Skip to content

docs: credential refresher covers all AWS sources in 26.09.1 #32

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xe-nvdk merged 1 commit into from
Aug 18, 2026
Merged

docs: credential refresher covers all AWS sources in 26.09.1 #32

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 7 additions & 4 deletions docs/configuration/overview.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,10 +168,13 @@ ARC_STORAGE_S3_PATH_STYLE=false
:::tip IAM roles / IRSA (no static keys)
For EC2/EKS, omit `s3_access_key`/`s3_secret_key` entirely (leave them unset). Arc
then authenticates via the AWS credential chain — EC2 instance profile, **EKS IRSA
(IAM Roles for Service Accounts)**, or environment credentials. This applies to
both writes and DuckDB query reads (query-read credential-chain support requires
Arc 26.06.2+). Setting exactly one of the two keys is rejected at startup; set
both or neither.
(IAM Roles for Service Accounts)**, **EKS Pod Identity**, or environment
credentials. This applies to both writes and DuckDB query reads. Temporary
credentials (IRSA, instance roles, Pod Identity) are refreshed automatically
before each session expiry; this requires **Arc 26.09.1+** — on 26.06.2–26.06.3,
query reads stop working roughly one hour after each process start
([#600](https://github.com/Basekick-Labs/arc/issues/600)). Setting exactly one
of the two keys is rejected at startup; set both or neither.
:::

</TabItem>
Expand Down
8 changes: 3 additions & 5 deletions docs/installation/kubernetes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -183,11 +183,9 @@ Set `image.tag: "26.09.1"` (or later) for IRSA that keeps working past the first
hour.

:::note EKS Pod Identity
This applies to **IRSA**, which injects `AWS_ROLE_ARN` and
`AWS_WEB_IDENTITY_TOKEN_FILE` into the pod — the pair Arc's credential
refresher detects. EKS **Pod Identity** — the newer mechanism, which uses
`AWS_CONTAINER_CREDENTIALS_FULL_URI` instead — is not yet detected. Use IRSA
for S3-backed query workloads.
As of 26.09.1 Arc's credential refresher covers every source the AWS SDK
resolves: **IRSA** and **EKS Pod Identity** both work, as do EC2 instance
roles for non-EKS deployments. Static keys, when configured, always win.
:::
:::

Expand Down