S3: implements support for session token - #156
Open
ahouene wants to merge 5 commits into
Open
Conversation
neilcook
reviewed
Aug 13, 2026
Comment on lines
+526
to
+532
| creds := credentials.NewStaticV4(opt.AccessKey, opt.SecretKey, opt.SessionToken) | ||
| if opt.AccessKeyFile != "" { | ||
| creds = credentials.New(&FileSecretsCredentials{ | ||
| AccessKeyFile: opt.AccessKeyFile, | ||
| SecretKeyFile: opt.SecretKeyFile, | ||
| RefreshInterval: opt.SecretsRefreshInterval, | ||
| AccessKeyFile: opt.AccessKeyFile, | ||
| SecretKeyFile: opt.SecretKeyFile, | ||
| SessionTokenFile: opt.SessionTokenFile, | ||
| RefreshInterval: opt.SecretsRefreshInterval, |
Contributor
There was a problem hiding this comment.
I think there should be stronger checking of valid configurations. I think that you only want either static credentials, or file based credentials, but the current code allows for example opt.SessionTokenFile to be defined, along with opt.AccessKey and opt.SecretKey, but the session token file will be ignored.
| // https://kubernetes.io/docs/tasks/inject-data-application/distribute-credentials-secure | ||
| // and https://docs.docker.com/engine/swarm/secrets. | ||
| // | ||
| // It supports an empty or deleted SessionTokenFile. |
Contributor
There was a problem hiding this comment.
// It supports an empty or deleted SessionTokenFile. is stated here, but see comment in RetrieveWithCredContext
|
|
||
| var sessionToken []byte | ||
| if c.SessionTokenFile != "" { | ||
| sessionToken, err = os.ReadFile(c.SessionTokenFile) |
Contributor
There was a problem hiding this comment.
If the file was deleted, this will return an error, which contradicts what the comment above states about empty or deleted files.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds support for session tokens to be used along the access key id and the secret access key in the S3 backend, directly or through a file.
It also adds support for trailing newlines in those files.
The tests have been updated to take these additions into account. The test against the full test suite in case credential files are used is being removed because it doesn't bring much and just makes the tests longer. Instead, we test that the S3 Backend is correctly created and can (or cannot) perform a write operation with various file contents.