[RFC-0010] Add multi-tenant workload identity support for AWS Bucket #1868
Conversation
cappyzawa
added
area/bucket
cappyzawa
force-pushed
the
feat/bucket-workload-identity-aws
branch
3 times, most recently
from
d550312 to
3e0213c
Compare
Signed-off-by: cappyzawa <[email protected]>
cappyzawa
force-pushed
the
feat/bucket-workload-identity-aws
branch
from
3e0213c to
3300705
Compare
| @@ -273,6 +273,55 @@ data: | |||
| secretkey: <BASE64> | |||
| ``` | |||
|
|
|||
| ##### AWS Controller-Level Workload Identity example | |||
There was a problem hiding this comment.
Let's mention specifically https://fluxcd.io/flux/integrations/aws/#for-amazon-simple-storage-service as well like we did for GCP
There was a problem hiding this comment.
I think we should add the link eventually. However, the current documentation at that URL (specifically the "At the object level" section) states that S3 integration with the Bucket API "does not support configuring authentication through OIDC Federation at the object level" and will be introduced in Flux v2.7.
Since this PR is implementing that functionality, I'll include the link in this PR and update the website documentation afterward to reflect the new capabilities. This way users will have the reference ready once the website is updated.
There was a problem hiding this comment.
I'll include the link in this PR and update the website documentation afterward
Cool, thanks! We have an item for tracking this in the umbrella issue:
This PR should update all three cloud providers 🙏
There was a problem hiding this comment.
I’ve made the same update for Azure as well: 3a14ce4
cappyzawa
force-pushed
the
feat/bucket-workload-identity-aws
branch
4 times, most recently
from
9fe7486 to
ef755b2
Compare
|
Let's not delete this much documentation on this PR, in the past we considered deleting all Workload Identity related documentation and just linking to the full guide and decided not to do that in that moment, we need more time to think how we will do this. Can you please reset to this commit? 3300705 This one was looking pretty good, I'd like to reboot the review starting from that one |
cappyzawa
force-pushed
the
feat/bucket-workload-identity-aws
branch
from
3a14ce4 to
29b4242
Compare
…Bucket Remove os.Setenv() to prevent env var pollution Remove os.Setenv() call that could cause environment variable pollution in multi-tenant environments. The pkg/auth/aws package already handles region configuration properly by prioritizing opts.STSRegion over AWS_REGION environment variable. Signed-off-by: cappyzawa <[email protected]>
cappyzawa
force-pushed
the
feat/bucket-workload-identity-aws
branch
from
29b4242 to
6dd483d
Compare
Part of: fluxcd/flux2#5022