Skip to content

Commit a481e44

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #876 from gargipanatula/hardcode-sts-endpoints
Migrate STS hostname verification to AWS SDK Go V2
2 parents 851f655 + 12997cd commit a481e44

File tree

12 files changed

+489
-154
lines changed

12 files changed

+489
-154
lines changed

‎cmd/aws-iam-authenticator/root.go‎

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -20,17 +20,18 @@ import (
2020
"errors"
2121
"fmt"
2222
"os"
23+
"slices"
2324
"strings"
2425

2526
"sigs.k8s.io/aws-iam-authenticator/pkg/config"
2627
"sigs.k8s.io/aws-iam-authenticator/pkg/mapper"
2728

28-
"github.com/aws/aws-sdk-go/aws/endpoints"
2929
"github.com/sirupsen/logrus"
3030
"github.com/spf13/cobra"
3131
"github.com/spf13/viper"
3232
utilerrors "k8s.io/apimachinery/pkg/util/errors"
3333
"k8s.io/component-base/featuregate"
34+
"sigs.k8s.io/aws-iam-authenticator/pkg/endpoints"
3435
)
3536

3637
var cfgFile string
@@ -157,13 +158,7 @@ func getConfig() (config.Config, error) {
157158
return cfg, errors.New("cluster ID cannot be empty")
158159
}
159160

160-
partitionKeys := []string{}
161-
partitionMap := map[string]endpoints.Partition{}
162-
for _, p := range endpoints.DefaultPartitions() {
163-
partitionMap[p.ID()] = p
164-
partitionKeys = append(partitionKeys, p.ID())
165-
}
166-
if _, ok := partitionMap[cfg.PartitionID]; !ok {
161+
if !slices.Contains(endpoints.PARTITIONS, cfg.PartitionID) {
167162
return cfg, errors.New("Invalid partition")
168163
}
169164

‎cmd/aws-iam-authenticator/server.go‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,11 @@ import (
2929
"sigs.k8s.io/aws-iam-authenticator/pkg/metrics"
3030
"sigs.k8s.io/aws-iam-authenticator/pkg/server"
3131

32-
"github.com/aws/aws-sdk-go/aws/endpoints"
3332
"github.com/prometheus/client_golang/prometheus"
3433
"github.com/sirupsen/logrus"
3534
"github.com/spf13/cobra"
3635
"github.com/spf13/viper"
36+
"sigs.k8s.io/aws-iam-authenticator/pkg/endpoints"
3737
)
3838

3939
const (
@@ -67,14 +67,9 @@ var serverCmd = &cobra.Command{
6767
}
6868

6969
func init() {
70-
partitionKeys := []string{}
71-
for _, p := range endpoints.DefaultPartitions() {
72-
partitionKeys = append(partitionKeys, p.ID())
73-
}
74-
7570
serverCmd.Flags().String("partition",
7671
endpoints.AwsPartitionID,
77-
fmt.Sprintf("The AWS partition. Must be one of: %v", partitionKeys))
72+
fmt.Sprintf("The AWS partition. Must be one of: %v", endpoints.PARTITIONS))
7873
viper.BindPFlag("server.partition", serverCmd.Flags().Lookup("partition"))
7974

8075
serverCmd.Flags().String("generate-kubeconfig",

‎cmd/aws-iam-authenticator/verify.go‎

Lines changed: 24 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -19,15 +19,16 @@ limitations under the License.
1919
package main
2020

2121
import (
22+
"context"
2223
"encoding/json"
2324
"fmt"
2425
"os"
2526

27+
"sigs.k8s.io/aws-iam-authenticator/pkg/endpoints"
2628
"sigs.k8s.io/aws-iam-authenticator/pkg/token"
2729

28-
"github.com/aws/aws-sdk-go/aws/ec2metadata"
29-
"github.com/aws/aws-sdk-go/aws/endpoints"
30-
"github.com/aws/aws-sdk-go/aws/session"
30+
"github.com/aws/aws-sdk-go-v2/config"
31+
"github.com/aws/aws-sdk-go-v2/feature/ec2/imds"
3132
"github.com/spf13/cobra"
3233
"github.com/spf13/viper"
3334
)
@@ -54,12 +55,7 @@ var verifyCmd = &cobra.Command{
5455
os.Exit(1)
5556
}
5657

57-
sess := session.Must(session.NewSession())
58-
ec2metadata := ec2metadata.New(sess)
59-
instanceRegion, err := ec2metadata.Region()
60-
if err != nil {
61-
fmt.Printf("[Warn] Region not found in instance metadata, err: %v", err)
62-
}
58+
instanceRegion := getInstanceRegion(context.Background())
6359

6460
id, err := token.NewVerifier(clusterID, partition, instanceRegion).Verify(tok)
6561
if err != nil {
@@ -86,14 +82,27 @@ func init() {
8682
viper.BindPFlag("token", verifyCmd.Flags().Lookup("token"))
8783
viper.BindPFlag("output", verifyCmd.Flags().Lookup("output"))
8884

89-
partitionKeys := []string{}
90-
for _, p := range endpoints.DefaultPartitions() {
91-
partitionKeys = append(partitionKeys, p.ID())
92-
}
93-
9485
verifyCmd.Flags().String("partition",
9586
endpoints.AwsPartitionID,
96-
fmt.Sprintf("The AWS partition. Must be one of: %v", partitionKeys))
87+
fmt.Sprintf("The AWS partition. Must be one of: %v", endpoints.PARTITIONS))
9788
viper.BindPFlag("partition", verifyCmd.Flags().Lookup("partition"))
9889

9990
}
91+
92+
// Uses EC2 metadata to get the region. Returns "" if no region found.
93+
func getInstanceRegion(ctx context.Context) string {
94+
cfg, err := config.LoadDefaultConfig(ctx)
95+
if err != nil {
96+
fmt.Fprintf(os.Stderr, "[Warn] Unable to create config for metadata client, err: %v", err)
97+
panic(err)
98+
}
99+
100+
imdsClient := imds.NewFromConfig(cfg)
101+
getRegionOutput, err := imdsClient.GetRegion(ctx, &imds.GetRegionInput{})
102+
if err != nil {
103+
fmt.Fprintf(os.Stderr, "[Warn] Region not found in instance metadata, err: %v\n", err)
104+
return ""
105+
}
106+
107+
return getRegionOutput.Region
108+
}

‎go.mod‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,11 @@ module sigs.k8s.io/aws-iam-authenticator
33
go 1.24.4
44

55
require (
6-
github.com/aws/aws-sdk-go v1.55.7
76
github.com/aws/aws-sdk-go-v2 v1.36.6
87
github.com/aws/aws-sdk-go-v2/config v1.29.18
98
github.com/aws/aws-sdk-go-v2/credentials v1.17.71
109
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.33
11-
github.com/aws/aws-sdk-go-v2/service/ec2 v1.233.1
10+
github.com/aws/aws-sdk-go-v2/service/ec2 v1.235.0
1211
github.com/aws/aws-sdk-go-v2/service/sts v1.34.1
1312
github.com/aws/smithy-go v1.22.4
1413
github.com/fsnotify/fsnotify v1.9.0
@@ -55,7 +54,6 @@ require (
5554
github.com/google/gnostic-models v0.6.9 // indirect
5655
github.com/google/uuid v1.6.0 // indirect
5756
github.com/inconshreveable/mousetrap v1.1.0 // indirect
58-
github.com/jmespath/go-jmespath v0.4.0 // indirect
5957
github.com/josharian/intern v1.0.0 // indirect
6058
github.com/json-iterator/go v1.1.12 // indirect
6159
github.com/mailru/easyjson v0.9.0 // indirect

‎go.sum‎

Lines changed: 2 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
github.com/aws/aws-sdk-go v1.55.7 h1:UJrkFq7es5CShfBwlWAC8DA077vp8PyVbQd3lqLiztE=
2-
github.com/aws/aws-sdk-go v1.55.7/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
31
github.com/aws/aws-sdk-go-v2 v1.36.6 h1:zJqGjVbRdTPojeCGWn5IR5pbJwSQSBh5RWFTQcEQGdU=
42
github.com/aws/aws-sdk-go-v2 v1.36.6/go.mod h1:EYrzvCCN9CMUTa5+6lf6MM4tq3Zjp8UhSGR/cBsjai0=
53
github.com/aws/aws-sdk-go-v2/config v1.29.18 h1:x4T1GRPnqKV8HMJOMtNktbpQMl3bIsfx8KbqmveUO2I=
@@ -14,8 +12,8 @@ github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.37 h1:v+X21AvTb2wZ+ycg1g
1412
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.37/go.mod h1:G0uM1kyssELxmJ2VZEfG0q2npObR3BAkF3c1VsfVnfs=
1513
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
1614
github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
17-
github.com/aws/aws-sdk-go-v2/service/ec2 v1.233.1 h1:1KYEVBXApGIQnXChtqKTZSN6jerkfiFhOApi8TcGs2w=
18-
github.com/aws/aws-sdk-go-v2/service/ec2 v1.233.1/go.mod h1:K7qdQFo+lbGM48aPEyoPfy/VN/xNOA4o8GGczfSXNcQ=
15+
github.com/aws/aws-sdk-go-v2/service/ec2 v1.235.0 h1:TE8LEu5sTuH2fR9Buv8BNXafOSm+CDrQA3DmYSaWX00=
16+
github.com/aws/aws-sdk-go-v2/service/ec2 v1.235.0/go.mod h1:K7qdQFo+lbGM48aPEyoPfy/VN/xNOA4o8GGczfSXNcQ=
1917
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.4 h1:CXV68E2dNqhuynZJPB80bhPQwAKqBWVer887figW6Jc=
2018
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.4/go.mod h1:/xFi9KtvBXP97ppCz1TAEvU1Uf66qvid89rbem3wCzQ=
2119
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.18 h1:vvbXsA2TVO80/KT7ZqCbx934dt6PY+vQ8hZpUZ/cpYg=
@@ -84,10 +82,6 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
8482
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
8583
github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
8684
github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
87-
github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
88-
github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
89-
github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
90-
github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
9185
github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
9286
github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
9387
github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
@@ -230,7 +224,6 @@ gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSP
230224
gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
231225
gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
232226
gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
233-
gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
234227
gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
235228
gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
236229
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

‎pkg/arn/arn.go‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,11 @@ package arn
22

33
import (
44
"fmt"
5+
"slices"
56
"strings"
67

78
awsarn "github.com/aws/aws-sdk-go-v2/aws/arn"
8-
"github.com/aws/aws-sdk-go/aws/endpoints"
9+
"sigs.k8s.io/aws-iam-authenticator/pkg/endpoints"
910
)
1011

1112
type PrincipalType int
@@ -101,10 +102,8 @@ func StripPath(arn string) (string, error) {
101102
}
102103

103104
func checkPartition(partition string) error {
104-
for _, p := range endpoints.DefaultPartitions() {
105-
if partition == p.ID() {
106-
return nil
107-
}
105+
if !slices.Contains(endpoints.PARTITIONS, partition) {
106+
return fmt.Errorf("partition %s is not recognized", partition)
108107
}
109-
return fmt.Errorf("partition %s is not recognized", partition)
108+
return nil
110109
}

‎pkg/endpoints/partitions.go‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
package endpoints
2+
3+
import (
4+
"fmt"
5+
)
6+
7+
// Represents the partitions recognized by the github.com/aws/aws-sdk-go/aws/endpoints
8+
// package. Obtaining these partitions has been deprecated in the AWS SDK Go V2, so this serves as a
9+
// hardcoded alternative. Source: https://github.com/aws/aws-sdk-go/blob/main/aws/endpoints/defaults.go
10+
const (
11+
AwsPartitionID = "aws" // AWS Standard partition.
12+
AwsCnPartitionID = "aws-cn" // AWS China partition.
13+
AwsUsGovPartitionID = "aws-us-gov" // AWS GovCloud (US) partition.
14+
AwsIsoPartitionID = "aws-iso" // AWS ISO (US) partition.
15+
AwsIsoBPartitionID = "aws-iso-b" // AWS ISOB (US) partition.
16+
AwsIsoEPartitionID = "aws-iso-e" // AWS ISOE (Europe) partition.
17+
AwsIsoFPartitionID = "aws-iso-f" // AWS ISOF partition.
18+
)
19+
20+
var (
21+
PARTITIONS = []string{
22+
AwsPartitionID,
23+
AwsCnPartitionID,
24+
AwsUsGovPartitionID,
25+
AwsIsoPartitionID,
26+
AwsIsoBPartitionID,
27+
AwsIsoEPartitionID,
28+
AwsIsoFPartitionID,
29+
}
30+
)
31+
32+
// Returns the STS domain for the given partition. Returns an error
33+
// if the partition is not recognized.
34+
func GetSTSPartitionDomain(partition string) (string, error) {
35+
var domain string
36+
37+
switch partition {
38+
case AwsPartitionID:
39+
domain = "amazonaws.com"
40+
case AwsCnPartitionID:
41+
domain = "amazonaws.com.cn"
42+
case AwsUsGovPartitionID:
43+
domain = "amazonaws.com"
44+
case AwsIsoPartitionID:
45+
domain = "c2s.ic.gov"
46+
case AwsIsoBPartitionID:
47+
domain = "sc2s.sgov.gov"
48+
case AwsIsoEPartitionID:
49+
domain = "cloud.adc-e.uk"
50+
case AwsIsoFPartitionID:
51+
domain = "csp.hci.ic.gov"
52+
default:
53+
return "", fmt.Errorf("Partition %s not valid", partition)
54+
}
55+
56+
return domain, nil
57+
}
58+
59+
// Gets the dual stack domain for the given partition. Returns an empty string
60+
// if the partition does not support dual stack
61+
func GetSTSDualStackPartitionDomain(partition string) string {
62+
var domain string
63+
64+
switch partition {
65+
case AwsPartitionID:
66+
domain = "api.aws"
67+
case AwsUsGovPartitionID:
68+
domain = "api.aws"
69+
case AwsCnPartitionID:
70+
domain = "api.amazonwebservices.com.cn"
71+
default:
72+
return ""
73+
}
74+
75+
return domain
76+
}

0 commit comments

Comments
 (0)