feat: Add IRSA and session token support to AWS Storage Service #1327
+947
−10
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ibuziuk
reviewed
Sep 2, 2025
| return UrlUtil.createApiUrl("", namespace.getName(), "logo", namespace.getLogoName()).substring(1); | ||
| } | ||
| } | ||
| } |
ibuziuk
reviewed
Sep 2, 2025
| assertFalse((Boolean) ReflectionTestUtils.invokeMethod(storageService, "hasStaticCredentials")); | ||
| assertFalse((Boolean) ReflectionTestUtils.invokeMethod(storageService, "hasSessionToken")); | ||
| } | ||
| } No newline at end of file |
ibuziuk
approved these changes
Sep 2, 2025
achdmbp
force-pushed
the
feature/aws-irsa-support
branch
from
12ee2d6 to
ff10815
Compare
|
@svor @amvanbaren folks, could you please review? It would be great to include the change in the next release. |
|
@achdmbp Hello, I've tried to follow steps from the description Option A: Testing with IRSA (Recommended). When I deployed openvsx-server to EKS cluster: deployement.yamlapiVersion: apps/v1
kind: Deployment
metadata:
name: openvsx-server
namespace: default
spec:
replicas: 1
selector:
matchLabels:
app: openvsx-server
template:
metadata:
labels:
app: openvsx-server
spec:
serviceAccountName: openvsx-service-account # IRSA service account
containers:
- name: server
image: quay.io/vsvydenk/openvsx:pr-check # image built using this PR
env:
# Only configure S3 bucket - credentials auto-detected via IRSA
- name: OVSX_STORAGE_AWS_BUCKET
value: "vsvydenk-openvsx"
- name: OVSX_STORAGE_AWS_REGION
value: "us-east-1"
# No static credentials needed!openvsx-server pod failed: logscould you please provide more details how openvsx should be deployed, did you add any additional configuration into application.yaml ? |
This enhancement addresses the AWS credential limitations in OpenVSX by adding support for multiple authentication methods: 1. Static credentials with session token (temporary credentials) 2. Static credentials without session token (permanent credentials) 3. IRSA credentials (IAM Roles for Service Accounts) 4. Default credential provider chain (fallback) Key improvements: - Enables secure Kubernetes deployments using IRSA - Supports temporary credentials from AWS STS - Maintains backward compatibility with existing configurations - Follows AWS security best practices - Eliminates need for long-lived static credentials in containers The service automatically detects available credential types and uses appropriate AWS SDK credential providers based on configuration. Updated documentation includes examples for all authentication methods and deployment scenarios. Fixes: eclipse#1316 Signed-off-by: Adnan Al <[email protected]>
- Enables Web Identity Token authentication for S3 storage - Fixes 'sts service module must be on the class path' error - Required for IAM Roles for Service Accounts (IRSA) integration
achdmbp
force-pushed
the
feature/aws-irsa-support
branch
from
02c35e5 to
a85c501
Compare
OpenVSX IRSA Integration - PR Testing InstructionsOverviewThis PR adds AWS IRSA (IAM Roles for Service Accounts) support to OpenVSX, allowing it to authenticate with AWS S3 using OpenShift service account tokens instead of static credentials. Prerequisites
Step-by-Step Testing1. Create AWS InfraCreate S3 Bucket: export AWS_REGION="your-aws-region"
export BUCKET_NAME="your-openvsx-test-bucket-$(date +%s)"
aws s3 mb s3://$BUCKET_NAME --region $AWS_REGIONCreate IAM Role for IRSA: export ROLE_NAME="your-openvsx-irsa-role"
export OIDC_PROVIDER="your-openshift-oidc-provider-url"
export NAMESPACE="your-test-namespace"
# Create trust policy
cat > trust-policy.json << EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::$(aws sts get-caller-identity --query Account --output text):oidc-provider/$OIDC_PROVIDER"
},
"Action": "sts:AssumeRoleWithWebIdentity",
"Condition": {
"StringEquals": {
"$OIDC_PROVIDER:sub": "system:serviceaccount:$NAMESPACE:openvsx-service-account"
}
}
}
]
}
EOF
# Create IAM role
aws iam create-role --role-name $ROLE_NAME --assume-role-policy-document file://trust-policy.json
# Create S3 access policy
cat > s3-policy.json << EOF
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject",
"s3:DeleteObject",
"s3:ListBucket"
],
"Resource": [
"arn:aws:s3:::$BUCKET_NAME",
"arn:aws:s3:::$BUCKET_NAME/*"
]
}
]
}
EOF
# Attach policy to role
aws iam put-role-policy --role-name $ROLE_NAME --policy-name S3Access --policy-document file://s3-policy.json
export ROLE_ARN="arn:aws:iam::$(aws sts get-caller-identity --query Account --output text):role/$ROLE_NAME"2. Create OpenShift Project and Service Accountoc new-project $NAMESPACE
# Create service account with IRSA annotation
cat << EOF | oc apply -f -
apiVersion: v1
kind: ServiceAccount
metadata:
name: openvsx-service-account
namespace: $NAMESPACE
annotations:
eks.amazonaws.com/role-arn: $ROLE_ARN
EOF3. Deploy PostgreSQL Databasecat << EOF | oc apply -f -
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: postgres-pvc
namespace: $NAMESPACE
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 1Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: postgresql
namespace: $NAMESPACE
spec:
replicas: 1
selector:
matchLabels:
app: postgresql
template:
metadata:
labels:
app: postgresql
spec:
containers:
- name: postgresql
image: postgres:13
env:
- name: POSTGRES_DB
value: openvsx
- name: POSTGRES_USER
value: openvsx
- name: POSTGRES_PASSWORD
value: openvsx
ports:
- containerPort: 5432
volumeMounts:
- name: postgres-storage
mountPath: /var/lib/postgresql/data
volumes:
- name: postgres-storage
persistentVolumeClaim:
claimName: postgres-pvc
---
apiVersion: v1
kind: Service
metadata:
name: postgresql
namespace: $NAMESPACE
spec:
selector:
app: postgresql
ports:
- port: 5432
targetPort: 5432
EOF
# Wait for PostgreSQL to be ready
oc rollout status deployment/postgresql -n $NAMESPACE4. Deploy Elasticsearchcat << EOF | oc apply -f -
apiVersion: apps/v1
kind: Deployment
metadata:
name: elasticsearch
namespace: $NAMESPACE
spec:
replicas: 1
selector:
matchLabels:
app: elasticsearch
template:
metadata:
labels:
app: elasticsearch
spec:
containers:
- name: elasticsearch
image: docker.elastic.co/elasticsearch/elasticsearch:7.17.0
env:
- name: discovery.type
value: single-node
- name: ES_JAVA_OPTS
value: "-Xms512m -Xmx512m"
ports:
- containerPort: 9200
---
apiVersion: v1
kind: Service
metadata:
name: elasticsearch
namespace: $NAMESPACE
spec:
selector:
app: elasticsearch
ports:
- port: 9200
targetPort: 9200
EOF
# Wait for Elasticsearch to be ready
oc rollout status deployment/elasticsearch -n $NAMESPACE5. Build and Deploy OpenVSX Server with PR changesBuild and push image: cd server/ # Navigate to OpenVSX server directory
export IMAGE_NAME="image-registry.openshift-image-registry.svc:5000/$NAMESPACE/openvsx-server:latest"
# build and push the container image
podman build -t $IMAGE_NAME .
podman push $IMAGE_NAMEDeploy OpenVSX Server: note: below are the env variables that worked to test the s3 integration using IRSA without creating application.yaml cat << EOF | oc apply -f -
apiVersion: apps/v1
kind: Deployment
metadata:
name: openvsx-server
namespace: $NAMESPACE
spec:
replicas: 1
selector:
matchLabels:
app: openvsx-server
template:
metadata:
labels:
app: openvsx-server
spec:
serviceAccountName: openvsx-service-account
containers:
- name: server
image: $IMAGE_NAME
imagePullPolicy: Always
ports:
- containerPort: 8080
env:
- name: SPRING_DATASOURCE_URL
value: "jdbc:postgresql://postgresql:5432/openvsx"
- name: SPRING_DATASOURCE_USERNAME
value: "openvsx"
- name: SPRING_DATASOURCE_PASSWORD
value: "openvsx"
- name: OVSX_ELASTICSEARCH_HOST
value: "elasticsearch:9200"
- name: OVSX_INTEGRITY_KEY_PAIR
value: "create"
- name: BUCKET4J_ENABLED
value: "false"
- name: OVSX_REDIS_ENABLED
value: "false"
- name: SPRING_AUTOCONFIGURE_EXCLUDE
value: "org.springframework.boot.actuate.autoconfigure.tracing.zipkin.ZipkinAutoConfiguration,org.springframework.boot.autoconfigure.data.redis.RedisAutoConfiguration,org.springframework.boot.autoconfigure.data.redis.RedisReactiveAutoConfiguration"
- name: SPRING_FLYWAY_BASELINE_ON_MIGRATE
value: "true"
# S3 configuration for IRSA
- name: OVSX_STORAGE_AWS_BUCKET
value: "$BUCKET_NAME"
- name: OVSX_STORAGE_AWS_REGION
value: "$AWS_REGION"
---
apiVersion: v1
kind: Service
metadata:
name: openvsx-server
namespace: $NAMESPACE
spec:
selector:
app: openvsx-server
ports:
- port: 8080
targetPort: 8080
---
apiVersion: route.openshift.io/v1
kind: Route
metadata:
name: openvsx-server
namespace: $NAMESPACE
spec:
to:
kind: Service
name: openvsx-server
port:
targetPort: 8080
tls:
termination: edge
EOF
# Wait for OpenVSX server to be ready
oc rollout status deployment/openvsx-server -n $NAMESPACE6. Configure Database and TestSetup test user and token: # Add test user
oc exec deployment/postgresql -n $NAMESPACE -- \
psql -U openvsx -d openvsx -c \
"INSERT INTO user_data (id, login_name, full_name, email, provider_url, provider, created)
VALUES (1001, 'test-user', 'Test User', '[email protected]', 'github', 'github', NOW())
ON CONFLICT (id) DO NOTHING;"
# Add personal access token
oc exec deployment/postgresql -n $NAMESPACE -- \
psql -U openvsx -d openvsx -c \
"INSERT INTO personal_access_token (id, user_data, value, active, created, accessed, description)
VALUES (1001, 1001, 'test_token_123', true, NOW(), NOW(), 'test publisher')
ON CONFLICT (id) DO NOTHING;"Wait for server health and test publishing: export OPENVSX_URL="https://$(oc get route openvsx-server -n $NAMESPACE -o jsonpath='{.spec.host}')"
# Wait for server to be healthy
echo "Waiting for OpenVSX server to be healthy..."
for i in {1..30}; do
if curl -s -f "$OPENVSX_URL/actuator/health" >/dev/null 2>&1; then
echo "✅ OpenVSX server is healthy"
break
fi
if [ $i -eq 30 ]; then
echo "❌ Health check timeout"
exit 1
fi
echo "Attempt $i/30 - waiting 10 seconds..."
sleep 10
done
# Create namespace and publish extension
ovsx create-namespace ms-python -r "$OPENVSX_URL" -p test_token_123
# Download and publish a test extension
curl -L -o redhat-vscode-yaml-test.vsix "https://open-vsx.org/api/redhat/vscode-yaml/1.20.2025100808/file/redhat.vscode-yaml-1.20.2025100808.vsix"
ovsx publish redhat-vscode-yaml-test.vsix -r "$OPENVSX_URL" -p test_token_1237. Verify S3 Storage and Download# Check S3 bucket contents
echo "Checking S3 bucket contents..."
aws s3 ls s3://$BUCKET_NAME --recursive --region $AWS_REGION
# Test extension download
echo "Testing extension download..."
DOWNLOAD_URL=$(curl -s "$OPENVSX_URL/api/redhat/vscode-yaml" | jq -r '.files.download')
curl -L -o test-download.vsix "$DOWNLOAD_URL"
if [ -f test-download.vsix ] && [ -s test-download.vsix ]; then
FILE_SIZE=$(ls -lh test-download.vsix | awk '{print $5}')
echo "✅ Extension downloaded successfully - Size: $FILE_SIZE"
rm -f test-download.vsix
else
echo "❌ Download failed"
fiExpected Results✅ Success Indicators:
Cleanup# Delete OpenShift resources
oc delete project $NAMESPACE
# Delete AWS resources
aws iam delete-role-policy --role-name $ROLE_NAME --policy-name S3Access
aws iam delete-role --role-name $ROLE_NAME
aws s3 rm s3://$BUCKET_NAME --recursive
aws s3 rb s3://$BUCKET_NAME
# Clean up local files
rm -f trust-policy.json s3-policy.jsonKey Changes Tested
|
|
hi @svor sorry for the delay. I added steps I followed to test my changes here #1327 (comment) . let me know if you have any questions |
svor
approved these changes
Oct 16, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Add IRSA and Session Token Support to AWS Storage Service
Fixes #1316
Overview
This enhancement addresses the AWS credential limitations in OpenVSX by adding support for multiple authentication methods, enabling secure Kubernetes deployments and following AWS security best practices.
🔧 Changes Made
Supported Authentication Methods
Testing Instructions
Prerequisites
Option A: Testing with IRSA (Recommended)
1. Set up IRSA in your Kubernetes cluster
Follow the AWS IRSA documentation to configure IAM Roles for Service Accounts.
2. Create IAM Role and Policy
Create IAM role for IRSA
3. Deploy OpenVSX with IRSA
4. Verify IRSA Authentication
Option B: Testing with Manual Credentials (Fallback)
If IRSA setup is not available, use this manual configuration:
1. Create Kubernetes Secret
2. Deploy with Secret-based Credentials
🔍 Verification Steps
Test S3 operations:
Verify credential rotation (for temporary credentials):
Unit Test Coverage
Run the comprehensive test suite:
Run integration tests with LocalStack
Documentation
🔒 Security Benefits
Breaking Changes
None - this is a backward-compatible enhancement.
Checklist