sollhui commented on code in PR #66555:
URL: https://github.com/apache/doris/pull/66555#discussion_r3781808581
##########
common/cpp/custom_aws_credentials_provider_chain.cpp:
##########
@@ -67,16 +77,26 @@
CustomAwsCredentialsProviderChain::CustomAwsCredentialsProviderChain()
"Added ECS metadata service credentials provider
with relative path: ["
<< relativeUri << "] to the provider
chain.");
} else if (!absoluteUri.empty()) {
+ // The endpoint authenticates each fetch with a bearer token, which
the provider takes
+ // either inline or as a file path. Given a path, Reload() re-reads
the file and
+ // overrides the inline value before every fetch. ECS sets only the
inline variable;
+ // EKS Pod Identity sets only the file one, and the kubelet rewrites
that file long
+ // before the token in it expires. Forwarding both is what makes the
Authorization
+ // header non-empty under Pod Identity - reading the inline variable
alone sends an
+ // empty header, the agent rejects it, and no S3 access works at all -
and what keeps
+ // it valid past the first rotation.
const auto token =
Aws::Environment::GetEnv(AWS_ECS_CONTAINER_AUTHORIZATION_TOKEN);
- AddProvider(Aws::MakeShared<TaskRoleCredentialsProvider>(
- DefaultCredentialsProviderChainTag, absoluteUri.c_str(),
token.c_str()));
+ const auto tokenPath =
Aws::Environment::GetEnv(AWS_EKS_CONTAINER_AUTHORIZATION_TOKEN_FILE);
+ AddProvider(Aws::MakeShared<GeneralHTTPCredentialsProvider>(
Review Comment:
Kafka MSK also need support
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
