-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Move to new repo to get fresh start. Starting on v1.0.0
- Loading branch information
1 parent
fd85781
commit cddf575
Showing
5 changed files
with
149 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,59 @@ | ||
name: Create and publish a container image | ||
|
||
on: | ||
push: | ||
branches: [ "main" ] | ||
# Publish semver tags as releases. | ||
tags: [ 'v*.*.*' ] | ||
pull_request: | ||
branches: [ "main" ] | ||
|
||
env: | ||
REGISTRY: ghcr.io | ||
# github.repository as <account>/<repo> | ||
IMAGE_NAME: ${{ github.repository }} | ||
jobs: | ||
build: | ||
runs-on: ubuntu-latest | ||
permissions: | ||
contents: read | ||
packages: write | ||
# This is used to complete the identity challenge | ||
# with sigstore/fulcio when running outside of PRs. | ||
id-token: write | ||
steps: | ||
- name: Checkout repository | ||
uses: actions/checkout@v4 | ||
# Set up BuildKit Docker container builder to be able to build | ||
# multi-platform images and export cache | ||
# https://github.com/docker/setup-buildx-action | ||
- name: Set up Docker Buildx | ||
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0 | ||
# Login against a Docker registry except on PR | ||
# https://github.com/docker/login-action | ||
- name: Log into registry ${{ env.REGISTRY }} | ||
if: github.event_name != 'pull_request' | ||
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 | ||
with: | ||
registry: ${{ env.REGISTRY }} | ||
username: ${{ github.actor }} | ||
password: ${{ secrets.GITHUB_TOKEN }} | ||
# Extract metadata (tags, labels) for Docker | ||
# https://github.com/docker/metadata-action | ||
- name: Extract Docker metadata | ||
id: meta | ||
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0 | ||
with: | ||
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | ||
# Build and push Docker image with Buildx (don't push on PR) | ||
# https://github.com/docker/build-push-action | ||
- name: Build and push Docker image | ||
id: build-and-push | ||
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0 | ||
with: | ||
context: . | ||
push: ${{ github.event_name != 'pull_request' }} | ||
tags: ${{ steps.meta.outputs.tags }} | ||
labels: ${{ steps.meta.outputs.labels }} | ||
cache-from: type=gha | ||
cache-to: type=gha,mode=max |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,12 @@ | ||
FROM ubuntu:jammy | ||
|
||
RUN apt update && apt install -y wget curl && apt clean | ||
|
||
ARG HELPER_VERSION=1.1.1 | ||
RUN set -e \ | ||
&& curl -o /usr/bin/aws_signing_helper --fail https://rolesanywhere.amazonaws.com/releases/${HELPER_VERSION}/X86_64/Linux/aws_signing_helper \ | ||
&& chmod +x /usr/bin/aws_signing_helper | ||
|
||
COPY entrypoint.sh /entrypoint.sh | ||
|
||
ENTRYPOINT /entrypoint.sh |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,3 @@ | ||
|
||
build: | ||
@podman build --platform linux/amd64 . -t aws-signing-helper |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1 +1,46 @@ | ||
# aws-signing-helper | ||
# aws-signing-helper | ||
|
||
Inspired by [josh23french/iam-roles-anywhere-sidecar](https://github.com/josh23french/iam-roles-anywhere-sidecar) | ||
|
||
Uses [aws/rolesanywhere-credential-helper](https://github.com/aws/rolesanywhere-credential-helper) cli instead of building a separate http server. | ||
|
||
## sidecar | ||
|
||
Add it to your own deployment as a sidecar. | ||
|
||
Example: | ||
|
||
```yaml | ||
spec: | ||
containers: | ||
- env: | ||
- name: PRIVATE_KEY | ||
value: /certificates/MyService.key.pem | ||
- name: CERTIFICATE | ||
value: /certificates/MyService.crt.pem | ||
- name: ROLE_ARN | ||
value: arn:aws:iam::123456789012:role/MyRole | ||
- name: PROFILE_ARN | ||
value: arn:aws:rolesanywhere:eu-west-1:123456789012:profile/e7acdea9-3c21-42ab-affc-c448b69eee1b | ||
- name: TRUST_ANCHOR_ARN | ||
value: arn:aws:rolesanywhere:eu-west-1:123456789012:trust-anchor/ee461377-7abd-428f-bc04-ff99b7538920 | ||
- name: DEBUG | ||
value: "false" | ||
image: ghcr.io/ehlomarcus/aws-signin-helper:v1.0.0 | ||
imagePullPolicy: IfNotPresent | ||
name: iam-helper | ||
resources: | ||
requests: | ||
cpu: 100m | ||
memory: 128Mi | ||
``` | ||
Next you need to add this ENV to your application container. Using this ENV will allow your application (aws-sdk) to discover credentials. | ||
```yaml | ||
spec: | ||
containers: | ||
- env: | ||
- name: AWS_EC2_METADATA_SERVICE_ENDPOINT | ||
value: http://localhost:8081/ | ||
``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,29 @@ | ||
#!/usr/bin/env bash | ||
set -e | ||
|
||
if [ -z $PORT ] | ||
then | ||
PORT="8081" | ||
fi | ||
|
||
if [ -z $SESSION_DURATION ] | ||
then | ||
SESSION_DURATION="3600" | ||
fi | ||
|
||
if [ -z $REGION ] | ||
then | ||
REGION="eu-west-1" | ||
fi | ||
|
||
if [ -z $ENDPOINT ] | ||
then | ||
ENDPOINT="rolesanywhere.eu-west-1.amazonaws.com" | ||
fi | ||
|
||
if [ -z $DEBUG ] | ||
then | ||
DEBUG=false | ||
fi | ||
|
||
aws_signing_helper serve --port $PORT --certificate $CERTIFICATE --private-key $PRIVATE_KEY --trust-anchor-arn $TRUST_ANCHOR_ARN --profile-arn $PROFILE_ARN --role-arn $ROLE_ARN --endpoint $ENDPOINT --region $REGION --debug $DEBUG |