ImagePipe.Source.S3.WebIdentity (image_pipe v0.1.0)

Copy Markdown View Source

Credential provider for EKS IAM roles for service accounts (IRSA), using STS AssumeRoleWithWebIdentity.

credentials:
  {:provider, ImagePipe.Source.S3.WebIdentity,
   token_file: System.fetch_env!("AWS_WEB_IDENTITY_TOKEN_FILE"),
   role_arn: System.fetch_env!("AWS_ROLE_ARN"),
   region: System.fetch_env!("AWS_REGION")}

It exchanges the token the cluster mounts into the pod for temporary credentials. The STS call is unsigned, since the token authenticates it. Setting up credentials is covered in Serving images from S3.

Options

  • :token_file (String.t/0) - Required. Path of the web identity token, from AWS_WEB_IDENTITY_TOKEN_FILE. The file is read again on every refresh, since the platform rotates it.

  • :role_arn (String.t/0) - Required. ARN of the role to assume, from AWS_ROLE_ARN.

  • :region (String.t/0) - Required. Region of the STS endpoint, sts.<region>.amazonaws.com.

  • :role_session_name (String.t/0) - Session name for the assumed role. The default value is "image-pipe".

  • :receive_timeout (non_neg_integer/0) - Milliseconds to wait for each response. The default value is 5000.

  • :connect_timeout (non_neg_integer/0) - Milliseconds to wait for a connection. The default value is 5000.