control-service: force aws cred provider refresh (#2879)

what: Forced the AWS credentials service to refresh credentials before passing them to the data job builder task. why: Users of the control-service noticed that the job builder task would occasionally fail with 401 unauthorized when attempting to push images to aws ecr repository. Since some builders take longer to build the images, it is possible that a passed valid credential expired during build. As per the aws documentation: "This credentials provider uses a background thread to refresh credentials." though it is unclear when credentials are rotated. Note this behaviour of the provider was changed in a aws update, previously the credentials were generated before every request. testing: existing tests should cover this. Signed-off-by: mrMoZ1 <[email protected]>
vmware · Nov 6, 2023 · 74cd3ab · 74cd3ab
1 parent bcdc43d
commit 74cd3ab
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/...ol_service/src/main/java/com/vmware/taurus/service/credentials/AWSCredentialsService.java b/...ol_service/src/main/java/com/vmware/taurus/service/credentials/AWSCredentialsService.java
@@ -77,6 +77,7 @@ public AWSCredentialsDTO createTemporaryCredentials() {
           "",
           awsCredentialsServiceConfig.getRegion());
     }
+    credentialsProvider.refresh();
     AWSSessionCredentials serviceAccountCredentials = credentialsProvider.getCredentials();
     var accessKeyId = serviceAccountCredentials.getAWSAccessKeyId();
     var secretAccessKey = serviceAccountCredentials.getAWSSecretKey();