Skip to content

017, 018: AWS KMS credentials config restructure & EKS workload authentication#97

Merged
robobario merged 5 commits intokroxylicious:mainfrom
oleksiyp:017-aws-kms-eks-auth
Apr 21, 2026
Merged

017, 018: AWS KMS credentials config restructure & EKS workload authentication#97
robobario merged 5 commits intokroxylicious:mainfrom
oleksiyp:017-aws-kms-eks-auth

Conversation

@oleksiyp
Copy link
Copy Markdown
Contributor

@oleksiyp oleksiyp commented Apr 13, 2026

Summary

Two design proposals for the AWS KMS Record Encryption filter:

  • 017 — Credentials config restructure: Groups all credential providers under a single credentials YAML node (credentials.longTerm, credentials.ec2Metadata, etc.) instead of flat top-level fields. Backward compatible — existing longTermCredentials / ec2MetadataCredentials YAML keeps working via migration in the record's compact constructor.

  • 018 — EKS workload authentication (IRSA & Pod Identity): Adds two new credential providers for Amazon EKS pods. IRSA exchanges a projected OIDC token via STS AssumeRoleWithWebIdentity; Pod Identity calls the local Pod Identity Agent. Both return temporary credentials compatible with the existing SigV4 signing. Includes extraction of a shared async-refresh base class from Ec2MetadataCredentialsProvider. Depends on 017 for config structure.

Prompted by review feedback on the implementation PR kroxylicious/kroxylicious#3684.

References: kroxylicious/kroxylicious#1295, kroxylicious/kroxylicious#3684

🤖 Generated with Claude Code

@oleksiyp @claude
017, 018: AWS KMS credentials config restructure & EKS auth
0e0575d 
017 - restructure AWS KMS config to group credential providers under a
      `credentials` node, with backward compat for existing flat fields

018 - add IRSA (AssumeRoleWithWebIdentity) and EKS Pod Identity
      credential providers, with shared async refresh base class

References: kroxylicious/kroxylicious#1295, kroxylicious/kroxylicious#3684

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Oleksiy Pylypenko <oleksiy.pylypenko@gmail.com>
@oleksiyp oleksiyp requested a review from a team as a code owner April 13, 2026 09:02
@oleksiyp oleksiyp mentioned this pull request Apr 13, 2026
Merged
6 tasks
SamBarker added a commit to SamBarker/kroxylicious-design that referenced this pull request Apr 13, 2026
@SamBarker
Renumber proposal from 017 to 019
f747944 
017 and 018 were claimed by PR kroxylicious#97.

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>

Signed-off-by: Sam Barker <sbarker@redhat.com>
Signed-off-by: Sam Barker <sam@quadrocket.co.uk>
oleksiyp added a commit to oleksiyp/kroxylicious that referenced this pull request Apr 13, 2026
@oleksiyp @claude
feat(aws-kms): credentials config restructure + Pod Identity provider
6b18b72 
Restructure AWS KMS configuration to group all credential providers
under a `credentials` node (CredentialsConfig record). Existing
top-level `longTermCredentials` and `ec2MetadataCredentials` keys
remain as deprecated backward-compatible aliases — the compact
constructor silently migrates them into the `credentials` node.

Add EKS Pod Identity credential provider that retrieves temporary
credentials from the local Pod Identity Agent endpoint. Falls back
to AWS_CONTAINER_CREDENTIALS_FULL_URI and
AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE environment variables.

Design proposal: kroxylicious/design#97

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Oleksiy Pylypenko <oleksiy.pylypenko@gmail.com>
robobario
robobario reviewed Apr 14, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@robobario robobario left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @oleksiyp great to have your proposal, support for EKS auth would be brilliant to have.

Have put up some points, mostly asking for elaboration on the new config options. Also a paragraph of justification for using environment variables would be great as we have so far preferred explicit YAML configuration.

@k-wall is also expert in the AWS KMS so keen for him to take a look.

Comment thread proposals/018-aws-kms-eks-authentication.md
Comment thread proposals/018-aws-kms-eks-authentication.md
Comment thread proposals/018-aws-kms-eks-authentication.md
Comment thread proposals/018-aws-kms-eks-authentication.md
Comment thread proposals/018-aws-kms-eks-authentication.md Outdated
Comment thread proposals/018-aws-kms-eks-authentication.md Outdated
Comment thread proposals/018-aws-kms-eks-authentication.md
@robobario robobario requested a review from k-wall April 14, 2026 00:08
@oleksiyp @claude
018: address review feedback — config tables, descriptions, env var j…
d711ee5 
…ustification

- Add comprehensive config options tables for IRSA and Pod Identity
  with field descriptions, defaults, and env var fallbacks
- Add fail-fast documentation (KmsException at construction time)
- Add paragraph justifying env var defaults (platform-injected values,
  separation of concerns, AWS SDK convention)
- Document durationSeconds range (900-43200), roleSessionName default
  and regex, stsEndpointUrl derivation, credentialLifetimeFactor behavior

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Oleksiy Pylypenko <oleksiy.pylypenko@gmail.com>
@oleksiyp
Copy link
Copy Markdown
Contributor Author

oleksiyp commented Apr 14, 2026

@robobario addressed comments you provided in d711ee5

SamBarker added a commit to SamBarker/kroxylicious-design that referenced this pull request Apr 14, 2026
@SamBarker
Renumber proposal from 017 to 019
901b875 
017 and 018 were claimed by PR kroxylicious#97.

Assisted-by: Claude Opus 4.6 <noreply@anthropic.com>

Signed-off-by: Sam Barker <sbarker@redhat.com>
Signed-off-by: Sam Barker <sam@quadrocket.co.uk>
robobario
robobario reviewed Apr 15, 2026
View reviewed changes
Comment thread proposals/018-aws-kms-eks-authentication.md Outdated
@oleksiyp @claude
018: drop stsRegion field, derive STS endpoint from Config.region
0558bd8 
Since Config.region is already required in YAML, there is no need for a
separate stsRegion field or AWS_REGION env var fallback. The STS endpoint
is derived as https://sts.<Config.region>.amazonaws.com by default.

stsEndpointUrl remains as an optional override for non-standard
partitions (China: amazonaws.com.cn, ISO: c2s.ic.gov).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Oleksiy Pylypenko <oleksiy.pylypenko@gmail.com>
k-wall
k-wall reviewed Apr 16, 2026
View reviewed changes
Comment thread proposals/017-aws-kms-credentials-config-restructure.md Outdated
k-wall
k-wall approved these changes Apr 16, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@k-wall k-wall left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM - thank you @oleksiyp, both proposals look good to me.

@k-wall
Copy link
Copy Markdown
Member

k-wall commented Apr 16, 2026

@ddaviesbrackett-dwp I know you run Kroxylicious on EC2 so are closer to the issues than me. If you have bandwidth would you mind reviewing?

@oleksiyp @claude
017: fix rejected alternative — reference deprecation policy
c6c5fad 
Per k-wall's review, the project has a deprecation policy even pre-1.0,
so "nominally acceptable breaking changes" was incorrect framing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Oleksiy Pylypenko <oleksiy.pylypenko@gmail.com>
@oleksiyp
Copy link
Copy Markdown
Contributor Author

oleksiyp commented Apr 17, 2026

@robobario do you have any other requests to fix in this proposals?

@robobario
Copy link
Copy Markdown
Member

robobario commented Apr 19, 2026

nope, looks good to me thank you! I'll put a call out on the dev list to see if anyone else wants to review it, else will merge it in 24 hours.

tombentley
tombentley reviewed Apr 19, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@tombentley tombentley left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this! It basically LGTM.

Claude found a few minor points which we can improve. They're mostly just clarifying the proposal itself, not changing what's being proposed.

Thanks again.

Comment thread proposals/018-aws-kms-eks-authentication.md Outdated
Comment thread proposals/018-aws-kms-eks-authentication.md
Comment thread proposals/018-aws-kms-eks-authentication.md Outdated
Comment thread proposals/018-aws-kms-eks-authentication.md Outdated
Comment thread proposals/018-aws-kms-eks-authentication.md
Comment thread proposals/018-aws-kms-eks-authentication.md Outdated
Comment thread proposals/018-aws-kms-eks-authentication.md Outdated
Comment thread proposals/018-aws-kms-eks-authentication.md
Comment thread proposals/018-aws-kms-eks-authentication.md
@oleksiyp @claude
018: address tombentley review feedback
83ee98d 
- Acknowledge Accept: application/json is undocumented in STS API
- Add IAM permissions note for assumed role
- Add durationSeconds effective maximum (role MaxSessionDuration)
- Add credentialLifetimeFactor valid range (0, 1)
- Extend fail-fast to validate roleSessionName regex and durationSeconds
- Add Pod Identity trust boundary note (link-local HTTP, same as IMDS)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Oleksiy Pylypenko <oleksiy.pylypenko@gmail.com>
@oleksiyp
Copy link
Copy Markdown
Contributor Author

oleksiyp commented Apr 20, 2026

@tombentley checked comments and fixed what makes sense to me in 83ee98d

tombentley
tombentley approved these changes Apr 20, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@tombentley tombentley left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Many thanks @oleksiyp

@oleksiyp
Copy link
Copy Markdown
Contributor Author

oleksiyp commented Apr 21, 2026

@robobario can you please merge?

@robobario robobario merged commit 64812b4 into kroxylicious:main Apr 21, 2026
1 check passed
@robobario
Copy link
Copy Markdown
Member

robobario commented Apr 21, 2026

Done, thanks for that!

@oleksiyp oleksiyp deleted the 017-aws-kms-eks-auth branch April 21, 2026 20:22
oleksiyp added a commit to oleksiyp/kroxylicious that referenced this pull request Apr 21, 2026
@oleksiyp @claude
feat(aws-kms): credentials config restructure + Pod Identity provider
934a834 
Restructure AWS KMS configuration to group all credential providers
under a `credentials` node (CredentialsConfig record). Existing
top-level `longTermCredentials` and `ec2MetadataCredentials` keys
remain as deprecated backward-compatible aliases — the compact
constructor silently migrates them into the `credentials` node.

Add EKS Pod Identity credential provider that retrieves temporary
credentials from the local Pod Identity Agent endpoint. Falls back
to AWS_CONTAINER_CREDENTIALS_FULL_URI and
AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE environment variables.

Design proposal: kroxylicious/design#97

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Oleksiy Pylypenko <oleksiy.pylypenko@gmail.com>
k-wall pushed a commit to oleksiyp/kroxylicious that referenced this pull request Apr 22, 2026
@oleksiyp @claude @k-wall
feat(aws-kms): credentials config restructure + Pod Identity provider
f73d2b6 
Restructure AWS KMS configuration to group all credential providers
under a `credentials` node (CredentialsConfig record). Existing
top-level `longTermCredentials` and `ec2MetadataCredentials` keys
remain as deprecated backward-compatible aliases — the compact
constructor silently migrates them into the `credentials` node.

Add EKS Pod Identity credential provider that retrieves temporary
credentials from the local Pod Identity Agent endpoint. Falls back
to AWS_CONTAINER_CREDENTIALS_FULL_URI and
AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE environment variables.

Design proposal: kroxylicious/design#97

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Oleksiy Pylypenko <oleksiy.pylypenko@gmail.com>
@github-project-automation github-project-automation Bot moved this from Must Do to Done in Release 0.21.0 Apr 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tombentley tombentley tombentley approved these changes

@robobario robobario robobario approved these changes

@k-wall k-wall k-wall approved these changes

Assignees

No one assigned

Labels

None yet

Projects

Release 0.21.0
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@oleksiyp @k-wall @robobario @tombentley