@@ -56,6 +56,12 @@ const (
5656 stsAssumeRoleRetryMaxBackoffDelay = 10 * time .Second
5757)
5858
59+ const (
60+ eksauthAssumeRoleRetryCode = "AccessDeniedException"
61+ eksauthAssumeRoleRetryMaxAttemps = 0 // This will cause SDK to retry indefinetly, but we do have a timeout on the operation
62+ eksauthAssumeRoleRetryMaxBackoffDelay = 10 * time .Second
63+ )
64+
5965const serviceAccountTokenAudienceSTS = "sts.amazonaws.com"
6066const roleARNAnnotation = "eks.amazonaws.com/role-arn"
6167const credentialSecretName = "aws-secret"
@@ -360,7 +366,7 @@ func (t *s3CSICredentialsTestSuite) DefineTests(driver storageframework.TestDriv
360366 removeAssociation := createPodIdentityAssociation (ctx , f , sa , * role .Arn )
361367 deferCleanup (removeAssociation )
362368
363- pod := CSIDriverPod (ctx , f )
369+ pod := csiDriverPod (ctx , f )
364370 waitUntilRoleIsAssumableWithEKS (ctx , f , sa , pod )
365371
366372 // Trigger recreation of our pods to use the new IAM role
@@ -752,7 +758,7 @@ func eksPodIdentityRoleTrustPolicyDocument() string {
752758 {
753759 "Effect" : "Allow" ,
754760 "Principal" : jsonMap {
755- "Service" : "pods.eks.amazonaws.com" ,
761+ "Service" : serviceAccountTokenAudienceEKS ,
756762 },
757763 "Action" : []string {"sts:AssumeRole" , "sts:TagSession" },
758764 },
@@ -818,7 +824,7 @@ func assumeRole(ctx context.Context, f *framework.Framework, roleArn string) *st
818824 framework .Logf ("Assuming IAM role %s" , roleArn )
819825
820826 client := sts .NewFromConfig (awsConfig (ctx ))
821- return waitUntilRoleIsAssumable (ctx , client .AssumeRole , & sts.AssumeRoleInput {
827+ return waitUntilRoleIsAssumableSTS (ctx , client .AssumeRole , & sts.AssumeRoleInput {
822828 RoleArn : ptr .To (roleArn ),
823829 RoleSessionName : ptr .To (f .BaseName ),
824830 DurationSeconds : ptr .To (int32 (stsAssumeRoleCredentialDuration .Seconds ())),
@@ -828,38 +834,44 @@ func assumeRole(ctx context.Context, f *framework.Framework, roleArn string) *st
828834// waitUntilRoleIsAssumable waits until the given role is assumable.
829835// This is needed because we're creating new roles in our test cases and then trying to assume those roles,
830836// but there is a delay between IAM and STS services and newly created roles/policies does not appear on STS immediately.
831- func waitUntilRoleIsAssumable [Input any , Output any ](ctx context.Context , assumeFunc func (context.Context , * Input , ... func (* sts.Options )) (* Output , error ), input * Input ) * Output {
837+ func waitUntilRoleIsAssumable [Input any , Output any , O any ](
838+ ctx context.Context ,
839+ assumeFunc func (context.Context , * Input , ... func (O )) (* Output , error ),
840+ input * Input ,
841+ optionsFunc func (O ),
842+ ) * Output {
832843 ctx , cancel := context .WithTimeout (ctx , stsAssumeRoleTimeout )
833844 defer cancel ()
834845
835- output , err := assumeFunc (ctx , input , func (o * sts.Options ) {
836- o .Retryer = retry .AddWithErrorCodes (o .Retryer , stsAssumeRoleRetryCode )
837- o .Retryer = retry .AddWithMaxAttempts (o .Retryer , stsAssumeRoleRetryMaxAttemps )
838- o .Retryer = retry .AddWithMaxBackoffDelay (o .Retryer , stsAssumeRoleRetryMaxBackoffDelay )
839- })
846+ output , err := assumeFunc (ctx , input , optionsFunc )
840847 framework .ExpectNoError (err )
841848 gomega .Expect (output ).ToNot (gomega .BeNil ())
842849
843850 return output
844851}
845852
846- // waitUntilRoleIsAssumableEKS waits until the given role is assumable.
847- // This is needed because we're creating new roles in our test cases and then trying to assume those roles,
848- // but there is a delay between IAM and STS services and newly created roles/policies does not appear on STS immediately.
849- func waitUntilRoleIsAssumableEKS [Input any , Output any ](ctx context.Context , assumeFunc func (context.Context , * Input , ... func (* eksauth.Options )) (* Output , error ), input * Input ) * Output {
850- ctx , cancel := context .WithTimeout (ctx , stsAssumeRoleTimeout )
851- defer cancel ()
852-
853- output , err := assumeFunc (ctx , input , func (o * eksauth.Options ) {
854- o .Retryer = retry .AddWithErrorCodes (o .Retryer , stsAssumeRoleRetryCode , "AccessDeniedException" )
853+ func waitUntilRoleIsAssumableSTS [Input any , Output any ](
854+ ctx context.Context ,
855+ assumeFunc func (context.Context , * Input , ... func (* sts.Options )) (* Output , error ),
856+ input * Input ,
857+ ) * Output {
858+ return waitUntilRoleIsAssumable (ctx , assumeFunc , input , func (o * sts.Options ) {
859+ o .Retryer = retry .AddWithErrorCodes (o .Retryer , stsAssumeRoleRetryCode )
855860 o .Retryer = retry .AddWithMaxAttempts (o .Retryer , stsAssumeRoleRetryMaxAttemps )
856861 o .Retryer = retry .AddWithMaxBackoffDelay (o .Retryer , stsAssumeRoleRetryMaxBackoffDelay )
857862 })
863+ }
858864
859- framework .ExpectNoError (err )
860- gomega .Expect (output ).ToNot (gomega .BeNil ())
861-
862- return output
865+ func waitUntilRoleIsAssumableEKS [Input any , Output any ](
866+ ctx context.Context ,
867+ assumeFunc func (context.Context , * Input , ... func (* eksauth.Options )) (* Output , error ),
868+ input * Input ,
869+ ) * Output {
870+ return waitUntilRoleIsAssumable (ctx , assumeFunc , input , func (o * eksauth.Options ) {
871+ o .Retryer = retry .AddWithErrorCodes (o .Retryer , eksauthAssumeRoleRetryCode )
872+ o .Retryer = retry .AddWithMaxAttempts (o .Retryer , eksauthAssumeRoleRetryMaxAttemps )
873+ o .Retryer = retry .AddWithMaxBackoffDelay (o .Retryer , eksauthAssumeRoleRetryMaxBackoffDelay )
874+ })
863875}
864876
865877func waitUntilRoleIsAssumableWithWebIdentity (ctx context.Context , f * framework.Framework , sa * v1.ServiceAccount ) {
@@ -875,7 +887,7 @@ func waitUntilRoleIsAssumableWithWebIdentity(ctx context.Context, f *framework.F
875887 framework .ExpectNoError (err )
876888
877889 client := sts .NewFromConfig (awsConfig (ctx ))
878- waitUntilRoleIsAssumable (ctx , client .AssumeRoleWithWebIdentity , & sts.AssumeRoleWithWebIdentityInput {
890+ waitUntilRoleIsAssumableSTS (ctx , client .AssumeRoleWithWebIdentity , & sts.AssumeRoleWithWebIdentityInput {
879891 RoleArn : ptr .To (roleARN ),
880892 RoleSessionName : ptr .To (f .BaseName ),
881893 WebIdentityToken : ptr .To (serviceAccountToken .Status .Token ),
0 commit comments