S3 Bucket Integration

Jalh · April 6, 2023, 1:44pm

Hello,
at this line:

mosip/mosip-infra/blob/9dd41d36b0f30b3b68289f5acc3e7f85784317a5/deployment/v3/external/object-store/cred.sh#L33


      
          then
          echo Creating secrets as per Minio native installation
          USER=$(kubectl -n minio get secret minio -o jsonpath='{.data.root-user}' | base64 --decode)
          PASS=$(kubectl -n minio get secret minio -o jsonpath='{.data.root-password}' | base64 --decode)
          kubectl -n s3 create configmap s3 --from-literal=s3-user-key=$USER --from-literal=s3-region="" --dry-run=client  -o yaml | kubectl apply -f -
          kubectl -n s3 create secret generic s3 --from-literal=s3-user-secret=$PASS --dry-run=client  -o yaml | kubectl apply -f -
          echo object-store secret and config map is set now.
          break
          elif [ $choice = "2" ]
          then
          read -p "Please enter the S3 user key " USER
          read -p "Please enter the S3 secret key" PASS
          read -p "Please enter the S3 region" REGION
          kubectl -n s3 create configmap s3 --from-literal=s3-user-key=$USER --from-literal=s3-region=$REGION --dry-run=client  -o yaml | kubectl apply -f -
          kubectl -n s3 create secret generic s3 --from-literal=s3-user-secret=$PASS --dry-run=client  -o yaml | kubectl apply -f -
          echo object-store secret and config map is set now.
          break
          else
          echo You entered wrong choice
          kill -9 `ps --pid $$ -oppid=`; exit
          break

You expect integrators to provide an AWS user for S3. That is something I do not want to do and i’d rather use the object store with AWS IRSA to contact AWS S3 API.

Is it possible to skip this configuration and how does it behave in the app properties ?

With IRSA the application within the pod through the AWS SDK will pick up Web Identity token from the AWS credentials chain and get the values from envvars.

Regards,

Jalh · April 14, 2023, 1:51pm

Hello,
any news about that ? The component using this is datashare but I cannot find the source code repository anywhere based on your release note:

If that functionality is not available we could make a PR out of it.

gsasikumar · April 17, 2023, 9:22am

The code for this is available in the khazana library. https://github.com/mosip/khazana/blob/master/kernel/object-store/src/main/java/io/mosip/commons/khazana/impl/S3Adapter.java

Jalh · May 2, 2023, 9:17am

Hello,
any plan for your team to implement this feature in a close future ?

gsasikumar · May 2, 2023, 9:40am

@Jalh ,

Currently, we have no plan to use the AWS IRSA as we do not see any country deploying in AWS for production usage.

However, if you plan to make the change please feel free to raise a PR.

Topic		Replies	Views
In mosip -infra while setting up mosip v3 installation from where i can get these values Developer	1	103	March 28, 2024
[12.0.1] partner-onboarder installation errors / misisng minimoto Support	3	119	April 25, 2024
Issue installing conf-secrets service Platform	3	344	January 30, 2023
Installation issues Developer	6	271	November 16, 2023
Regarding External Database Setup For MOSIP Support	4	195	December 25, 2023

S3 Bucket Integration

Related topics