aroch opened a new pull request #12008:
URL: https://github.com/apache/flink/pull/12008
<!--
*Thank you very much for contributing to Apache Flink - we are happy that
you want to help us improve Flink. To help the community review your
contribution in the best possible way, please go through the checklist below,
which will get the contribution into a shape in which it can be best reviewed.*
*Please understand that we do not do this to make contributions to Flink a
hassle. In order to uphold a high standard of quality for code contributions,
while at the same time managing a large number of contributions, we need
contributors to prepare the contributions well, and give reviewers enough
contextual information for the review. Please also understand that
contributions that do not follow this guide will take longer to review and thus
typically be picked up with lower priority by the community.*
## Contribution Checklist
- Make sure that the pull request corresponds to a [JIRA
issue](https://issues.apache.org/jira/projects/FLINK/issues). Exceptions are
made for typos in JavaDoc or documentation files, which need no JIRA issue.
- Name the pull request in the form "[FLINK-XXXX] [component] Title of the
pull request", where *FLINK-XXXX* should be replaced by the actual issue
number. Skip *component* if you are unsure about which is the best component.
Typo fixes that have no associated JIRA issue should be named following
this pattern: `[hotfix] [docs] Fix typo in event time introduction` or
`[hotfix] [javadocs] Expand JavaDoc for PuncuatedWatermarkGenerator`.
- Fill out the template below to describe the changes contributed by the
pull request. That will give reviewers the context they need to do the review.
- Make sure that the change passes the automated tests, i.e., `mvn clean
verify` passes. You can set up Travis CI to do that following [this
guide](https://flink.apache.org/contributing/contribute-code.html#open-a-pull-request).
- Each pull request should address only one issue, not mix up code from
multiple issues.
- Each commit in the pull request has a meaningful commit message
(including the JIRA id)
- Once all items of the checklist are addressed, remove the above text and
this checklist, leaving only the filled out template below.
**(The sections below can be removed for hotfixes of typos)**
-->
## What is the purpose of the change
IAM Roles for Service Accounts have many advantages when deploying Flink on
AWS EKS.
From AWS documentation:
> With IAM roles for service accounts on Amazon EKS clusters, you can
associate an IAM role with a Kubernetes service account. This service account
can then provide AWS permissions to the containers in any pod that uses that
service account. With this feature, you no longer need to provide extended
permissions to the worker node IAM role so that pods on that node can call AWS
APIs.
In order to support for IAM Roles for Service Accounts we need to add
support for a relatively new authentication method in AWS SDK called
WebIdentityToken.
This pull request adds support for WebIdentityToken authentication method
when using AWS services. This includes S3 and Kinesis.
## Brief change log
S3
- Bumping AWS SDK dependency to 1.11.754
- Bumping httpcomponents:httpclient dependency to 4.5.9
- Added aws-java-sdk-sts dependency
Kinesis
- Bumping AWS SDK dependency to 1.11.754
- Added CredentialProvider type for WebIdentityToken
## Verifying this change
It is tricky to verify this change by end-to-end test as Kinesalite doesn't
support authentication methods. Minio does support it but requires extra
containers to be launched to do the actual token verification that will
complicate and lengthen the s3 tests.
Added configuration unit tests in `AWSUtilTest`
As this change is mainly a dependency change, I verified it manually on an
actual EKS cluster.
## Does this pull request potentially affect one of the following parts:
- Dependencies (does it add or upgrade a dependency): (**yes** / no)
- The public API, i.e., is any changed class annotated with
`@Public(Evolving)`: (yes / **no**)
- The serializers: (yes / **no**)
- The runtime per-record code paths (performance sensitive): (yes / **no**)
- Anything that affects deployment or recovery: JobManager (and its
components), Checkpointing, Kubernetes/Yarn/Mesos, ZooKeeper: (yes / **no** /
don't know)
- The S3 file system connector: (**yes** / no)
## Documentation
- Does this pull request introduce a new feature? (**yes** / no)
- If yes, how is the feature documented? (not applicable / docs /
**JavaDocs** / not documented)
Currently I could not find the deployment on EKS documented anywhere. If
needed i'm willing to add docs if that would be helpful.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
