🐛 Create a `aws.Config` with region to be able to work different AWS partition (like gov cloud or china AWS partition) #4860

calvix · 2024-03-13T08:07:55Z

What type of PR is this?
/kind bug

What this PR does / why we need it:
When creating aws.Config without specifying a region the AWS SDK will by default call AWS commercial partition (known as just aws) .

If you wanna use a different AWS partition (https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/partitions.html and https://docs.aws.amazon.com/IAM/latest/UserGuide/reference-arns.html ) like for example aws-cn and provide static access keys to the user that is in aws-cn partition then the controller fails with error since AWS SDK tries to validate the access keys in aws commercial partition.


 > controller="awscluster" controllerGroup="infrastructure.cluster.x-k8s.io" controllerKind="AWSCluster" AWSCluster="org-giantswarm/galaxy" namespace="org-giantswarm" name="galaxy" reconcileID="e4da8234-95e0-476b-868f-d7c4aeda498c"
E0306 10:02:50.109642       1 controller.go:324] "Reconciler error" err=<
   error getting infra provider cluster or control plane object: failed to create aws session: Failed to retrieve identity credentials: InvalidClientTokenId: The security token included in the request is invalid.
   	status code: 403, request id: 391bd0ff-52b9-412d-8d03-82aa8d720bd5
> controller="awsmachine" controllerGroup="infrastructure.cluster.x-k8s.io" controllerKind="AWSMachine" AWSMachine="org-giantswarm/galaxy-control-plane-12c432c9-qrtwx" namespace="org-giantswarm" name="galaxy-control-plane-12c432c9-qrtwx" reconcileID="74834d11-ff72-464a-b63c-df993020ad38"
E0306 10:02:50.187222       1 controller.go:324] "Reconciler error" err=<
   error getting infra provider cluster or control plane object: failed to create aws session: Failed to retrieve identity credentials: InvalidClientTokenId: The security token included in the request is invalid.
   	status code: 403, request id: 63ba0c98-c34e-42c4-a276-4fbccc855908
> controller="awsmachine" controllerGroup="infrastructure.cluster.x-k8s.io" controllerKind="AWSMachine" AWSMachine="org-giantswarm/galaxy-control-plane-12c432c9-hpgm5" namespace="org-giantswarm" name="galaxy-control-plane-12c432c9-hpgm5" reconcileID="9246fa92-2b5f-40ab-8e82-5ca5cc464133"
E0306 10:02:50.202148       1 controller.go:324] "Reconciler error" err=<
   error getting infra provider cluster or control plane object: failed to create aws session: Failed to retrieve identity credentials: InvalidClientTokenId: The security token included in the request is invalid.
   	status code: 403, request id: 2ff4274b-1075-454f-ad2a-9002de92f501
> controller="awsmachine" controllerGroup="infrastructure.cluster.x-k8s.io" controllerKind="AWSMachine" AWSMachine="org-giantswarm/galaxy-control-plane-12c432c9-bdtfw" namespace="org-giantswarm" name="galaxy-control-plane-12c432c9-bdtfw" reconcileID="80073767-a7ff-44b0-b866-7ef1d16c676d"
E0306 10:08:18.496207       1 controller.go:324] "Reconciler error" err=<
   failed to create scope: failed to create aws session: Failed to retrieve identity credentials: InvalidClientTokenId: The security token included in the request is invalid.
   	status code: 403, request id: b1c30992-fdce-48e9-a66b-f951a4fd223d
   sigs.k8s.io/cluster-api-provider-aws/v2/pkg/cloud/scope.NewClusterScope
   	/workspace/pkg/cloud/scope/cluster.go:76
   sigs.k8s.io/cluster-api-provider-aws/v2/controllers.(*AWSClusterReconciler).Reconcile
   	/workspace/controllers/awscluster_controller.go:173

When the aws.Config is created with the proper region then the AWS SDK will connect to the right aws partition and correctly check for the validity of the static access key. And this is exactly what this PR fixes

squashed commits

Release note:

Create `aws.Config` with a region to be able to work with different AWS partitions

k8s-ci-robot · 2024-03-13T08:08:05Z

Hi @calvix. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

vincepri

/lgtm

vincepri · 2024-03-13T13:35:28Z

/ok-to-test

k8s-ci-robot · 2024-03-13T13:58:16Z

@calvix: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-cluster-api-provider-aws-apidiff-main	`a617ca1`	link	false	`/test pull-cluster-api-provider-aws-apidiff-main`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

calvix · 2024-03-13T14:17:05Z

pkg/cloud/identity/identity.go

@@ -154,7 +156,7 @@ func (p *AWSRolePrincipalTypeProvider) Name() string {
 // Retrieve returns the credential values for the AWSRolePrincipalTypeProvider.
 func (p *AWSRolePrincipalTypeProvider) Retrieve() (credentials.Value, error) {
 	if p.credentials == nil || p.IsExpired() {
-		awsConfig := aws.NewConfig()
+		awsConfig := aws.NewConfig().WithRegion(p.region)


this line is the core change, the rest is just wiring the region value to be able to use it here

vincepri

/approve
/assign @nrb

k8s-ci-robot · 2024-03-19T15:56:22Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: vincepri

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [vincepri]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

nrb · 2024-03-19T17:30:35Z

/lgtm

k8s-ci-robot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Mar 13, 2024

k8s-ci-robot requested review from Ankitasw and vincepri March 13, 2024 08:08

calvix marked this pull request as ready for review March 13, 2024 08:15

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 13, 2024

k8s-ci-robot requested a review from luthermonson March 13, 2024 08:15

vincepri approved these changes Mar 13, 2024

View reviewed changes

k8s-ci-robot assigned vincepri Mar 13, 2024

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 13, 2024

k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Mar 13, 2024

create-aws-client-with-region

a617ca1

calvix force-pushed the calvix-create-aws-client-with-region branch from e318bdb to a617ca1 Compare March 13, 2024 13:54

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 13, 2024

calvix commented Mar 13, 2024

View reviewed changes

calvix requested a review from vincepri March 19, 2024 09:21

vincepri approved these changes Mar 19, 2024

View reviewed changes

k8s-ci-robot assigned nrb Mar 19, 2024

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 19, 2024

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 19, 2024

k8s-ci-robot merged commit d62768f into kubernetes-sigs:main Mar 19, 2024
21 of 22 checks passed

calvix deleted the calvix-create-aws-client-with-region branch March 21, 2024 07:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🐛 Create a `aws.Config` with region to be able to work different AWS partition (like gov cloud or china AWS partition) #4860

🐛 Create a `aws.Config` with region to be able to work different AWS partition (like gov cloud or china AWS partition) #4860

calvix commented Mar 13, 2024 •

edited

Loading

k8s-ci-robot commented Mar 13, 2024

vincepri left a comment

vincepri commented Mar 13, 2024

k8s-ci-robot commented Mar 13, 2024 •

edited

Loading

calvix Mar 13, 2024

vincepri left a comment

k8s-ci-robot commented Mar 19, 2024

nrb commented Mar 19, 2024

🐛 Create a aws.Config with region to be able to work different AWS partition (like gov cloud or china AWS partition) #4860

🐛 Create a aws.Config with region to be able to work different AWS partition (like gov cloud or china AWS partition) #4860

Conversation

calvix commented Mar 13, 2024 • edited Loading

k8s-ci-robot commented Mar 13, 2024

vincepri left a comment

Choose a reason for hiding this comment

vincepri commented Mar 13, 2024

k8s-ci-robot commented Mar 13, 2024 • edited Loading

calvix Mar 13, 2024

Choose a reason for hiding this comment

vincepri left a comment

Choose a reason for hiding this comment

k8s-ci-robot commented Mar 19, 2024

nrb commented Mar 19, 2024

🐛 Create a `aws.Config` with region to be able to work different AWS partition (like gov cloud or china AWS partition) #4860

🐛 Create a `aws.Config` with region to be able to work different AWS partition (like gov cloud or china AWS partition) #4860

calvix commented Mar 13, 2024 •

edited

Loading

k8s-ci-robot commented Mar 13, 2024 •

edited

Loading