81 lines
2.1 KiB
Ruby
81 lines
2.1 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
module Clusters
|
|
module Aws
|
|
class FetchCredentialsService
|
|
attr_reader :provision_role
|
|
|
|
MissingRoleError = Class.new(StandardError)
|
|
|
|
def initialize(provision_role, provider: nil)
|
|
@provision_role = provision_role
|
|
@provider = provider
|
|
@region = provider&.region || provision_role&.region || Clusters::Providers::Aws::DEFAULT_REGION
|
|
end
|
|
|
|
def execute
|
|
raise MissingRoleError, 'AWS provisioning role not configured' unless provision_role.present?
|
|
|
|
::Aws::AssumeRoleCredentials.new(
|
|
client: client,
|
|
role_arn: provision_role.role_arn,
|
|
role_session_name: session_name,
|
|
external_id: provision_role.role_external_id,
|
|
policy: session_policy
|
|
).credentials
|
|
end
|
|
|
|
private
|
|
|
|
attr_reader :provider, :region
|
|
|
|
def client
|
|
::Aws::STS::Client.new(**client_args)
|
|
end
|
|
|
|
def client_args
|
|
{ region: region, credentials: gitlab_credentials }.compact
|
|
end
|
|
|
|
def gitlab_credentials
|
|
# These are not needed for IAM instance profiles
|
|
return unless access_key_id.present? && secret_access_key.present?
|
|
|
|
::Aws::Credentials.new(access_key_id, secret_access_key)
|
|
end
|
|
|
|
def access_key_id
|
|
Gitlab::CurrentSettings.eks_access_key_id
|
|
end
|
|
|
|
def secret_access_key
|
|
Gitlab::CurrentSettings.eks_secret_access_key
|
|
end
|
|
|
|
##
|
|
# If we haven't created a provider record yet,
|
|
# we restrict ourselves to read-only access so
|
|
# that we can safely expose credentials to the
|
|
# frontend (to be used when populating the
|
|
# creation form).
|
|
def session_policy
|
|
if provider.nil?
|
|
File.read(read_only_policy)
|
|
end
|
|
end
|
|
|
|
def read_only_policy
|
|
Rails.root.join('vendor', 'aws', 'iam', "eks_cluster_read_only_policy.json")
|
|
end
|
|
|
|
def session_name
|
|
if provider.present?
|
|
"gitlab-eks-cluster-#{provider.cluster_id}-user-#{provision_role.user_id}"
|
|
else
|
|
"gitlab-eks-autofill-user-#{provision_role.user_id}"
|
|
end
|
|
end
|
|
end
|
|
end
|
|
end
|