Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add AWS credential #281

Merged
merged 3 commits into from
Dec 4, 2024
Merged

Add AWS credential #281

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a240dc1
Add AWS credential
boyuan-chen Dec 3, 2024
b880ee1
Fix lint
boyuan-chen Dec 3, 2024
63b2097
change profile name
boyuan-chen Dec 3, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions op-service/txmgr/cli.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@ const (
ReceiptQueryIntervalFlagName = "txmgr.receipt-query-interval"
// Kms
KmsProductionName = "kms.production"
KmsProfileName = "kms.profile"
KmsKeyIDName = "kms.key.id"
KmsEndpointName = "kms.endpoint"
KmsRegionName = "kms.region"
Expand Down Expand Up @@ -204,6 +205,11 @@ func CLIFlagsWithDefaults(envPrefix string, defaults DefaultFlagValues) []cli.Fl
Value: false,
EnvVars: opservice.PrefixEnvVar(envPrefix, "KMS_PRODUCTION"),
},
&cli.StringFlag{
Name: KmsProfileName,
Usage: "The profile to use when initializing the KMS. If not set, the default profile will be used.",
EnvVars: opservice.PrefixEnvVar(envPrefix, "KMS_PROFILE"),
},
&cli.StringFlag{
Name: KmsKeyIDName,
Usage: "KMS Key ID.",
Expand Down Expand Up @@ -242,6 +248,7 @@ type CLIConfig struct {
TxSendTimeout time.Duration
TxNotInMempoolTimeout time.Duration
KmsProduction bool
KmsProfile string
KmsKeyID string
KmsEndpoint string
KmsRegion string
Expand Down Expand Up @@ -329,6 +336,7 @@ func ReadCLIConfig(ctx *cli.Context) CLIConfig {
TxSendTimeout: ctx.Duration(TxSendTimeoutFlagName),
TxNotInMempoolTimeout: ctx.Duration(TxNotInMempoolTimeoutFlagName),
KmsProduction: ctx.Bool(KmsProductionName),
KmsProfile: ctx.String(KmsProfileName),
KmsKeyID: ctx.String(KmsKeyIDName),
KmsEndpoint: ctx.String(KmsEndpointName),
KmsRegion: ctx.String(KmsRegionName),
Expand Down
6 changes: 6 additions & 0 deletions op-service/txmgr/kms.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,12 @@ func NewKmsConfig(cfg CLIConfig) (*KmsConfig, error) {
sess, err = session.NewSession(&aws.Config{
Region: aws.String(cfg.KmsRegion)},
)
if cfg.KmsProfile != "" {
sess, err = session.NewSession(&aws.Config{
Region: aws.String(cfg.KmsRegion),
Credentials: credentials.NewSharedCredentials("", cfg.KmsProfile),
})
}
} else {
log.Info("Using AWS KMS development mode")
if cfg.KmsKeyID == "" || cfg.KmsEndpoint == "" || cfg.KmsRegion == "" {
Expand Down
8 changes: 8 additions & 0 deletions ops/docker/op-stack-go/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,10 @@ RUN apk add --no-cache make gcc musl-dev linux-headers git jq bash
COPY ./go.mod /app/go.mod
COPY ./go.sum /app/go.sum

# We copy OCID script and aws config
COPY ./ops/scripts/aws_credential.sh /app/ops/scripts/aws_credential.sh
COPY ./ops/scripts/aws_config /app/ops/scripts/aws_config

WORKDIR /app

RUN echo "go mod cache: $(go env GOMODCACHE)"
Expand Down Expand Up @@ -143,10 +147,14 @@ CMD ["op-dispute-mon"]

FROM --platform=$TARGETPLATFORM $TARGET_BASE_IMAGE AS op-batcher-target
COPY --from=op-batcher-builder /app/op-batcher/bin/op-batcher /usr/local/bin/
COPY --from=op-batcher-builder /app/ops/scripts/aws_credential.sh /opt/aws/credentials.sh
COPY --from=op-batcher-builder /app/ops/scripts/aws_config /opt/.aws/config
CMD ["op-batcher"]

FROM --platform=$TARGETPLATFORM $TARGET_BASE_IMAGE AS op-proposer-target
COPY --from=op-proposer-builder /app/op-proposer/bin/op-proposer /usr/local/bin/
COPY --from=op-batcher-builder /app/ops/scripts/aws_credential.sh /opt/aws/credentials.sh
COPY --from=op-batcher-builder /app/ops/scripts/aws_config /opt/.aws/config
CMD ["op-proposer"]

FROM --platform=$TARGETPLATFORM $TARGET_BASE_IMAGE AS op-conductor-target
Expand Down
1 change: 1 addition & 0 deletions ops/docker/op-stack-go/Dockerfile.dockerignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,3 +21,4 @@
!/op-alt-da
!/go.mod
!/go.sum
!/ops
2 changes: 2 additions & 0 deletions ops/scripts/aws_config
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
[profile BobaGCP]
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A bit of a nit, I don't think we necessarily need to include 'Boba' here, I'd think simply calling this the "GCP" profile would be good enough. Presumably if someone is overwriting the aws config already, they would simply overwrite this file

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure. I have renamed it.

credential_process = /opt/aws/credentials.sh
17 changes: 17 additions & 0 deletions ops/scripts/aws_credential.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
#!/bin/bash

AUDIENCE="KMSAccess"
ROLE_ARN="arn:aws:iam::${AWS_ACCOUNT_ID}:role/gke-kms-access-role"

jwt_token=$(curl -sH "Metadata-Flavor: Google" "http://metadata/computeMetadata/v1/instance/service-accounts/default/identity?audience=${AUDIENCE}&format=full&licenses=FALSE")
jwt_decoded=$(jq -R 'split(".") | .[1] | @base64d | fromjson' <<< "$jwt_token")
jwt_sub=$(echo -n "$jwt_decoded" | jq -r '.sub')

credentials=$(aws sts assume-role-with-web-identity \
--role-arn "$ROLE_ARN" \
--role-session-name "$jwt_sub" \
--web-identity-token "$jwt_token" \
| jq '.Credentials' \
| jq '.Version=1')

echo "$credentials"