Add new AWS podIdentity #5061

JorTurFer · 2023-10-08T18:36:32Z

Special KUDOS to @ThaSami, who has developed almost all the WebIdentity and caching code

This PR Introduced a new authentication option for AWS, relying 100% on TriggerAuthentication CRD for getting all the required information instead of mixing TriggerAuthentication and trigger.metadata section. For this, 2 new fields have been added:

roleArn: Similar to already existing clientId, this new field is used for manually providing the AWS roleArn that KEDA has to use.
identityOwner: This field is used for specifying if you want to use KEDA's roleArn or the workload roleArn (recovered from the workload service account annotations). This field is an enum with 3 valid values: unset, keda, workload (unset is treaded as keda)
These fields are mutually exclusive and there is a validation in admission webhooks to check this.

This new authentication allows 3 different working ways:

Using KEDA's role (identityOwner: keda): In this scenario, KEDA's role has the required permission for accessing to the resources.
Using workload's role via AssumeRole(identityOwner: workload or roleArn: VALUE): In this scenario, KEDA will use its own role to assume workloads role via AssumeRole API. This requires that KEDA's role can assume other role inside AWS AIM. (and it's the assume role who has the access instead of KEDA's role)
Using workload's role via Web Identity Role(identityOwner: workload or roleArn: VALUE): In this scenario, KEDA will request the role via WebIdentityRole API. This requires an OIDC federation between KEDA's service account and the role that KEDA has to assume.(and it's the assume role who has the access instead of KEDA's role)

Additionally, this PR adds a cache for storing the aws credentials across all the usages instead of creating a credential instance per scaler. This means that if we are using the same role on several scalers, KEDA will use the same instance/token for all the scalers instead of requesting (and refreshing) a token for each scaler. To know if the aws config is in use in other scalers, we will use a new unique key introduced as scaler.Config level which is based on resourceType,namespace,resourceName,triggerIndex to be unique accross all the resources.
This new caching system has been included only as part of this new authenticaiton and also using AWS_ACCESS_KEY and AWS_ACCESS_SECRET.

Checklist

When introducing a new scaler, I agree with the scaling governance policy
have verified that my change is according to the deprecations & breaking changes policy
Tests have been added
Changelog has been updated and is aligned with our changelog requirements
A PR is opened to update the documentation on (repo) (if applicable) Add documentation about new AWS auth keda-docs#1251
Commits are signed with Developer Certificate of Origin (DCO - learn more)

Fixes #4134
Fixes #5178
Fixes #5297

Relates to:

github-actions · 2023-10-08T18:36:43Z

Thank you for your contribution! 🙏 We will review your PR as soon as possible.

While you are waiting, make sure to:

Add an entry in our changelog in alphabetical order and link related issue
Update the documentation, if needed
Add unit & e2e tests for your changes
GitHub checks are passing
Is the DCO check failing? Here is how you can fix DCO issues

Learn more about:

Our contribution guide

blakepettersson · 2023-11-28T15:00:29Z

To add further confusion, AWS has just released a new alternative to IRSA called Pod Identity 😄

I'm not sure of the relevance it will have, if any, on this PR but would be worth to have a look to see the potential impact of this feature.

JorTurFer · 2023-12-30T22:47:02Z

/run-e2e aws
Update: You can check the progress here

JorTurFer · 2023-12-31T08:30:59Z

/run-e2e aws
Update: You can check the progress here

JorTurFer · 2023-12-31T12:21:34Z

/run-e2e aws
Update: You can check the progress here

pkg/scalers/aws/aws_config_cache.go

Co-authored-by: Sami S <[email protected]> Signed-off-by: Jorge Turrado <[email protected]>

JorTurFer · 2023-12-31T16:27:55Z

/run-e2e
Update: You can check the progress here

JorTurFer · 2023-12-31T17:39:26Z

/run-e2e aws
Update: You can check the progress here

Signed-off-by: Jorge Turrado <[email protected]>

JorTurFer · 2024-01-01T22:30:20Z

/run-e2e aws
Update: You can check the progress here

JorTurFer · 2024-01-01T22:34:19Z

PTAL @zroubalik , @tomkerkhove @blakepettersson @ThaSami
I've been working on this feature and it's ready to review. I've addressed all the comments here and also in the issue (or at least I hope so)

Signed-off-by: Jorge Turrado <[email protected]>

JorTurFer · 2024-01-01T22:49:50Z

/run-e2e aws
Update: You can check the progress here

zroubalik

Great job, I have a few comments in general about documentation.

Will do another review once kedacore/keda-docs#1251 (comment) is resolved

pkg/scalers/scaler.go

pkg/scalers/aws/aws_authorization.go

pkg/scalers/aws/aws_common.go

pkg/scalers/aws/aws_config_cache.go

pkg/scalers/aws/aws_common.go

…ueKey Signed-off-by: Jorge Turrado <[email protected]>

Signed-off-by: Jorge Turrado <[email protected]>

pkg/scaling/scalers_builder.go

Signed-off-by: Jorge Turrado <[email protected]>

Signed-off-by: Jorge Turrado Ferrero <[email protected]>

Signed-off-by: Jorge Turrado <[email protected]>

JorTurFer · 2024-01-03T23:07:06Z

/run-e2e aws
Update: You can check the progress here

Signed-off-by: Jorge Turrado <[email protected]>

JorTurFer · 2024-01-03T23:33:40Z

/run-e2e aws
Update: You can check the progress here

wozniakjan

great work!

few minor nits for your consideration provided below

apis/keda/v1alpha1/triggerauthentication_types.go

pkg/scalers/aws/aws_config_cache.go

Signed-off-by: Jorge Turrado <[email protected]>

Signed-off-by: Jorge Turrado Ferrero <[email protected]>

JorTurFer · 2024-01-07T17:57:37Z

/run-e2e aws
Update: You can check the progress here

zroubalik

LGTM, great work everybody, @blakepettersson @ThaSami @JorTurFer !

* Add new AWS podIdentity Co-authored-by: Sami S <[email protected]> Signed-off-by: Jorge Turrado <[email protected]> * use new resources Signed-off-by: Jorge Turrado <[email protected]> * fix logs Signed-off-by: Jorge Turrado <[email protected]> * rename scalerIndex to triggerIndex and ScalerUniqueKey to TriggerUniqueKey Signed-off-by: Jorge Turrado <[email protected]> * add missing headers Signed-off-by: Jorge Turrado <[email protected]> * propagate ctx Signed-off-by: Jorge Turrado <[email protected]> * Add documentation commments Signed-off-by: Jorge Turrado <[email protected]> * Add explanation to new files Signed-off-by: Jorge Turrado <[email protected]> * Add semgrep exclusion Signed-off-by: Jorge Turrado <[email protected]> * go mod updates Signed-off-by: Jorge Turrado <[email protected]> * update comment Signed-off-by: Jorge Turrado <[email protected]> * update clientset Signed-off-by: Jorge Turrado <[email protected]> * apply feedback Signed-off-by: Jorge Turrado <[email protected]> --------- Signed-off-by: Jorge Turrado <[email protected]> Signed-off-by: Jorge Turrado <[email protected]> Signed-off-by: Jorge Turrado Ferrero <[email protected]> Co-authored-by: Sami S <[email protected]>

JorTurFer force-pushed the add-aws branch from 5f5c9d4 to a440e2f Compare October 9, 2023 17:13

This was referenced Oct 10, 2023

AWS Pod identities need to be reviewed #4134

Closed

Removing support for AWS-KIAM Identity authentication from KEDA on v2.15 #5085

Closed

Removing support for AWS-EKS Identity authentication from KEDA on v3 #5086

Open

blakepettersson mentioned this pull request Nov 20, 2023

Feat: Enhance podIdentity Role Assumption in AWS by Direct Integration with OIDC/Federation and Implement Credentials Cache #5177

Closed

4 tasks

JorTurFer mentioned this pull request Dec 18, 2023

Add support aws secretmanager authentication #5162

Merged

7 tasks

JorTurFer force-pushed the add-aws branch from 12cc370 to c696c0b Compare December 27, 2023 15:07

JorTurFer force-pushed the add-aws branch 2 times, most recently from 66de066 to 02a2bf1 Compare December 31, 2023 12:15

JorTurFer marked this pull request as ready for review December 31, 2023 12:21

JorTurFer requested a review from a team as a code owner December 31, 2023 12:21

JorTurFer changed the title ~~WIP - Add new AWS podIdentity~~ Add new AWS podIdentity Dec 31, 2023

semgrep-app bot reviewed Dec 31, 2023

View reviewed changes

pkg/scalers/aws/aws_config_cache.go Outdated Show resolved Hide resolved

semgrep-app bot reviewed Dec 31, 2023

View reviewed changes

pkg/scalers/aws/aws_config_cache.go Outdated Show resolved Hide resolved

JorTurFer force-pushed the add-aws branch from 3f0ebb5 to d8249e4 Compare December 31, 2023 16:22

Add new AWS podIdentity

e7a57ac

Co-authored-by: Sami S <[email protected]> Signed-off-by: Jorge Turrado <[email protected]>

JorTurFer force-pushed the add-aws branch from d8249e4 to e7a57ac Compare December 31, 2023 16:24

use new resources

7339cfa

Signed-off-by: Jorge Turrado <[email protected]>

fix logs

9bc02e7

Signed-off-by: Jorge Turrado <[email protected]>

zroubalik requested a review from wozniakjan January 3, 2024 19:58

zroubalik reviewed Jan 3, 2024

View reviewed changes

JorTurFer added 2 commits January 3, 2024 23:16

rename scalerIndex to triggerIndex and ScalerUniqueKey to TriggerUniq…

cb6ab34

…ueKey Signed-off-by: Jorge Turrado <[email protected]>

add missing headers

89a69af

Signed-off-by: Jorge Turrado <[email protected]>

semgrep-app bot reviewed Jan 3, 2024

View reviewed changes

pkg/scaling/scalers_builder.go Show resolved Hide resolved

JorTurFer and others added 7 commits January 3, 2024 23:19

propagate ctx

8f3a3b2

Signed-off-by: Jorge Turrado <[email protected]>

Add documentation commments

ba2d0c9

Signed-off-by: Jorge Turrado <[email protected]>

Add explanation to new files

2ec8636

Signed-off-by: Jorge Turrado <[email protected]>

Merge branch 'main' into add-aws

6d0a5e8

Signed-off-by: Jorge Turrado Ferrero <[email protected]>

Add semgrep exclusion

5a9c624

Signed-off-by: Jorge Turrado <[email protected]>

go mod updates

b4eb615

Signed-off-by: Jorge Turrado <[email protected]>

update comment

74b36e1

Signed-off-by: Jorge Turrado <[email protected]>

update clientset

548d1fe

Signed-off-by: Jorge Turrado <[email protected]>

wozniakjan reviewed Jan 7, 2024

View reviewed changes

apis/keda/v1alpha1/triggerauthentication_types.go Show resolved Hide resolved

pkg/scalers/aws/aws_config_cache.go Outdated Show resolved Hide resolved

JorTurFer and others added 2 commits January 7, 2024 18:54

apply feedback

1e982e9

Signed-off-by: Jorge Turrado <[email protected]>

Merge branch 'main' into add-aws

1900f0d

Signed-off-by: Jorge Turrado Ferrero <[email protected]>

wozniakjan approved these changes Jan 7, 2024

View reviewed changes

zroubalik approved these changes Jan 8, 2024

View reviewed changes

JorTurFer merged commit c132117 into kedacore:main Jan 9, 2024
19 checks passed

JorTurFer deleted the add-aws branch January 9, 2024 16:16

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add new AWS podIdentity #5061

Add new AWS podIdentity #5061

JorTurFer commented Oct 8, 2023 •

edited

Loading

github-actions bot commented Oct 8, 2023

blakepettersson commented Nov 28, 2023 •

edited

Loading

JorTurFer commented Dec 30, 2023 •

edited by github-actions bot

Loading

JorTurFer commented Dec 31, 2023 •

edited by github-actions bot

Loading

JorTurFer commented Dec 31, 2023 •

edited by github-actions bot

Loading

JorTurFer commented Dec 31, 2023 •

edited by github-actions bot

Loading

JorTurFer commented Dec 31, 2023 •

edited by github-actions bot

Loading

JorTurFer commented Jan 1, 2024 •

edited by github-actions bot

Loading

JorTurFer commented Jan 1, 2024

JorTurFer commented Jan 1, 2024 •

edited by github-actions bot

Loading

zroubalik left a comment

JorTurFer commented Jan 3, 2024 •

edited by github-actions bot

Loading

JorTurFer commented Jan 3, 2024 •

edited by github-actions bot

Loading

wozniakjan left a comment

JorTurFer commented Jan 7, 2024 •

edited by github-actions bot

Loading

zroubalik left a comment

Add new AWS podIdentity #5061

Add new AWS podIdentity #5061

Conversation

JorTurFer commented Oct 8, 2023 • edited Loading

Checklist

github-actions bot commented Oct 8, 2023

blakepettersson commented Nov 28, 2023 • edited Loading

JorTurFer commented Dec 30, 2023 • edited by github-actions bot Loading

JorTurFer commented Dec 31, 2023 • edited by github-actions bot Loading

JorTurFer commented Dec 31, 2023 • edited by github-actions bot Loading

JorTurFer commented Dec 31, 2023 • edited by github-actions bot Loading

JorTurFer commented Dec 31, 2023 • edited by github-actions bot Loading

JorTurFer commented Jan 1, 2024 • edited by github-actions bot Loading

JorTurFer commented Jan 1, 2024

JorTurFer commented Jan 1, 2024 • edited by github-actions bot Loading

zroubalik left a comment

Choose a reason for hiding this comment

JorTurFer commented Jan 3, 2024 • edited by github-actions bot Loading

JorTurFer commented Jan 3, 2024 • edited by github-actions bot Loading

wozniakjan left a comment

Choose a reason for hiding this comment

JorTurFer commented Jan 7, 2024 • edited by github-actions bot Loading

zroubalik left a comment

Choose a reason for hiding this comment

JorTurFer commented Oct 8, 2023 •

edited

Loading

blakepettersson commented Nov 28, 2023 •

edited

Loading

JorTurFer commented Dec 30, 2023 •

edited by github-actions bot

Loading

JorTurFer commented Dec 31, 2023 •

edited by github-actions bot

Loading

JorTurFer commented Dec 31, 2023 •

edited by github-actions bot

Loading

JorTurFer commented Dec 31, 2023 •

edited by github-actions bot

Loading

JorTurFer commented Dec 31, 2023 •

edited by github-actions bot

Loading

JorTurFer commented Jan 1, 2024 •

edited by github-actions bot

Loading

JorTurFer commented Jan 1, 2024 •

edited by github-actions bot

Loading

JorTurFer commented Jan 3, 2024 •

edited by github-actions bot

Loading

JorTurFer commented Jan 3, 2024 •

edited by github-actions bot

Loading

JorTurFer commented Jan 7, 2024 •

edited by github-actions bot

Loading