refactor(aws-lambda): refactor aws-lambda plugin code with lua-resty-aws #11350

windmgc · 2023-08-03T08:38:10Z

Summary

This PR refactors the aws-lambda plugin by using the lua-resty-aws library.

Refactoring the aws-lambda plugin can provide Kong with multiple aspects of benefits:

Simplifying the code base and avoiding maintaining IAM-based authenticating code and AWS service request signing code inside the lambda plugin.
Doing IAM-based authenticating automatically on multiple scenarios(based on Environment variables, shared aws config/credential files, EC2 IMDS metadata service, ECS container endpoint, EKS IRSA, etc.). Before this PR, some of these were not supported by the aws-lambda.
Obtaining a more similar behaviour to other mainstream AWS SDKs, such as gaining support for additional AWS-related environment variable configurations.

Please note that the AWS authentication-related code and tests are removed because we no longer need them after the change, and all of the previous plugin's functional tests should pass after the change because there is no actual behavior-breaking change in this PR.

Checklist

The Pull Request has tests
There's an entry in the CHANGELOG
There is a user-facing docs PR against https://github.com/Kong/docs.konghq.com - PUT DOCS PR HERE

Full changelog

Add lua-resty-aws as a dependency in Kong's rockspec.
Add libexpat as a dependency into the Bazel build process.
Remove Kong's implementation of fetching EC2 IMDS/ECS IAM role credential code, and remove fetching STS temporary credential code.
Remove Kong's implementation of the AWS v4 request signing code.
Re-implementing the credential fetching code in the aws-lambda plugin.
Re-implementing the Lambda service invoking code in the aws-lambda plugin.
Cleaning and re-arranging some other code blocks.

Issue reference

#7638

KAG-1386
FTI-5242
FTI-5206

windmgc · 2023-08-09T02:16:22Z

kong/db/dao/plugins.lua

@@ -355,5 +355,29 @@ function Plugins:get_handlers()
  return list
 end

+function Plugins:execute_plugin_init()


@bungle I'm trying to add support for plugins executing their own code in the init phase, so that plugins can do things that may contain yield which cannot be done inside a require. I'm adding an execute_plugin_init function to achieve that. How do you feel about this? Is it a proper way or any advice?

my 2cts: in the "global patches", replace require with a pure-Lua version. Since this has been a recurring theme for a long time. That would solve a bunch of initialization problems due to "yield across C-boundary" issues.

#11177 (review)
Leaving a note here: this is the discussion on the same topic. Apparently needs some works to be done to achieve that. If we can achieve that it'll be a painkiller for the restriction of not able to do any yield-able thing in module level

windmgc · 2023-08-09T03:30:34Z

Tests need lua-resty-aws library version bumping(after merging Kong/lua-resty-aws#71) to make itself pass. Manually tests passed

…cies into rockspec and bazel configs The commit introduces latest version of lua-resty-aws as Kong's dependency. Since lua-resty-aws relies on luaexpat to do xml decoding, Kong also needs to build libexpat during compiling/packaging.

The commits rewrite part of the aws-lambda plugin code so that the IAM role credential fetching is replaced by using lua-resty-aws credential provider.

This commits does refactoring on the majority of the aws-lambda plugin code. The IAM role credential fetching and lambda function invoking has been replaced by using the lua-resty-aws library directly.

Makefile

hanshuebner

Why is the expat dependency now needed?

The test coverage seems to only be reduced in this PR, even though we're adding features. How do we verify that the new features provided by lua-resty-aws actually work when using the aws-lambda plugin?

Please update the PR description accordingly. If no tests are needed because we have enough coverage, this should also be mentioned.

windmgc · 2023-08-14T09:24:57Z

Why is the expat dependency now needed?

We now need libexpat as a runtime dependency of luaexpat, which is the lua library used in the lua-resty-aws now to do XML parsing(to replace deprecated pl.xml).

The test coverage seems only to be reduced in this PR, even though we're adding features. How do we verify that the new features provided by lua-resty-aws actually work when using the aws-lambda plugin?

Only those AWS-authenticating related codes and tests are removed because we no longer need them after the PR's change. Other remaining tests should pass without any problem, and I think we already have enough coverage on those. I'm still waiting to get a lua-resty-aws library new version bumping to make all tests green in this PR.

Speaking of the authenticating feature, it's a good point, I'd also like new tests that cover the authenticating feature included in this PR as well, but simulating the way that AWS does authenticating is quite complex in a CI environment. (I'm doing some experiments at https://github.com/Kong/kong-ee/pull/5916, and hopefully if it works well I can add similar things to OSS repo as well)

I've updated the PR description to explain the tests related issue.

…aws (#11350) * refactor(aws-lambda): add lua-resty-aws library and libexpat dependencies into rockspec and bazel configs The commit introduces latest version of lua-resty-aws as Kong's dependency. Since lua-resty-aws relies on luaexpat to do xml decoding, Kong also needs to build libexpat during compiling/packaging. * refactor(aws-lambda): use lua-resty-aws and rewrite fetch credential The commits rewrite part of the aws-lambda plugin code so that the IAM role credential fetching is replaced by using lua-resty-aws credential provider. * refactor(aws-lambda): refactor aws-lambda plugin This commits does refactoring on the majority of the aws-lambda plugin code. The IAM role credential fetching and lambda function invoking has been replaced by using the lua-resty-aws library directly. * style(*): remove useless lua file * fix(cd): fix explain manifest for libexpat * fix(cd): fix buildifier style * fix(*): try to fix lambda plugin init_worker * fix(*): fix http proxy & sts regional endpoint config * fix(*): execute plugin init code correctly * fix(*): remove lambda returned content length * chore(*): move libexpat from cross_deps to standalone repo * fix(*): do not override global config credential * chore(*): remove non-debug flag * chore(*): bump lua-resty-aws version to 1.3.0

pull-request-size bot added the size/XXL label Aug 3, 2023

github-actions bot assigned windmgc Aug 3, 2023

github-actions bot added plugins/aws-lambda build/bazel labels Aug 3, 2023

windmgc force-pushed the refactor-lambda branch 3 times, most recently from 5c5522f to 6dd44bc Compare August 7, 2023 06:08

github-actions bot added core/db schema-change-noteworthy labels Aug 8, 2023

windmgc commented Aug 9, 2023

View reviewed changes

windmgc marked this pull request as ready for review August 9, 2023 03:30

VicYP requested review from kikito and hanshuebner August 10, 2023 14:57

windmgc added 11 commits August 14, 2023 14:17

refactor(aws-lambda): use lua-resty-aws and rewrite fetch credential

641573a

The commits rewrite part of the aws-lambda plugin code so that the IAM role credential fetching is replaced by using lua-resty-aws credential provider.

refactor(aws-lambda): refactor aws-lambda plugin

b024cf5

This commits does refactoring on the majority of the aws-lambda plugin code. The IAM role credential fetching and lambda function invoking has been replaced by using the lua-resty-aws library directly.

style(*): remove useless lua file

1d6ce58

fix(cd): fix explain manifest for libexpat

d3b6e06

fix(cd): fix buildifier style

4b01d1a

fix(*): try to fix lambda plugin init_worker

b9e5538

fix(*): fix http proxy & sts regional endpoint config

3b9e667

fix(*): execute plugin init code correctly

e6efe72

fix(*): remove lambda returned content length

3859e19

chore(*): move libexpat from cross_deps to standalone repo

5c62561

windmgc force-pushed the refactor-lambda branch from 8e111aa to 5c62561 Compare August 14, 2023 06:27

fix(*): do not override global config credential

75f4c21

fffonion reviewed Aug 14, 2023

View reviewed changes

Makefile Outdated Show resolved Hide resolved

chore(*): remove non-debug flag

c4b2f4f

hanshuebner suggested changes Aug 14, 2023

View reviewed changes

chore(*): bump lua-resty-aws version to 1.3.0

3867bfe

hanshuebner approved these changes Aug 15, 2023

View reviewed changes

hanshuebner merged commit ea85db8 into master Aug 15, 2023
22 checks passed

hanshuebner deleted the refactor-lambda branch August 15, 2023 08:52

This was referenced Aug 16, 2023

fix(aws-lambda): add better type and error handling on proxy integration mode #11413

Merged

Missing feature: Assuming an IAM role via AWS EKS pod identity #7638

Closed

windmgc mentioned this pull request Aug 24, 2023

feat: aws lambda plugin now supports more IAM-based authentication scenarios Kong/docs.konghq.com#6002

Merged

2 tasks

windmgc mentioned this pull request Sep 8, 2023

fix(aws-lambda): remove aws lambda plugin init function #11528

Closed

1 task

This was referenced Sep 9, 2023

fix(aws-lambda): Refactor AWS initialization #11534

Closed

feat(plugins/aws-lambda): support AWS IRSA credentials method #10961

Closed

windmgc mentioned this pull request Nov 3, 2023

[cherry release/3.4.x] backport aws lambda refactor change #11906

Merged

3 tasks

kikito mentioned this pull request Jan 24, 2024

fix(scripts): fix update-copyright in venv and remove unused repos #12413

Closed

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

refactor(aws-lambda): refactor aws-lambda plugin code with lua-resty-aws #11350

refactor(aws-lambda): refactor aws-lambda plugin code with lua-resty-aws #11350

windmgc commented Aug 3, 2023 •

edited

Loading

windmgc Aug 9, 2023

Tieske Sep 7, 2023

windmgc Sep 7, 2023

windmgc commented Aug 9, 2023 •

edited

Loading

hanshuebner left a comment

windmgc commented Aug 14, 2023 •

edited

Loading

refactor(aws-lambda): refactor aws-lambda plugin code with lua-resty-aws #11350

refactor(aws-lambda): refactor aws-lambda plugin code with lua-resty-aws #11350

Conversation

windmgc commented Aug 3, 2023 • edited Loading

Summary

Checklist

Full changelog

Issue reference

windmgc Aug 9, 2023

Choose a reason for hiding this comment

Tieske Sep 7, 2023

Choose a reason for hiding this comment

windmgc Sep 7, 2023

Choose a reason for hiding this comment

windmgc commented Aug 9, 2023 • edited Loading

hanshuebner left a comment

Choose a reason for hiding this comment

windmgc commented Aug 14, 2023 • edited Loading

windmgc commented Aug 3, 2023 •

edited

Loading

windmgc commented Aug 9, 2023 •

edited

Loading

windmgc commented Aug 14, 2023 •

edited

Loading