class Kubeclient::AmazonEksCredentials

Get a bearer token to authenticate against aws eks.

Public Class Methods

token(credentials, eks_cluster, region: 'us-east-1') click to toggle source
# File lib/kubeclient/aws_eks_credentials.rb, line 10
def token(credentials, eks_cluster, region: 'us-east-1')
  begin
    require 'aws-sigv4'
    require 'base64'
    require 'cgi'
  rescue LoadError => e
    raise AmazonEksDependencyError,
          'Error requiring aws gems. Kubeclient itself does not include the following ' \
          'gems: [aws-sigv4]. To support auth-provider eks, you must ' \
          "include it in your calling application. Failed with: #{e.message}"
  end
  # https://github.com/aws/aws-sdk-ruby/pull/1848
  # Get a signer
  signer = if credentials.respond_to?(:credentials)
             Aws::Sigv4::Signer.new(
               service: 'sts',
               region: region,
               credentials_provider: credentials
             )
           else
             Aws::Sigv4::Signer.new(
               service: 'sts',
               region: region,
               credentials: credentials
             )
           end

  credentials = credentials.credentials if credentials.respond_to?(:credentials)

  # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/Sigv4/Signer.html#presign_url-instance_method
  presigned_url_string = signer.presign_url(
    http_method: 'GET',
    url: "https://sts.#{region}.amazonaws.com/?Action=GetCallerIdentity&Version=2011-06-15",
    body: '',
    credentials: credentials,
    expires_in: 60,
    headers: {
      'X-K8s-Aws-Id' => eks_cluster
    }
  )
  kube_token = 'k8s-aws-v1.' + Base64.urlsafe_encode64(presigned_url_string.to_s).sub(/=*$/, '') # rubocop:disable Metrics/LineLength
  kube_token
end