refactor external client to make single getAWSConfig call per connect #1003
Conversation
erhancagirici
changed the title
|
Is it possible to implement credential caching? Currently, it seems we make a single call per connect. However, when managing multiple resources, each resource triggers a separate call. Considering that IRSA credentials are valid for 15 minutes, it would be more efficient to perform the call only once every 15 minutes, even when dealing with numerous managed resources - what do you think ? |
erhancagirici
force-pushed
the
optimize-sts-calls
branch
3 times, most recently
from
9529217 to
5328115
Compare
|
@haarchri This PR is an initial improvement for addressing the low-hanging fruit. Our plan is to make further improvements in iterations. This is especially motivated by the fact that those parts of the provider are currently fractured because we have a hybrid architecture for that provider (both the CLI-based & SDK-based upjet architectures are in use at the moment). |
erhancagirici
force-pushed
the
optimize-sts-calls
branch
2 times, most recently
from
be58582 to
dc4d6d1
Compare
|
/test-examples="examples/iam/role.yaml" |
erhancagirici
force-pushed
the
optimize-sts-calls
branch
2 times, most recently
from
ef7740c to
a990e46
Compare
…r connect Signed-off-by: Erhan Cagirici <[email protected]>
ulucinar
force-pushed
the
optimize-sts-calls
branch
from
a990e46 to
e6f9d56
Compare
|
/test-examples="examples/iam/role.yaml" |
ulucinar
requested review from
ulucinar,
sergenyalcin and
turkenf
as code owners
| @@ -199,7 +196,7 @@ func DefaultTerraformSetupBuilder(ctx context.Context, c client.Client, mg resou | |||
| if pc.Spec.Endpoint != nil { | |||
| if pc.Spec.Endpoint.URL.Static != nil { | |||
| if len(pc.Spec.Endpoint.Services) > 0 && *pc.Spec.Endpoint.URL.Static == "" { | |||
| return errors.Wrap(err, "endpoint is wrong") | |||
There was a problem hiding this comment.
Good catch! Then, we were previously silently non-erroring :)
…s specified Signed-off-by: Alper Rifat Ulucinar <[email protected]>
|
/test-examples="examples/iam/role.yaml" |
Description of your changes
Refactors
getAWSConfigcalls in the external client code, to make single call per connect.getAWSconfigcalls involve resolving credentials and executing AWS STS calls when there are relevantAssumeRoleorAssumeRoleWithWebIdentityoperations needed. This was being called multiple times per connect, causing superfluous invocations.This PR will improve the situation reported at #997
I have:
make reviewable testto ensure this PR is ready for review.How has this code been tested
Via uptest: https://github.com/upbound/provider-aws/actions/runs/7141372941