Document S3 environment credential resolution - #207
Open
fffinkel wants to merge 1 commit into
Open
Conversation
The S3 provider section only showed static credentials, so there was no indication that omitting the access key and secret key makes the api server resolve credentials from its environment instead. Add an Authentication subsection describing both credential modes, the resolution order, when resolution happens, and the fact that EKS Pod Identity is not supported. Signed-off-by: Matt Finkel <finkel.matt@gmail.com>
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
The S3 provider section of
docs/reference/configuration/file-storage.mdshowed static credentials as the only option:Nothing told an AWS reader that omitting both properties makes the api server resolve credentials from its environment. This adds an "Authentication" subsection describing both credential modes, the resolution order, when resolution happens, and the fact that EKS Pod Identity is not supported.
Depends on
This documents behavior introduced by DependencyTrack/dependency-track#6851, which is not merged yet. Please do not merge this before that change lands, or the page will describe behavior the api server does not have.
Additional details
properties.mdis deliberately untouched. The api server change also editsapplication.properties, so the generated property descriptions fordt.file-storage.s3.access-keyanddt.file-storage.s3.secret-keyare now stale. PerAGENTS.mdI did not hand-edit a generated file, and theUpdate config docsworkflow regenerates it once the api server change merges. Say the word if you would rather I runmake generate-config-docsand include the result here.Diataxis. This is a reference page, so the new section only describes. The reasoning for the change, and the argument for preferring roles over long-lived keys, is deliberately left out. That belongs in Concepts, or in the follow-up section of ADR-004 in the api server repo, where I recorded it.
Pod Identity exclusion. Worth stating explicitly rather than leaving readers to infer it from silence. The api server's S3 client does not read the token file the Pod Identity Agent provides, and it rejects the agent's endpoint because that address is not a loopback address.
Verification
make lint-markdownreports 0 errors across 106 files.make lint-prosereports 0 errors for this page. Three warnings remain, all on pre-existing lines I did not touch (is selected,multiple,will). The passive-voice warnings my own additions triggered are fixed.make buildcompletes a strict build with no errors, and the newproperties.md#...anchor links all resolve.