bartek opened a new pull request, #3439: URL: https://github.com/apache/tika/pull/3439
On EKS, pods get AWS access through IAM roles for service accounts (IRSA). The pod is given a web identity token, with AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE set in its environment. The S3 plugin only supports instance, profile and key_secret, so there's no way to use the pod's role. Using instance picks up the node's role instead. This adds an `identity` credentialsProvider to the fetcher, emitter and pipes iterator, backed by the SDK's WebIdentityTokenFileCredentialsProvider. Additionally: * Added the sts module. The web identity provider needs it to exchange the token for credentials, but doesn't look for it until the first request. Without it, the fetcher builds fine and then fails on its first fetch. * Moved the fetcher's provider selection into buildCredentialsProvider, like the emitter has, so it can be tested without AWS. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
