Allow short-lived AWS credentials

Add SESSION_TOKEN to aws-secret and the pod environment. (Fixes kkb0318#3)
brianr2600 · Aug 22, 2024 · 3b9e632 · 3b9e632
1 parent 23efcfc
commit 3b9e632
Show file tree

Hide file tree

Showing 5 changed files with 14 additions and 0 deletions.
diff --git a/README.md b/README.md
@@ -92,6 +92,7 @@ Create a secret for irsa-manager to access AWS:
 kubectl create secret generic aws-secret -n irsa-manager-system \
   --from-literal=aws-access-key-id=<your-access-key-id> \
   --from-literal=aws-secret-access-key=<your-secret-access-key> \
+  --from-literal=aws-session-token=<your-aws-session-token> # Optional \
   --from-literal=aws-region=<your-region> \
   --from-literal=aws-role-arn=<your-role-arn>  # Optional: Set this if you want to switch roles
 

diff --git a/charts/irsa-manager/README.md b/charts/irsa-manager/README.md
@@ -22,6 +22,7 @@ helm install irsa-manager kkb0318/irsa-manager -n irsa-manager-system --create-n
 kubectl create secret generic aws-secret -n irsa-manager-system \
   --from-literal=aws-access-key-id=<your-access-key-id> \
   --from-literal=aws-secret-access-key=<your-secret-access-key> \
+  --from-literal=aws-session-token=<your-aws-session-token> # Optional \
   --from-literal=aws-region=<your-region> \
   --from-literal=aws-role-arn=<your-role-arn>  # Optional: Set this if you want to switch roles
 

diff --git a/charts/irsa-manager/README.md.gotmpl b/charts/irsa-manager/README.md.gotmpl
@@ -22,6 +22,7 @@ helm install irsa-manager kkb0318/irsa-manager -n irsa-manager-system --create-n
 kubectl create secret generic aws-secret -n irsa-manager-system \
   --from-literal=aws-access-key-id=<your-access-key-id> \
   --from-literal=aws-secret-access-key=<your-secret-access-key> \
+  --from-literal=aws-session-token=<your-aws-session-token> # Optional \
   --from-literal=aws-region=<your-region> \
   --from-literal=aws-role-arn=<your-role-arn>  # Optional: Set this if you want to switch roles
 

diff --git a/charts/irsa-manager/templates/deployment.yaml b/charts/irsa-manager/templates/deployment.yaml
@@ -37,6 +37,11 @@ spec:
             secretKeyRef:
               key: aws-secret-access-key
               name: aws-secret
+        - name: AWS_SESSION_TOKEN
+          valueFrom:
+            secretKeyRef:
+              key: aws-session-token
+              name: aws-secret
         - name: AWS_REGION
           valueFrom:
             secretKeyRef:

diff --git a/config/manager/manager.yaml b/config/manager/manager.yaml
@@ -59,6 +59,12 @@ spec:
                   name: aws-secret
                   key: aws-secret-access-key
                   # optional: true
+            - name: AWS_SESSION_TOKEN
+                valueFrom:
+                  secretKeyRef:
+                    name: aws-secret
+                    key: aws-session-token
+                    # optional: true
             - name: AWS_REGION
               valueFrom:
                 secretKeyRef: