Add EKSProvider for AWS credentials using Pod Identity agent and integrate into AWSCredentialProvider chain #2146
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This pull request introduces a new EKSProvider to the AWS credential provider chain in the MongoDB Go driver. The EKSProvider enables the driver to retrieve AWS credentials from the endpoint specified by the AWS_CONTAINER_CREDENTIALS_FULL_URI environment variable.
Background & Motivation
AWS recently introduced the Pod Identity agent for EKS, which provides IAM credentials to pods via a local HTTP endpoint. The agent sets the AWS_CONTAINER_CREDENTIALS_FULL_URI environment variable in the pod, typically pointing to a URL like http://169.254.170.23/v1/credentials.
The implementation of EKSProvider is essentially similar to the existing ECSProvider, with the main difference being the use of a different environment variable and endpoint for credential retrieval. This change ensures the driver can authenticate seamlessly in EKS environments using Pod Identity.
AWS SDK: Container Credentials
Pod Identity Agent