aws / aws/aws-sdk-java-v2

Metadata Service call does not support Proxy

Aperta
#1,830 1 commento 0 reazioni 0 assegnatari Vedi su GitHub
feature-request p1 proxy
Lingua principale
Java
Stelle
2.6k
Fork
1k
Merge medio
2g 9h
PR unite (30g)
51

Descrizione

## Describe the bug
The EC2 Metadata service API call does not allow for configuration of a Proxy. This is required for example for Kube2Iam to work in Proxy mode.

## Expected Behavior
The ConnectionUtils should be able to support a proxy - ideally should be replaced with the standard ApacheHttpClient.

## Current Behavior
Configuring a Proxy in ApacheHttpClient does not affect ConnectionUtils:

```
2020-05-13 11:05:57,971 main DEBUG LoggerContext[name=77556fd, org.apache.logging.log4j.core.LoggerContext@f1da57d] started OK.
2020-05-13 11:05:58 [main] DEBUG software.amazon.awssdk.regions.providers.AwsRegionProviderChain:57 - Unable to load region from software.amazon.awssdk.regions.providers.SystemSettingsRegionProvider@89c10b7:Unable to load region from system settings. Region must be specified either via environment variable (AWS_REGION) or system property (aws.region).
2020-05-13 11:05:58 [main] DEBUG software.amazon.awssdk.http.apache.ApacheHttpClient:84 - Configuring Proxy. Proxy Host: 10.0.0.1
Exception in thread "main" software.amazon.awssdk.core.exception.SdkClientException: Unable to load credentials from service endpoint.
at software.amazon.awssdk.core.exception.SdkClientException$BuilderImpl.build(SdkClientException.java:98)
at software.amazon.awssdk.auth.credentials.HttpCredentialsProvider.refreshCredentials(HttpCredentialsProvider.java:110)
at software.amazon.awssdk.utils.cache.CachedSupplier.refreshCache(CachedSupplier.java:132)
at software.amazon.awssdk.utils.cache.CachedSupplier.get(CachedSupplier.java:89)

```

## Steps to Reproduce
With Kube2Iam in Proxy mode, and the SDK configured to use InstanceProfileCredentialsProvider, do any call to any service, for example:

```
ProxyConfiguration.Builder proxyConfig = ProxyConfiguration.builder();

ApacheHttpClient.Builder httpClientBuilder =
ApacheHttpClient.builder()
.proxyConfiguration(proxyConfig
.addNonProxyHost("*.amazonaws.com,:443")
.endpoint(new URI("http://:8181"))
.build());

ClientOverrideConfiguration.Builder overrideConfig =
ClientOverrideConfiguration.builder();
StsClient stsClient = StsClient.builder()
.httpClientBuilder(httpClientBuilder)
.overrideConfiguration(overrideConfig.build())
.credentialsProvider(InstanceProfileCredentialsProvider.builder().build())
.build();
stsClient.getCallerIdentity();
```
will fail.

## Possible Solution
Replace ConnectionUtils with the standard ApacheHttpClient. ConnectionUtils is currently used only for the metadata calls.

## Context
Kube2Iam in Proxy mode in Openshift 4

## Your Environment

* AWS Java SDK version used: 2.13.13
* JDK version used: jdk-11.0.6
* Operating System and version: Debian Linux 8.0

Guida per i contributori

Apri la guida per i contributori

Direzione di ricerca

Inizia con ConnectionUtils e le chiamate ai metadati utilizzate da InstanceProfileCredentialsProvider, quindi confronta la loro configurazione HTTP con ApacheHttpClient proxyConfiguration. Riproduci il problema usando l'esempio di proxy Kube2Iam ed esamina i test esistenti del provider di credenziali. Il lavoro è completato quando le richieste ai metadati rispettano il proxy configurato e la regressione è coperta da un test.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
aws, java
Ambito
authentication, networking
Tipo di issue
Bug
Difficoltà
4/5
Tempo stimato
3-5 giorni
Stato di attività
Ferma
Chiarezza
Abbastanza chiara
Idoneità per principianti
45/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.