mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-20 11:21:49 +00:00
Josh Siviour
5de598e85a
* ci: skip building unused E2E suite binaries in e2e.yml's single/multi jobs These two jobs immediately rebuild suite-aware binaries after Build Install Artifacts and never consume the tar's _bin contents, so the cross-compiled suite build was pure waste. build-install-artifacts.sh gains an optional --skip-e2e-build flag (positional contract unchanged); e2e-nightly.yml and the other callers keep building the full set. * refactor: replace hand-rolled IMDS client with AWS SDK v2 internal/imdscreds, cmd/ecs-agent's metadata fetch and its credentials provider used a hand-written IMDSv2 token/GET flow with manual RFC3339 expiry parsing. A malformed Expiration silently fell back to "never expires" instead of failing. Replace it with feature/ec2/imds, credentials/ec2rolecreds and aws.CredentialsCache, following the internal/gwsign/signer.go precedent. An unparseable Expiration is now a hard error from Fetch, covered by TestFetch_BadExpirationErrors. Output shapes to callers are unchanged, and IMDS base URLs ending in /latest keep working. * refactor: derive predastore bind config from spinifex.toml in spx itself predastore-start.sh awk-parsed spinifex.toml for the bind host/port and node_id, exported them as env vars, then exec'd spx. Move that derivation into predastoreStartCmd via derivePredastoreBind, which reads the raw (non-DIAL-normalized) nodes.<node>.predastore section, defaulting node_id to -1 (co-located) when the key is absent, same as the script. An explicit --host/--port/--node-id flag or SPINIFEX_PREDASTORE_* env var still overrides the derived value. Delete the now-unused script and point the systemd unit's ExecStart directly at spx service predastore start, matching the spinifex-viperblock.service precedent.
42 lines
1.3 KiB
Go
42 lines
1.3 KiB
Go
package credentials
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
|
|
"github.com/aws/aws-sdk-go-v2/aws"
|
|
"github.com/mulgadc/spinifex/internal/imdscreds"
|
|
)
|
|
|
|
// IMDSProvider fetches instance-role credentials from IMDS via the AWS SDK's
|
|
// EC2 IMDS client and ec2rolecreds provider, cached with aws.CredentialsCache
|
|
// (which refetches once the real expiry passes; ec2rolecreds also caps
|
|
// Expires to at most an hour out). Safe for concurrent use.
|
|
type IMDSProvider struct {
|
|
cache *aws.CredentialsCache
|
|
}
|
|
|
|
var _ CredentialsProvider = (*IMDSProvider)(nil)
|
|
|
|
// NewIMDSProvider builds a provider against the given IMDS base URL (e.g.
|
|
// "http://169.254.169.254/latest"). A nil client uses the SDK IMDS client's
|
|
// default HTTP client.
|
|
func NewIMDSProvider(client *http.Client, base string) *IMDSProvider {
|
|
provider := imdscreds.NewProvider(client, base)
|
|
return &IMDSProvider{cache: aws.NewCredentialsCache(provider)}
|
|
}
|
|
|
|
// Retrieve returns cached credentials when still valid, else fetches fresh ones.
|
|
func (p *IMDSProvider) Retrieve(ctx context.Context) (Credentials, error) {
|
|
creds, err := p.cache.Retrieve(ctx)
|
|
if err != nil {
|
|
return Credentials{}, err
|
|
}
|
|
return Credentials{
|
|
AccessKeyID: creds.AccessKeyID,
|
|
SecretAccessKey: creds.SecretAccessKey,
|
|
SessionToken: creds.SessionToken,
|
|
Expiration: creds.Expires,
|
|
}, nil
|
|
}
|