github-actions[bot] commented on code in PR #66555: URL: https://github.com/apache/doris/pull/66555#discussion_r3772474184
########## thirdparty/vars.sh: ########## @@ -379,10 +379,10 @@ BOOTSTRAP_TABLE_CSS_FILE="bootstrap-table.min.css" BOOTSTRAP_TABLE_CSS_MD5SUM="23389d4456da412e36bae30c469a766a" # aws sdk -AWS_SDK_DOWNLOAD="https://github.com/aws/aws-sdk-cpp/archive/refs/tags/1.11.219.tar.gz"; -AWS_SDK_NAME="aws-sdk-cpp-1.11.219.tar.gz" -AWS_SDK_SOURCE="aws-sdk-cpp-1.11.219" -AWS_SDK_MD5SUM="80aa616efe1a3e7a9bf0dfbc44a97864" +AWS_SDK_DOWNLOAD="https://github.com/aws/aws-sdk-cpp/archive/refs/tags/1.11.221.tar.gz"; Review Comment: [P1] Invalidate stale AWS SDK installs for this version bump The new production source requires `GeneralHTTPCredentialsProvider.h` and its symbol, neither of which exists in the previously pinned 1.11.219 SDK. However, `build.sh` validates an existing install only with the final-library sentinel plus the Arrow/Paimon manifest. The macOS BE workflow makes this deterministic: a `thirdparty/vars.sh` change downloads the base prebuilt (still containing 1.11.219) and rebuilds only Arrow/Paimon before compiling BE, so this PR cannot find the new header/symbol there. Please add version-aware AWS SDK invalidation/rebuild logic and make the macOS path build or consume a matching 1.11.221 SDK. ########## common/cpp/custom_aws_credentials_provider_chain.cpp: ########## @@ -67,16 +77,26 @@ CustomAwsCredentialsProviderChain::CustomAwsCredentialsProviderChain() "Added ECS metadata service credentials provider with relative path: [" << relativeUri << "] to the provider chain."); } else if (!absoluteUri.empty()) { + // The endpoint authenticates each fetch with a bearer token, which the provider takes + // either inline or as a file path. Given a path, Reload() re-reads the file and + // overrides the inline value before every fetch. ECS sets only the inline variable; + // EKS Pod Identity sets only the file one, and the kubelet rewrites that file long + // before the token in it expires. Forwarding both is what makes the Authorization + // header non-empty under Pod Identity - reading the inline variable alone sends an + // empty header, the agent rejects it, and no S3 access works at all - and what keeps + // it valid past the first rotation. const auto token = Aws::Environment::GetEnv(AWS_ECS_CONTAINER_AUTHORIZATION_TOKEN); - AddProvider(Aws::MakeShared<TaskRoleCredentialsProvider>( - DefaultCredentialsProviderChainTag, absoluteUri.c_str(), token.c_str())); + const auto tokenPath = Aws::Environment::GetEnv(AWS_EKS_CONTAINER_AUTHORIZATION_TOKEN_FILE); + AddProvider(Aws::MakeShared<GeneralHTTPCredentialsProvider>( Review Comment: [P1] Apply the EKS provider wiring to explicit CONTAINER routes This fixes `CustomAwsCredentialsProviderChain`, but `CONTAINER` is also a supported public provider mode. The BE S3 factory, Cloud recycler, and MSK auth paths still construct `TaskRoleCredentialsProvider` from only `AWS_CONTAINER_CREDENTIALS_RELATIVE_URI`. Standard EKS injects only `AWS_CONTAINER_CREDENTIALS_FULL_URI` plus `AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE`, so those branches pass an empty URI, create no HTTP client, and return no credentials (including when used as an STS base provider). Please centralize this construction so every explicit container-provider path forwards the relative URI, full URI, inline token, and rotating token-file path, and add coverage for explicit `CONTAINER` mode rather than only the default custom chain. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
