This commit fixes a problem where the plugin/AWS SDK would not recognise
static AWS credentials set in the machine's environment variables (by
setting AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY)
The default `WithSharedCredentials` value is `true` in awsutil (v2) -
This essentially disables the ability to read credentials from the
environment because we set the `default` AWS profile options, making the
SDK go search for a profile that may not exist and ignoring the
environment in the way, so we need to set it to `false` (see
`awsutil@v2.(*CredentialsConfig).generateAwsConfigOptions`) for extra
details.
* fix(storage): Storage Assume Role Support
This commit introduces fixes to enable operators to use AWS dynamic
credentials on the storage side of this plugin, namely validation,
improved credential lifecycle management to allow for storage buckets to
be updated from static to dynamic credentials and vice versa, and a new
way to determine credential types.
It also introduces new tests for dynamic credential usage for the
various functions.
* fix(storage): Static rotated creds being deleted on plugin err
On Storage Bucket update, when we determine if the credentials are to be
updated to new ones, we call `credState.ReplaceCreds`.
This call, if the old credentials were managed by us (rotated at create
time), will delete the old credentials and set the new ones onto
credState.
We called this function without validating if the incoming credentials
are valid. This could get the bucket in a state where where, while we'd
return an update error if the incoming credentials weren't working with
S3 (err in the dry run process that happens at the end of the update),
we'd also silently delete the old credentials the bucket used, rendering
the bucket completely broken.
---------
Co-authored-by: Hugo <hugoamvieira@users.noreply.github.com>
* feat: assume role provider credentials
This commit updates the awsutil dependency to its latest version, which
supports the capability of using dynamic credentials. The storage service
was refactored to make static credentials optional. The credentials pkg
was refactored to support several attribute fields used for the assume
role provider. The host service still enforces the use of static
credentials.
This updates the README to have full examples for both host set and host
catalog creation, and also corrects an incorrect example in the JSON
example (tag-name was supposed to be tag-key).
Additionally, I've removed the JSON example as it's no longer needed as
the CLI corrects accepts filter names with dashes with the work
performed in #2 and #4.
This adds DNS names to the output for host queries.
Hosts are discovered in private, then public order, first at the
top-level, and then through attached network interfaces. This mirrors
the discovery order of IP addresses.
This adds checks for unknown attributes through the entire plugin
lifecycle for all attributes, secrets, and persisted state.
It also fixes the E2E test which seems to have drifted.
...when no new credentials are supplied. This was initially not covered
when the E2E tests were written but was added later once we the mocks
necessary to do unit testing to get error coverage.
Ideally we'd ensure that an incoming filter is a string, but some
clients, such as the CLI, don't have a good way to require this without
it being very onerous to the user.
Eventually we can handle this via allowing the plugin to declare a
schema and perform type validation in the handler, but for now, work
around this within the plugin.
dependabot[bot]
Hugo
Damian DebkowskiandHugo
Michael Li
hashicorp-copywrite[bot]
Louis Ruch
Stan Ryzhov
Jeff Mitchell
Johan Brandhorst-Satzkorn
CalebAlbers
Haotian
Todd
Chris Marchesi
Todd Knight