Owen-CH-Leung opened a new issue, #66554: URL: https://github.com/apache/doris/issues/66554
### Search before asking - [x] I had searched in the [issues](https://github.com/apache/doris/issues?q=is%3Aissue) and found no similar issues. ### Version master (also 4.1.x) ### What's Wrong? Under EKS Pod Identity, the BE cannot reach s3 once its credentials expire, because it cannot refresh them. The `CustomAwsCredentialsProviderChain` only reads the credential endpoint's token from `AWS_CONTAINER_AUTHORIZATION_TOKEN`, once at construction. EKS Pod Identity supplies that token as a file stored in `AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE` and rotates it, which the chain never reads. Reference: https://docs.aws.amazon.com/eks/latest/userguide/pod-id-how-it-works.html So the BE keeps presenting the token it captured at startup. After first rotation, the agent will reject it and therefore every s3 request from BE fails. ### What You Expected? The BE reads `AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE` and re-reads it on each refresh, so BE can hit s3 across token rotations. ### How to Reproduce? 1. Run the BE in EKS with a Pod Identity association and no static credentials 2. Query a s3-backed catalog, and then wait for the token file to rotate 3. Subsequent queries will fail ### Anything Else? _No response_ ### Are you willing to submit PR? - [x] Yes I am willing to submit a PR! ### Code of Conduct - [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
