Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump minio client version to support assume-web-identity-role for AWS #3398

Closed
Jeffwan opened this issue Mar 31, 2020 · 22 comments
Closed

Bump minio client version to support assume-web-identity-role for AWS #3398

Jeffwan opened this issue Mar 31, 2020 · 22 comments
Assignees
@Jeffwan
Labels
area/backend area/frontend kind/feature status/triaged Whether the issue has been explicitly triaged

Comments

@Jeffwan
Copy link
Member

Jeffwan commented Mar 31, 2020 •
edited
Loading

What steps did you take:

aws add IAM For Service Account feature and aws user doesn't have to inject AWS credentials as env variables.

This requires us to use high AWS SDK version which supports assume-web-identity-role.
In this case, we need to add new resolver for minio client.

Here's the minio js and golang version.

The minimum version to support this issue is

/kind feature
/area frontend
/area backend
@Jeffwan
Copy link
Member Author

Jeffwan commented Mar 31, 2020

We also need to bump argo workflow version to make sure Argo sidecar use right SDK to persist artifacts to S3.

@Jeffwan Jeffwan mentioned this issue Mar 31, 2020
Closed
@discordianfish
Copy link
Member

To be clear, this is different from assuming instance profiles via kube2iam / kiam

@Bobgy Bobgy added the status/triaged Whether the issue has been explicitly triaged label Apr 15, 2020
@Jeffwan
Copy link
Member Author

Jeffwan commented Apr 18, 2020

Argo side, argo tracks awssdk upgrade in this issue. argoproj/argo-workflows#1774.
This has been included in https://github.com/argoproj/argo/releases/tag/v2.5.0. We need this version at least in KFP

@Jeffwan Jeffwan mentioned this issue Apr 19, 2020
Closed
@stale
Copy link

stale bot commented Jul 17, 2020

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

@stale stale bot added the lifecycle/stale The issue / pull request is stale, any activities remove this label. label Jul 17, 2020
@stale
Copy link

stale bot commented Jul 25, 2020

This issue has been automatically closed because it has not had recent activity. Please comment "/reopen" to reopen it.

@stale stale bot closed this as completed Jul 25, 2020
@stale
Copy link

stale bot commented Aug 1, 2020

This issue has been automatically closed because it has not had recent activity. Please comment "/reopen" to reopen it.

@Jeffwan
Copy link
Member Author

Jeffwan commented Nov 24, 2020

/reopen

@k8s-ci-robot k8s-ci-robot reopened this Nov 24, 2020
@k8s-ci-robot
Copy link
Contributor

@Jeffwan: Reopened this issue.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@stale stale bot removed the lifecycle/stale The issue / pull request is stale, any activities remove this label. label Nov 24, 2020
@PatrickXYS
Copy link
Member

/assign

@stale
Copy link

stale bot commented Jun 9, 2021

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

@stale stale bot added the lifecycle/stale The issue / pull request is stale, any activities remove this label. label Jun 9, 2021
@Nagarajj
Copy link

Nagarajj commented Aug 16, 2021 •
edited
Loading

@PatrickXYS minio-go module is still at 6.0.14, we would like to use IRSA on EKS, Is there a way this could be bumped up to 6.0.45 or latest. Thanks

Also any plans to do the same for minio-js ?

@stale stale bot removed the lifecycle/stale The issue / pull request is stale, any activities remove this label. label Aug 16, 2021
@PatrickXYS
Copy link
Member

/assign @surajkota

Suraj will be working on AWS part

@PatrickXYS
Copy link
Member

/unassign

@surajkota
Copy link
Contributor

surajkota commented Aug 16, 2021 •
edited
Loading

/unassign

@stale
Copy link

stale bot commented Mar 3, 2022

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

@stale stale bot added the lifecycle/stale The issue / pull request is stale, any activities remove this label. label Mar 3, 2022
@LEDfan
Copy link

LEDfan commented Mar 3, 2022

Hi, please re-consider to add support for this.
In the meantime the minio-js client also got support for IRSA: minio/minio-js#960 I don't think it's already part of a release, but hopefully the JS parts of Kubeflow can be updated as well somwhere soon.
Thanks!

@stale stale bot removed the lifecycle/stale The issue / pull request is stale, any activities remove this label. label Mar 3, 2022
@goswamig
Copy link
Contributor

@LEDfan yes, we are waiting for minio-js release 7.0.27 so that we can enable this feature.

@goswamig goswamig mentioned this issue Mar 21, 2022
Open
@goswamig
Copy link
Contributor

Minio-js 7.0.27 was released https://github.com/minio/minio-js/tree/7.0.27 with assume role support

@rawc0der
Copy link
Member

rawc0der commented Sep 5, 2022 •
edited
Loading

@Jeffwan @surajkota @PatrickXYS any plans here?

@surajkota
Copy link
Contributor

Yes, we do.

We had started on this and updated minio-go in #7946 but this is not sufficient for the UI to work. For the UI to work, we need minio-js support. Minio-js is also available but the corresponding typescript bindings are not. We have paused on this right now also to investigate user experience. Some of the service accounts are in Kubeflow namespace and some are in user profile namespace. Currently, the ml-pipeline-minio-artifact secret is copied to user namespace so using secrets works.

@rrrkharse feel free to post the latest on this, if I missed something

@rimolive
Copy link
Member

Closing this issue. Looks like the PR is closed and it covered what this issue asked as feature.

/close

@google-oss-prow Google OSS Prow
Copy link

@rimolive: Closing this issue.

In response to this:

Closing this issue. Looks like the PR is closed and it covered what this issue asked as feature.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@Jeffwan Jeffwan

Labels
area/backend area/frontend kind/feature status/triaged Whether the issue has been explicitly triaged
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests