Allow env vars to skip vendor specific keychain#1315
Merged
Conversation
jabrown85
force-pushed
the
jab/keychain-allow-vendor-skip
branch
from
1c42b78 to
945fa8e
Compare
Vendor keychains can be slow or fail. This allows platform operators to skip them entirely. Signed-off-by: Jesse Brown <jabrown85@gmail.com>
jabrown85
force-pushed
the
jab/keychain-allow-vendor-skip
branch
from
945fa8e to
5128c13
Compare
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1315 +/- ##
==========================================
- Coverage 64.60% 64.53% -0.06%
==========================================
Files 101 101
Lines 7007 7016 +9
==========================================
+ Hits 4526 4527 +1
- Misses 2069 2077 +8
Partials 412 412
Flags with carried forward coverage won't be shown. Click here to find out more. |
Member
|
@jabrown85 I think this makes a lot of sense - and, this would allow us to merge #887 with less trepidation that it could break certain environments (I think the original underlying issue there was fixed, and we just forgot about the PR, but still...). |
Signed-off-by: Jesse Brown <jabrown85@gmail.com> Signed-off-by: Jesse Brown <jabrown85@gmail.com>
natalieparellano
approved these changes
Mar 27, 2024
matejvasek
reviewed
Apr 9, 2024
Comment on lines
+41
to
+48
| keychains := []authn.Keychain{envKeychain, authn.DefaultKeychain} | ||
|
|
||
| if vendorKeychainEnabled("amazon") { | ||
| keychains = append(keychains, amazonKeychain) | ||
| } | ||
| if vendorKeychainEnabled("azure") { | ||
| keychains = append(keychains, azureKeychain) | ||
| } |
Contributor
There was a problem hiding this comment.
Were the calls to NewResolvedKeychain() omitted deliberately?
natalieparellano
pushed a commit
that referenced
this pull request
Apr 9, 2024
Prior to #1315, all keychains passed to NewMultiKeychain were resolved keychains, which prevented the credentials from becoming inaccessible after the lifecycle dropped privileges. Signed-off-by: Natalie Arellano <narellano@vmware.com>
natalieparellano
pushed a commit
that referenced
this pull request
Apr 10, 2024
Prior to #1315, all keychains passed to NewMultiKeychain were resolved keychains, which prevented the credentials from becoming inaccessible after the lifecycle dropped privileges. Signed-off-by: Natalie Arellano <narellano@vmware.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Vendor keychains can be slow or fail. This allows platform operators to skip them entirely.
Release notes
Allow platform operators the ability to skip vendor specific keychain implementations by setting
CNB_REGISTRY_AUTH_KEYCHAIN_SKIP_AMAZONorCNB_REGISTRY_AUTH_KEYCHAIN_SKIP_AZURE.Related
Resolves #1007 (comment)
Context
The Amazon/ECR one is terribly inefficient. It tries to query the metadata service and eventually fails after a few tries. This is not needed if the platform is providing the credentials via Default/Env. Selectively disabling seemed liked a decent enough idea.