You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
scaswell-tsys opened this issue
Apr 20, 2022
· 2 comments
· Fixed by #3475
Assignees
Labels
enhancementEnhancement or improvement to existing feature or requestPluginssecurityAnything security relatedv2.1.0Issues and PRs related to version 2.1.0v2.2.0v3.0.0Issues and PRs related to version 3.0.0
Is your feature request related to a problem? Please describe.
The corporate standard at our organization for products running inside AWS EKS is to use IAM Roles for Service Accounts (IRSA) to provide credentials for authentication to AWS services such as S3. This does not appear to be supported in the repository-s3 plugin.
Describe the solution you'd like
The ability to omit access key and secret key and have the repository-s3 plugin rely on the identity provided to the Pod running OpenSearch for credentials.
Describe alternatives you've considered
There are not a lot of alternatives. Until IRSA is supported we will be forced to use an access key/secret key combination. However this is contrary to the standard imposed by our Infosec organization and we'll be forced to obtain an exception (not an attractive proposition).
Additional context
We are specifically trying to deploy OpenSearch and repository-s3 plugin version 1.2.4. We have not tried to use version 1.3.1 but as far as I can tell (based on source code, documentation, and forums) IRSA is not supported in 1.3.1.
The text was updated successfully, but these errors were encountered:
enhancementEnhancement or improvement to existing feature or requestPluginssecurityAnything security relatedv2.1.0Issues and PRs related to version 2.1.0v2.2.0v3.0.0Issues and PRs related to version 3.0.0
Is your feature request related to a problem? Please describe.
The corporate standard at our organization for products running inside AWS EKS is to use IAM Roles for Service Accounts (IRSA) to provide credentials for authentication to AWS services such as S3. This does not appear to be supported in the repository-s3 plugin.
Describe the solution you'd like
The ability to omit access key and secret key and have the repository-s3 plugin rely on the identity provided to the Pod running OpenSearch for credentials.
Describe alternatives you've considered
There are not a lot of alternatives. Until IRSA is supported we will be forced to use an access key/secret key combination. However this is contrary to the standard imposed by our Infosec organization and we'll be forced to obtain an exception (not an attractive proposition).
Additional context
We are specifically trying to deploy OpenSearch and repository-s3 plugin version 1.2.4. We have not tried to use version 1.3.1 but as far as I can tell (based on source code, documentation, and forums) IRSA is not supported in 1.3.1.
The text was updated successfully, but these errors were encountered: