S3 auth via AWS profile / boto3 credential chain - #2
Open
realyota wants to merge 2 commits into
Open
Conversation
Add --s3auth=aws and --s3profile so s3gc can resolve temporary session-token credentials (e.g. from AWS SSO) instead of static keys; --s3-session-token for explicit temporary credentials
Member
|
Thanks @realyota I'll integrate the PR change into the feature branch because it has a testing suite and I can check for errors easily. |
lesandie
added a commit
that referenced
this pull request
Aug 6, 2026
Integrates #2 by @realyota, which added --s3auth=aws, --s3profile and --s3-session-token so credentials can come from the boto3 chain (AWS SSO) or as explicit temporary credentials. Merged here rather than into master first. Both branches share the same merge-base, so the conflicts are identical either way and ordering saves no work — but the CI workflow on this branch publishes a public image on every push to master, and PR #2 inherits master's unpinned dependencies. Merging it to master first would have published a public image with jsonargparse unpinned, which resolves to 4.50.x and fails at import. Resolving here also lets the 62-test suite and the Job runner validate the result first. Three resolutions were substantive rather than textual: PR #2 removed --s3useiam and IamAwsProvider, replacing workload identity with the boto3 chain. Both are kept, because they are not interchangeable: iam mode needs no boto3 and hands MinIO the credential *provider* rather than frozen keys, so credentials refresh across a long collect or delete. It is also what the validated Kubernetes deployments use. --s3auth now takes static|aws|iam, --s3profile implies aws, and --s3useiam is a deprecated alias for iam that still works with a warning, so existing manifests and Secrets are unaffected. Contradictory combinations are rejected instead of silently resolved. PR #2's Minio() call reverted the http_client to a bare PoolManager. That is the construct that hung a production run for 2h19m with no error, so the timeout/retry PoolManager and the reconnect helper are preserved, with a test asserting iam mode still gets them. Both branches defined strtobool. Ours is kept, since coerce_bool builds on it; PR #2's duplicate is dropped. Also kept from PR #2: UserVisibleError, the listing error that names the required s3:ListBucket permission and the aws CLI commands to verify it, and the widened log-secret filter. Adds what PR #2 did not include: Kubernetes wiring for the new flags (they were unreachable from a Job), pinned boto3==1.43.65, and 19 regression tests covering every mode, the implied-mode rules, the contradiction errors, the missing-boto3 path and the preserved transport. Co-Authored-By: realyota <realyota@users.noreply.github.com> Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add
--s3auth=awsand--s3profileso s3gc can resolve temporary session-token credentials (e.g. from AWS SSO) instead of static keys;--s3-session-tokenfor explicit temporary credentials