kubevirt / containerized-data-importer / #6255

50%

push

travis-ci

chore(cdi): migrate S3 datasource from aws-sdk-go v1 to v2 (#4229)

* chore(cdi): migrate S3 datasource from aws-sdk-go v1 to v2

Behavior is unchanged: static credentials from the secret, path-style
addressing, the importer's own HTTP client for certificate handling, and
plain http for http endpoints. Empty or partial credentials still fail on
the first request, now with "static credentials are empty".

v2 validates the signing region as a DNS name where v1 accepted anything,
so extractRegion drops the port and falls back to us-east-1 (logged) when
the derived region is not a valid DNS name, e.g. for IPv6 endpoints.

Signed-off-by: Damien Chomat <damien.chomat@gmail.com>

* importer: resolve S3 credentials via the SDK default chain when no secret is set

A DataVolume without a secretRef reaches the importer with empty keys.
Instead of failing with "static credentials are empty", let the
aws-sdk-go-v2 default chain resolve credentials from the pod's ambient
identity: environment variables, IRSA web identity token, EKS Pod
Identity, or IMDS. Together with the
cdi.kubevirt.io/storage.pod.serviceAccountName annotation (#4056), an
IRSA-annotated ServiceAccount is enough to import from S3 without a
secret in the cluster.

Setting only one of the two keys is a configuration error and is now
rejected explicitly when the client is built.

Signed-off-by: Damien Chomat <damien.chomat@gmail.com>

* importer: validate the S3 signing region with IsDNS1123Subdomain

Replace the hand-rolled host-label regexp with apimachinery's
IsDNS1123Subdomain, which already encodes the same DNS name rule.

Signed-off-by: Damien Chomat <damien.chomat@gmail.com>

* importer: fix gosec G112 and vendored bazel visibility

Two CI jobs failed on this branch:

* pull-cdi-linter: gosec G112 flagged the http.Server used by the IPv6
  getS3Client test for not setting ReadHeaderTimeout.
* pull-cdi-verify-go-mod: the BUILD.bazel files vendored for
  aws-sdk-go-v2's internal/v4a/internal/{cr... (continued)

40 of 42 new or added lines in 1 file covered. (95.24%)

15211 of 30537 relevant lines covered (49.81%)

0.56 hits per line