Skip to content

Commit 11b8b41

Browse files
AmitSahastraAmitSahastra
authored
Pcp 1428 4.0 (#812)
1 parent 05d753a commit 11b8b41

File tree

3 files changed

+176
-18
lines changed

3 files changed

+176
-18
lines changed

‎pkg/cloud/scope/session.go‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ package scope
1919
import (
2020
"context"
2121
"fmt"
22+
"sigs.k8s.io/cluster-api-provider-aws/pkg/utils"
2223
"sync"
2324

2425
"github.com/aws/aws-sdk-go/aws"
@@ -86,7 +87,7 @@ func sessionForRegion(region string, endpoint []ServiceEndpoint) (*session.Sessi
8687
}, nil
8788
}
8889
}
89-
return endpoints.DefaultResolver().EndpointFor(service, region, optFns...)
90+
return utils.CustomEndpointResolverForAWS().EndpointFor(service, region, optFns...)
9091
}
9192
ns, err := session.NewSession(&aws.Config{
9293
Region: aws.String(region),
@@ -108,6 +109,11 @@ func sessionForClusterWithRegion(k8sClient client.Client, clusterScoper cloud.Cl
108109
log := logger.WithName("identity")
109110
log.V(4).Info("Creating an AWS Session")
110111

112+
err := utils.ResetFipsEndpointEnv(region)
113+
if err != nil {
114+
return nil, nil, errors.Wrap(err, "Failed to reset fips endpoint env")
115+
}
116+
111117
resolver := func(service, region string, optFns ...func(*endpoints.Options)) (endpoints.ResolvedEndpoint, error) {
112118
for _, s := range endpoint {
113119
if service == s.ServiceID {
@@ -117,7 +123,8 @@ func sessionForClusterWithRegion(k8sClient client.Client, clusterScoper cloud.Cl
117123
}, nil
118124
}
119125
}
120-
return endpoints.DefaultResolver().EndpointFor(service, region, optFns...)
126+
127+
return utils.CustomEndpointResolverForAWS().EndpointFor(service, region, optFns...)
121128
}
122129

123130
providers, err := getProvidersForCluster(context.Background(), k8sClient, clusterScoper, log)

‎pkg/utils/resolver_endpoint.go‎

Lines changed: 61 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,11 @@ package utils
33
import (
44
"github.com/aws/aws-sdk-go/aws/endpoints"
55
"k8s.io/klog/v2/klogr"
6+
"os"
67
)
78

9+
var isFIPSEndpointEnabled bool
10+
811
func CustomEndpointResolverForAWS() endpoints.ResolverFunc {
912

1013
log := klogr.New()
@@ -15,8 +18,8 @@ func CustomEndpointResolverForAWS() endpoints.ResolverFunc {
1518
return resolve, err
1619
}
1720

18-
log.V(0).Info("CustomEndpointResolverForAWS", " region: ", region, " service: ", service, " optFns: ", optFns)
19-
21+
log.V(1).Info("CustomEndpointResolverForAWS", " region: ", region, " service: ", service, " optFns: ", optFns)
22+
// Handle only for US-GOV regions exceptions
2023
switch region {
2124
case endpoints.UsGovEast1RegionID:
2225
switch service {
@@ -79,7 +82,31 @@ func CustomEndpointResolverForAWS() endpoints.ResolverFunc {
7982
case "autoscaling-plans":
8083
resolve.URL = "https://autoscaling-plans.us-gov-west-1.amazonaws.com"
8184
case "autoscaling":
82-
resolve.URL = "https://ec2autoscaling.us-gov-west-1.amazonaws.com"
85+
resolve.URL = "https://autoscaling.us-gov-west-1.amazonaws.com"
86+
}
87+
88+
case endpoints.UsEast1RegionID:
89+
switch service {
90+
case "autoscaling":
91+
resolve.URL = "https://autoscaling.us-east-1.amazonaws.com"
92+
}
93+
94+
case endpoints.UsEast2RegionID:
95+
switch service {
96+
case "autoscaling":
97+
resolve.URL = "https://autoscaling.us-east-2.amazonaws.com"
98+
}
99+
100+
case endpoints.UsWest1RegionID:
101+
switch service {
102+
case "autoscaling":
103+
resolve.URL = "https://autoscaling.us-west-1.amazonaws.com"
104+
}
105+
106+
case endpoints.UsWest2RegionID:
107+
switch service {
108+
case "autoscaling":
109+
resolve.URL = "https://autoscaling.us-west-2.amazonaws.com"
83110
}
84111
}
85112

@@ -89,3 +116,34 @@ func CustomEndpointResolverForAWS() endpoints.ResolverFunc {
89116

90117
return resolver
91118
}
119+
120+
func ResetFipsEndpointEnv(region string) error {
121+
log := klogr.New()
122+
if isFIPSEndpointEnabled && shouldResetFIPSEndpointEnv(region) {
123+
log.V(1).Info("ResetFipsEndpointEnv required for non fips regions")
124+
err := os.Unsetenv("AWS_USE_FIPS_ENDPOINT")
125+
if err != nil {
126+
log.Error(err, "Failed to unset env AWS_USE_FIPS_ENDPOINT")
127+
return err
128+
}
129+
isFIPSEndpointEnabled = false
130+
}
131+
132+
return nil
133+
}
134+
135+
func shouldResetFIPSEndpointEnv(region string) bool {
136+
switch region {
137+
case endpoints.UsEast1RegionID, endpoints.UsEast2RegionID, endpoints.UsWest1RegionID, endpoints.UsWest2RegionID, endpoints.UsGovEast1RegionID, endpoints.UsGovWest1RegionID:
138+
default:
139+
return true
140+
}
141+
return false
142+
}
143+
144+
func init() {
145+
isEnabled := os.Getenv("AWS_USE_FIPS_ENDPOINT")
146+
if isEnabled == "true" {
147+
isFIPSEndpointEnabled = true
148+
}
149+
}

‎pkg/utils/resolver_endpoint_test.go‎

Lines changed: 106 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,125 @@
11
package utils
22

33
import (
4+
"github.com/aws/aws-sdk-go/aws"
45
"github.com/aws/aws-sdk-go/aws/endpoints"
6+
"github.com/aws/aws-sdk-go/aws/session"
7+
"github.com/aws/aws-sdk-go/service/cloudformation"
8+
"github.com/aws/aws-sdk-go/service/sts"
59
"github.com/onsi/gomega"
10+
"os"
611
"strings"
712
"testing"
813
)
914

1015
func TestResolverEndpointAWSGov(t *testing.T) {
1116
g := gomega.NewGomegaWithT(t)
1217

13-
resolver := CustomEndpointResolverForAWS()
14-
result, err := resolver(endpoints.CloudformationServiceID, endpoints.UsGovEast1RegionID, endpoints.UseFIPSEndpointOption)
15-
g.Expect(err).ToNot(gomega.HaveOccurred())
16-
g.Expect(strings.Contains(result.URL, "cloudformation.us-gov-east-1.amazonaws.com")).To(gomega.BeTrue())
18+
err := os.Setenv("AWS_USE_FIPS_ENDPOINT", "true")
19+
if err != nil {
20+
g.Expect(err).ToNot(gomega.HaveOccurred())
21+
}
1722

18-
result, err = resolver(endpoints.CloudformationServiceID, endpoints.UsGovWest1RegionID, endpoints.UseFIPSEndpointOption)
19-
g.Expect(err).ToNot(gomega.HaveOccurred())
23+
// Test us-gov and fips enabled regions
24+
err = os.Setenv("AWS_REGION", "us-west-2")
25+
if err != nil {
26+
g.Expect(err).ToNot(gomega.HaveOccurred())
27+
}
28+
sess, err := session.NewSessionWithOptions(session.Options{
29+
SharedConfigState: session.SharedConfigEnable,
30+
})
31+
if err != nil {
32+
g.Expect(err).ToNot(gomega.HaveOccurred())
33+
}
2034

21-
g.Expect(strings.Contains(result.URL, "cloudformation.us-gov-west-1.amazonaws.com")).To(gomega.BeTrue())
35+
stsSvc := sts.New(sess, aws.NewConfig().WithEndpointResolver(CustomEndpointResolverForAWS()))
36+
g.Expect(stsSvc.ServiceID).ToNot(gomega.BeEmpty())
37+
g.Expect(strings.Contains(stsSvc.Endpoint, "sts-fips.us-west-2.amazonaws.com")).To(gomega.BeTrue())
2238

23-
result, err = resolver(endpoints.StsServiceID, endpoints.UsGovWest1RegionID, endpoints.UseFIPSEndpointOption)
24-
g.Expect(err).ToNot(gomega.HaveOccurred())
39+
cfnSvc := cloudformation.New(sess, aws.NewConfig().WithEndpointResolver(CustomEndpointResolverForAWS()))
40+
g.Expect(cfnSvc.ServiceID).ToNot(gomega.BeEmpty())
41+
g.Expect(strings.Contains(cfnSvc.Endpoint, "cloudformation-fips.us-west-2.amazonaws.com")).To(gomega.BeTrue())
2542

26-
g.Expect(strings.Contains(result.URL, "sts.us-gov-west-1.amazonaws.com")).To(gomega.BeTrue())
43+
err = os.Setenv("AWS_REGION", "us-east-2")
44+
if err != nil {
45+
g.Expect(err).ToNot(gomega.HaveOccurred())
46+
}
47+
sess, err = session.NewSessionWithOptions(session.Options{
48+
SharedConfigState: session.SharedConfigEnable,
49+
})
50+
if err != nil {
51+
g.Expect(err).ToNot(gomega.HaveOccurred())
52+
}
2753

28-
result, err = resolver(endpoints.IamServiceID, endpoints.UsGovWest1RegionID, endpoints.UseFIPSEndpointOption)
29-
g.Expect(err).ToNot(gomega.HaveOccurred())
54+
stsSvc = sts.New(sess, aws.NewConfig().WithEndpointResolver(CustomEndpointResolverForAWS()))
55+
g.Expect(stsSvc.ServiceID).ToNot(gomega.BeEmpty())
56+
g.Expect(strings.Contains(stsSvc.Endpoint, "sts-fips.us-east-2.amazonaws.com")).To(gomega.BeTrue())
3057

31-
g.Expect(strings.Contains(result.URL, "iam.us-gov.amazonaws.com")).To(gomega.BeTrue())
58+
cfnSvc = cloudformation.New(sess, aws.NewConfig().WithEndpointResolver(CustomEndpointResolverForAWS()))
59+
g.Expect(cfnSvc.ServiceID).ToNot(gomega.BeEmpty())
60+
g.Expect(strings.Contains(cfnSvc.Endpoint, "cloudformation-fips.us-east-2.amazonaws.com")).To(gomega.BeTrue())
61+
62+
err = os.Setenv("AWS_REGION", endpoints.UsGovWest1RegionID)
63+
if err != nil {
64+
g.Expect(err).ToNot(gomega.HaveOccurred())
65+
}
66+
67+
sess, err = session.NewSessionWithOptions(session.Options{
68+
SharedConfigState: session.SharedConfigEnable,
69+
})
70+
if err != nil {
71+
g.Expect(err).ToNot(gomega.HaveOccurred())
72+
}
73+
74+
cfnSvc = cloudformation.New(sess, aws.NewConfig().WithEndpointResolver(CustomEndpointResolverForAWS()))
75+
g.Expect(cfnSvc.ServiceID).ToNot(gomega.BeEmpty())
76+
g.Expect(strings.Contains(cfnSvc.Endpoint, "cloudformation.us-gov-west-1.amazonaws.com")).To(gomega.BeTrue())
77+
78+
stsSvc = sts.New(sess, aws.NewConfig().WithEndpointResolver(CustomEndpointResolverForAWS()))
79+
g.Expect(stsSvc.ServiceID).ToNot(gomega.BeEmpty())
80+
g.Expect(strings.Contains(stsSvc.Endpoint, "sts.us-gov-west-1.amazonaws.com")).To(gomega.BeTrue())
81+
82+
// Test non fips endpoint regions
83+
err = os.Unsetenv("AWS_USE_FIPS_ENDPOINT")
84+
if err != nil {
85+
g.Expect(err).ToNot(gomega.HaveOccurred())
86+
}
87+
err = os.Setenv("AWS_REGION", endpoints.EuNorth1RegionID)
88+
if err != nil {
89+
g.Expect(err).ToNot(gomega.HaveOccurred())
90+
}
91+
sess, err = session.NewSessionWithOptions(session.Options{
92+
SharedConfigState: session.SharedConfigEnable,
93+
})
94+
if err != nil {
95+
g.Expect(err).ToNot(gomega.HaveOccurred())
96+
}
97+
98+
cfnSvc = cloudformation.New(sess, aws.NewConfig().WithEndpointResolver(CustomEndpointResolverForAWS()))
99+
g.Expect(cfnSvc.ServiceID).ToNot(gomega.BeEmpty())
100+
g.Expect(strings.Contains(cfnSvc.Endpoint, "cloudformation.eu-north-1.amazonaws.com")).To(gomega.BeTrue())
101+
102+
stsSvc = sts.New(sess, aws.NewConfig().WithEndpointResolver(CustomEndpointResolverForAWS()))
103+
g.Expect(stsSvc.ServiceID).ToNot(gomega.BeEmpty())
104+
g.Expect(strings.Contains(stsSvc.Endpoint, "sts.amazonaws.com")).To(gomega.BeTrue())
105+
106+
err = os.Setenv("AWS_REGION", endpoints.ApSoutheast1RegionID)
107+
if err != nil {
108+
g.Expect(err).ToNot(gomega.HaveOccurred())
109+
}
110+
111+
sess, err = session.NewSessionWithOptions(session.Options{
112+
SharedConfigState: session.SharedConfigEnable,
113+
})
114+
if err != nil {
115+
g.Expect(err).ToNot(gomega.HaveOccurred())
116+
}
117+
118+
cfnSvc = cloudformation.New(sess, aws.NewConfig().WithEndpointResolver(CustomEndpointResolverForAWS()))
119+
g.Expect(cfnSvc.ServiceID).ToNot(gomega.BeEmpty())
120+
g.Expect(strings.Contains(cfnSvc.Endpoint, "cloudformation.ap-southeast-1.amazonaws.com")).To(gomega.BeTrue())
121+
122+
stsSvc = sts.New(sess, aws.NewConfig().WithEndpointResolver(CustomEndpointResolverForAWS()))
123+
g.Expect(stsSvc.ServiceID).ToNot(gomega.BeEmpty())
124+
g.Expect(strings.Contains(stsSvc.Endpoint, "sts.amazonaws.com")).To(gomega.BeTrue())
32125
}

0 commit comments

Comments
 (0)