Skip to content

CORS-4055: migrate credential provider check to AWS SDK v2 #10261

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
tthvo wants to merge 1 commit into
base: main
Choose a base branch
from
Open

CORS-4055: migrate credential provider check to AWS SDK v2 #10261

tthvo wants to merge 1 commit into from
+30 −23

Conversation

@tthvo
Copy link
Member

@tthvo tthvo commented Jan 27, 2026

This PR is an incremental step to migrate AWS API calls to AWS SDK v2. This focuses on handlers that retrieve the source or provider of credentials, for example, via shared credential file and via environment variables.

Note: these logics are to determine whether the credential provider is static, which is safe to transfer to the cluster as-is in Mint and Passthrough credentialsMode.

@tthvo
CORS-4055: migrate credential provider check to AWS SDK v2
d67b14e 
This commit is an incremental step to migrate AWS API calls
to AWS SDK v2. This focuses on handlers that retrieve the source
or provider of credentials, for example, via shared credential file
and via environment variables.

Note: these logics are to determine whether the credential provider
is static, which is safe to transfer to the cluster as-is in Mint and
Passthrough credentialsMode.
@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jan 27, 2026
@openshift-ci-robot
Copy link
Contributor

openshift-ci-robot commented Jan 27, 2026 •
edited by openshift-ci bot
Loading

@tthvo: This pull request references CORS-4055 which is a valid jira issue.

Details

In response to this:

This PR is an incremental step to migrate AWS API calls to AWS SDK v2. This focuses on handlers that retrieve the source or provider of credentials, for example, via shared credential file and via environment variables.

Note: these logics are to determine whether the credential provider is static, which is safe to transfer to the cluster as-is in Mint and Passthrough credentialsMode.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jan 27, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign andfasano for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci bot requested review from jhixson74 and mtulio January 27, 2026 20:13
@tthvo
Copy link
Member Author

tthvo commented Jan 27, 2026

/label platform/aws
/cc @patrickdillon @barbacbd @yunjiang29

@tthvo
Copy link
Member Author

tthvo commented Jan 27, 2026

For local testing, I set credentialsMode: Passthrough in the install-config.yaml and run with various scenarios. The behaviour seems consistent with AWS SDK v1.

Credentials Setup Provider (reported from SDK) Result
Using a profile with long-term credentials: export AWS_PROFILE=<profile> INFO Credentials loaded from the AWS config using "SharedConfigCredentials: /path" provider No error
Using a profile with SSO credentials (STS): export AWS_PROFILE=<saml-profile> INFO Credentials loaded from the AWS config using "SharedConfigCredentials: /path" provider FATAL failed to fetch Openshift Manifests: failed to generate asset "Openshift Manifests": AWS credentials provided by SharedConfigCredentials: /home/thvo/.aws/credentials are not valid for Passthrough credentials mode
Exporting long-term credentials as env vars: eval "$(aws configure export-credentials --profile <profile> --format=env)" INFO Credentials loaded from the AWS config using "EnvConfigCredentials" provider No error
Exporting SSO credentials (STS) as env var: eval "$(aws configure export-credentials --profile <saml-profile> --format=env)" INFO Credentials loaded from the AWS config using "EnvConfigCredentials" provider FATAL failed to fetch Openshift Manifests: failed to generate asset "Openshift Manifests": AWS credentials provided by EnvConfigCredentials are not valid for Passthrough credentials mode
Running in an EC2 instance with an instance profile INFO Credentials loaded from the AWS config using "EC2RoleProvider" provider FATAL failed to fetch Openshift Manifests: failed to generate asset "Openshift Manifests": AWS credentials provided by EC2RoleProvider are not valid for Passthrough credentials mode

@tthvo
Copy link
Member Author

tthvo commented Jan 28, 2026

/test artifacts-images

1 similar comment
@tthvo
Copy link
Member Author

tthvo commented Jan 28, 2026

/test artifacts-images

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jan 28, 2026

@tthvo: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/e2e-aws-ovn-heterogeneous d67b14e link false /test e2e-aws-ovn-heterogeneous
ci/prow/e2e-aws-ovn-edge-zones d67b14e link false /test e2e-aws-ovn-edge-zones

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jhixson74 jhixson74 Awaiting requested review from jhixson74

@mtulio mtulio Awaiting requested review from mtulio

@barbacbd barbacbd Awaiting requested review from barbacbd

@patrickdillon patrickdillon Awaiting requested review from patrickdillon

@yunjiang29 yunjiang29 Awaiting requested review from yunjiang29

Assignees

No one assigned

Labels

jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. platform/aws

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@tthvo @openshift-ci-robot