<profile>	INFO Credentials loaded from the AWS config using "SharedConfigCredentials: /path" provider	No error
Using a profile with SSO credentials (STS): export AWS_PROFILE=<saml-profile>	INFO Credentials loaded from the AWS config using "SharedConfigCredentials: /path" provider	FATAL failed to fetch Openshift Manifests: failed to generate asset "Openshift Manifests": AWS credentials provided by SharedConfigCredentials: /home/thvo/.aws/credentials are not valid for Passthrough credentials mode
Exporting long-term credentials as env vars: eval "$(aws configure export-credentials --profile <profile> --format=env)"	INFO Credentials loaded from the AWS config using "EnvConfigCredentials" provider	No error
Exporting SSO credentials (STS) as env var: eval "$(aws configure export-credentials --profile <saml-profile> --format=env)"	INFO Credentials loaded from the AWS config using "EnvConfigCredentials" provider	FATAL failed to fetch Openshift Manifests: failed to generate asset "Openshift Manifests": AWS credentials provided by EnvConfigCredentials are not valid for Passthrough credentials mode
Running in an EC2 instance with an instance profile	INFO Credentials loaded from the AWS config using "EC2RoleProvider" provider	FATAL failed to fetch Openshift Manifests: failed to generate asset "Openshift Manifests": AWS credentials provided by EC2RoleProvider are not valid for Passthrough credentials mode

[tthvo]

/test artifacts-images

[tthvo]

/test artifacts-images

[openshift-ci]

@tthvo: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn-heterogeneous	d67b14e	link	false	/test e2e-aws-ovn-heterogeneous
ci/prow/e2e-aws-ovn-edge-zones	d67b14e	link	false	/test e2e-aws-ovn-edge-zones

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.