Update docker image?

[jcpetruzza]

The latest official docker image (0.9) appears to be a year old. Since then, the aws-sdk-go has added support for assuming roles via webtokens. This is necessary in order to run aws-es-proxy on kubernetes via AWS EKS using the native support for IAM roles.

Building against a newer version of aws-sdk-go should be enough to support this, I think, so creating a new official image could be a good idea?

[jcpetruzza]

Just saw #61 which would need to be merged first!

[abutaha]

Will have a look and update the docker image.

[jcpetruzza]

Thanks! Since you are on it, would you consider merging #40 as well? We are using using aws-es-proxy via the fluentd-elasticsearch helm chart on EKS, and had to end up using a custom image with both #61 and #40 applied. The latter was to actually see some errors when the IAM role was misconfigured! 😄

[abutaha]

This has been fixed in the new commit to master today. I will soon release a new docker image containing the latest code.

[ojundt]

Having IRSA support would be great! Any news on integrating that feature?

[codyja]

Would like to give this a try with the later aws-sdk-go version that supports IAM on EKS. Thanks!

[abutaha]

@ojundt version 1.1 has IRSA included, can you give it a try?
@codyja I'm using aws-sdk-go v1.30.4 which I think has the support, however, I will update the sdk and release a new version this week.

[ojundt]

@abutaha version 1.1 with IRSA works like a charm. Thank you!

[diego-ojeda-binbash]

Hi @ojundt , could you help me understand how to run aws-es-proxy in order to get it working with IRSA? I'm struggling a bit to make it run. Are you deploying aws-es-proxy through a YAML manifest via kubectl? Are you using a chart? What parameters do you pass to either of those to make it work? Thanks!

[diego-ojeda-binbash]

In case it helps somebody else I managed to get it working on AWS EKS by providing the following environment variables to the aws-es-proxy pod:

• AWS_ROLE_ARN => arn:aws:iam::[ACCOUNT_ID]:role/[ROLE_NAME]
• AWS_WEB_IDENTITY_TOKEN_FILE: /var/run/secrets/eks.amazonaws.com/serviceaccount/token

The service account needs to be annotated with eks.amazonaws.com/role-arn so that EKS creates the token in the file specified above.
Also, you are providing a role ARN which belongs to an actual role, such role needs to be granted access to AWS ES through a policy in order for this to work.