From 4308433bded06156f6bc36860b664ec295186257 Mon Sep 17 00:00:00 2001 From: Conrado Miranda Date: Fri, 9 Jul 2021 16:17:17 -0700 Subject: [PATCH 1/4] Add s3-specific credentials --- pkg/buildcontext/s3.go | 3 +++ pkg/constants/constants.go | 6 ++++-- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/pkg/buildcontext/s3.go b/pkg/buildcontext/s3.go index b0880636fe..b01f5457b2 100644 --- a/pkg/buildcontext/s3.go +++ b/pkg/buildcontext/s3.go @@ -27,6 +27,7 @@ import ( "github.com/GoogleContainerTools/kaniko/pkg/util" "github.com/GoogleContainerTools/kaniko/pkg/util/bucket" "github.com/aws/aws-sdk-go/aws" + "github.com/aws/aws-sdk-go/aws/credentials" "github.com/aws/aws-sdk-go/aws/session" "github.com/aws/aws-sdk-go/service/s3" "github.com/aws/aws-sdk-go/service/s3/s3manager" @@ -56,6 +57,8 @@ func (s *S3) UnpackTarFromBuildContext() (string, error) { option.Config = aws.Config{ Endpoint: aws.String(endpoint), S3ForcePathStyle: aws.Bool(forcePath), + DisableSSL: aws.Bool(true), + Credentials: credentials.NewStaticCredentials(os.Getenv(constants.S3StaticAccessKey), os.Getenv(constants.S3StaticSecret), ""), } } sess, err := session.NewSessionWithOptions(option) diff --git a/pkg/constants/constants.go b/pkg/constants/constants.go index 658918a950..abc48cb3d8 100644 --- a/pkg/constants/constants.go +++ b/pkg/constants/constants.go @@ -56,8 +56,10 @@ const ( Dockerignore = ".dockerignore" // S3 Custom endpoint ENV name - S3EndpointEnv = "S3_ENDPOINT" - S3ForcePathStyle = "S3_FORCE_PATH_STYLE" + S3EndpointEnv = "S3_ENDPOINT" + S3ForcePathStyle = "S3_FORCE_PATH_STYLE" + S3StaticAccessKey = "S3_STATIC_ACCESS_KEYID" + S3StaticSecret = "S3_STATIC_ACCESS_SECRET" ) // ScratchEnvVars are the default environment variables needed for a scratch image. From 3d28379d2f181bc017a6cedd55af7f7177e1faf4 Mon Sep 17 00:00:00 2001 From: Conrado Miranda Date: Mon, 26 Jul 2021 17:19:37 -0700 Subject: [PATCH 2/4] Add support for s3 host --- pkg/buildcontext/s3.go | 32 +++++++++++++++++++++++++++++++- pkg/constants/constants.go | 1 + 2 files changed, 32 insertions(+), 1 deletion(-) diff --git a/pkg/buildcontext/s3.go b/pkg/buildcontext/s3.go index b01f5457b2..a3dab34c18 100644 --- a/pkg/buildcontext/s3.go +++ b/pkg/buildcontext/s3.go @@ -18,9 +18,11 @@ package buildcontext import ( "fmt" + "github.com/aws/aws-sdk-go/aws/request" "os" "path/filepath" "strings" + "time" kConfig "github.com/GoogleContainerTools/kaniko/pkg/config" "github.com/GoogleContainerTools/kaniko/pkg/constants" @@ -29,6 +31,7 @@ import ( "github.com/aws/aws-sdk-go/aws" "github.com/aws/aws-sdk-go/aws/credentials" "github.com/aws/aws-sdk-go/aws/session" + signer "github.com/aws/aws-sdk-go/aws/signer/v4" "github.com/aws/aws-sdk-go/service/s3" "github.com/aws/aws-sdk-go/service/s3/s3manager" ) @@ -65,7 +68,34 @@ func (s *S3) UnpackTarFromBuildContext() (string, error) { if err != nil { return bucket, err } - downloader := s3manager.NewDownloader(sess) + + s3Client := s3.New(sess) + if os.Getenv(constants.S3Host) != "" { + sig := signer.NewSigner(credentials.NewStaticCredentials(os.Getenv(constants.S3StaticAccessKey), os.Getenv(constants.S3StaticSecret), "")) + + s3Client.Handlers.Sign.Clear() + s3Client.Handlers.Sign.PushFront(func(request *request.Request) { + originalHost := request.HTTPRequest.Host + originalHost2 := request.HTTPRequest.URL.Host + defer func() { + request.HTTPRequest.Host = originalHost + request.HTTPRequest.URL.Host = originalHost2 + }() + request.HTTPRequest.Host = os.Getenv(constants.S3Host) + request.HTTPRequest.URL.Host = os.Getenv(constants.S3Host) + region := "us-east-1" + if os.Getenv("AWS_REGION") != "" { + region = os.Getenv("AWS_REGION") + } + t := time.Now() + _, err := sig.Sign(request.HTTPRequest, request.Body, "s3", region, t) + if err != nil { + panic(err) + return + } + }) + } + downloader := s3manager.NewDownloaderWithClient(s3Client) directory := kConfig.BuildContextDir tarPath := filepath.Join(directory, constants.ContextTar) if err := os.MkdirAll(directory, 0750); err != nil { diff --git a/pkg/constants/constants.go b/pkg/constants/constants.go index abc48cb3d8..a172122ae5 100644 --- a/pkg/constants/constants.go +++ b/pkg/constants/constants.go @@ -60,6 +60,7 @@ const ( S3ForcePathStyle = "S3_FORCE_PATH_STYLE" S3StaticAccessKey = "S3_STATIC_ACCESS_KEYID" S3StaticSecret = "S3_STATIC_ACCESS_SECRET" + S3Host = "S3_HOST" ) // ScratchEnvVars are the default environment variables needed for a scratch image. From f3f817e12714b0333951749e2ad7d0101426b5c8 Mon Sep 17 00:00:00 2001 From: Conrado Miranda Date: Mon, 26 Jul 2021 17:57:46 -0700 Subject: [PATCH 3/4] Update handlers --- pkg/buildcontext/s3.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkg/buildcontext/s3.go b/pkg/buildcontext/s3.go index a3dab34c18..e3c781f197 100644 --- a/pkg/buildcontext/s3.go +++ b/pkg/buildcontext/s3.go @@ -73,8 +73,8 @@ func (s *S3) UnpackTarFromBuildContext() (string, error) { if os.Getenv(constants.S3Host) != "" { sig := signer.NewSigner(credentials.NewStaticCredentials(os.Getenv(constants.S3StaticAccessKey), os.Getenv(constants.S3StaticSecret), "")) - s3Client.Handlers.Sign.Clear() - s3Client.Handlers.Sign.PushFront(func(request *request.Request) { + //s3Client.Handlers.Sign.Clear() + s3Client.Handlers.Sign.PushBack(func(request *request.Request) { originalHost := request.HTTPRequest.Host originalHost2 := request.HTTPRequest.URL.Host defer func() { From e493384d9472c66739e75e9492d918c20c54cc8a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 14 Oct 2022 17:53:58 +0000 Subject: [PATCH 4/4] chore(deps): bump ossf/scorecard-action from 1.1.1 to 2.0.4 Bumps [ossf/scorecard-action](https://github.com/ossf/scorecard-action) from 1.1.1 to 2.0.4. - [Release notes](https://github.com/ossf/scorecard-action/releases) - [Changelog](https://github.com/ossf/scorecard-action/blob/main/RELEASE.md) - [Commits](https://github.com/ossf/scorecard-action/compare/3e15ea8318eee9b333819ec77a36aca8d39df13e...e363bfca00e752f91de7b7d2a77340e2e523cb18) --- updated-dependencies: - dependency-name: ossf/scorecard-action dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/scorecards-analysis.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecards-analysis.yml b/.github/workflows/scorecards-analysis.yml index 6ada8c2828..e534d37aea 100644 --- a/.github/workflows/scorecards-analysis.yml +++ b/.github/workflows/scorecards-analysis.yml @@ -26,7 +26,7 @@ jobs: persist-credentials: false - name: "Run analysis" - uses: ossf/scorecard-action@3e15ea8318eee9b333819ec77a36aca8d39df13e + uses: ossf/scorecard-action@e363bfca00e752f91de7b7d2a77340e2e523cb18 with: results_file: results.sarif results_format: sarif