[
https://issues.apache.org/jira/browse/TIKA-5006?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18132965#comment-18132965
]
ASF GitHub Bot commented on TIKA-5006:
--------------------------------------
bartek opened a new pull request, #3439:
URL: https://github.com/apache/tika/pull/3439
On EKS, pods get AWS access through IAM roles for service accounts (IRSA).
The pod is given a web identity token, with AWS_ROLE_ARN and
AWS_WEB_IDENTITY_TOKEN_FILE set in its environment. The S3 plugin only supports
instance, profile and key_secret, so there's no way to use the pod's role.
Using instance picks up the node's role instead.
This adds an `identity` credentialsProvider to the fetcher, emitter and
pipes iterator, backed by the SDK's WebIdentityTokenFileCredentialsProvider.
Additionally:
* Added the sts module. The web identity provider needs it to exchange the
token for credentials, but doesn't look for it until the first request. Without
it, the fetcher builds fine and then fails on its first fetch.
* Moved the fetcher's provider selection into buildCredentialsProvider, like
the emitter has, so it can be tested without AWS.
> Support AWS S3 Web identity credentials
> ---------------------------------------
>
> Key: TIKA-5006
> URL: https://issues.apache.org/jira/browse/TIKA-5006
> Project: Tika
> Issue Type: Improvement
> Reporter: Bartek Ciszkowski
> Priority: Major
>
> The S3 fetcher is unable to use web identity credentials, which mounts a web
> identity token into the pod. As a result, tika-grpc running on EKS cannot
> read S3 with the pod's AIM role.
>
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
