Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use AWS OIDC to get AWS creds #742

Merged
merged 2 commits into from
Mar 7, 2023
Merged

Use AWS OIDC to get AWS creds #742

merged 2 commits into from
Mar 7, 2023

Conversation

jjacobelli
Copy link
Contributor

This PR is using the AWS OIDC to get AWS credentials (doc). Currently we are using permanent tokens that we need to manually rotate every 90 days. This PR is removing this requirement.

The AWS_ROLE_ARN and AWS_REGION are orgs variables defined here: https://github.com/organizations/nv-morpheus/settings/variables/actions.

@jjacobelli jjacobelli self-assigned this Mar 7, 2023
@jjacobelli jjacobelli added non-breaking Non-breaking change improvement Improvement to existing functionality labels Mar 7, 2023
@jjacobelli jjacobelli marked this pull request as ready for review March 7, 2023 14:37
@jjacobelli jjacobelli requested a review from a team as a code owner March 7, 2023 14:37
@jjacobelli jjacobelli requested review from a team as code owners March 7, 2023 17:50
@jjacobelli
Use AWS OIDC to get AWS creds
ab02afb 
Signed-off-by: Jordan Jacobelli <jjacobelli@nvidia.com>
@jjacobelli
Set AWS credentials lifetime to 12h
e6639b0 
Signed-off-by: Jordan Jacobelli <jjacobelli@nvidia.com>
@jjacobelli jjacobelli removed request for a team March 7, 2023 17:56
@dagardner-nv
Copy link
Contributor

/merge

@rapids-bot rapids-bot bot merged commit 72437b9 into nv-morpheus:branch-23.03 Mar 7, 2023
dagardner-nv pushed a commit to dagardner-nv/Morpheus that referenced this pull request Mar 7, 2023
@jjacobelli @dagardner-nv
Use AWS OIDC to get AWS creds (nv-morpheus#742)
3afefee 
This PR is using the AWS OIDC to get AWS credentials ([doc](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services)). Currently we are using permanent tokens that we need to manually rotate every 90 days. This PR is removing this requirement.

The `AWS_ROLE_ARN` and `AWS_REGION` are orgs variables defined here: https://github.com/organizations/nv-morpheus/settings/variables/actions.

Authors:
  - Jordan Jacobelli (https://github.com/jjacobelli)

Approvers:
  - AJ Schmidt (https://github.com/ajschmidt8)
  - David Gardner (https://github.com/dagardner-nv)
  - Michael Demoret (https://github.com/mdemoret-nv)

URL: nv-morpheus#742
@dagardner-nv dagardner-nv mentioned this pull request Mar 7, 2023
Merged
ajschmidt8 added a commit to ajschmidt8/Morpheus that referenced this pull request Mar 8, 2023
@ajschmidt8
Update workflow permissions block
31c2e6c 
This PR is a continuation of nv-morpheus#742.

Omitting the other keys in the `permissions` block sets them to `none` ([src](https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs#overview)).

This is probably not a concern for `nv-morpheus`, but it caused issues for some private RAPIDS repositories so I wanted to update the `nv-morpheus` repos for consistency.

To remedy this, this PR includes the following changes:

- Keeps the `id-token` permission as `write`, but sets the remaining permissions as described in the `restricted` column [here](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token)
  - Also sets `pull_request` to `read` so that `fetch_base_branch` in `common.sh` can use it
- Moves the `permissions` block to the top of `ci_pipe.yml` to DRY it up
- Removes the `permissions` block from `pull_request.yml` since that workflow only calls `ci_pipe.yml` and therefore is redundant
@ajschmidt8 ajschmidt8 mentioned this pull request Mar 8, 2023
Merged
rapids-bot bot pushed a commit that referenced this pull request Mar 8, 2023
@ajschmidt8
Update workflow permissions block (#745)
0b4c810 
This PR is a continuation of #742.

Omitting the other keys in the `permissions` block sets them to `none` ([src](https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs#overview)).

This is probably not a concern for `nv-morpheus`, but it caused issues for some private RAPIDS repositories so I wanted to update the `nv-morpheus` repos for consistency.

To remedy this, this PR includes the following changes:

- Keeps the `id-token` permission as `write`, but sets the remaining permissions as described in the `restricted` column [here](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token)
  - Also sets `pull_request` to `read` so that `fetch_base_branch` in `common.sh` can use it
- Moves the `permissions` block to the top of `ci_pipe.yml` to DRY it up
- ~~Removes the `permissions` block from `pull_request.yml` since that workflow only calls `ci_pipe.yml` and therefore is redundant~~ (this is required. otherwise this error occurs https://github.com/nv-morpheus/Morpheus/actions/runs/4359998192)

Authors:
  - AJ Schmidt (https://github.com/ajschmidt8)
  - David Gardner (https://github.com/dagardner-nv)

Approvers:
  - David Gardner (https://github.com/dagardner-nv)

URL: #745
ajschmidt8 added a commit to dagardner-nv/Morpheus that referenced this pull request Mar 8, 2023
@ajschmidt8
Update workflow permissions block (nv-morpheus#745)
55fcac4 
This PR is a continuation of nv-morpheus#742.

Omitting the other keys in the `permissions` block sets them to `none` ([src](https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs#overview)).

This is probably not a concern for `nv-morpheus`, but it caused issues for some private RAPIDS repositories so I wanted to update the `nv-morpheus` repos for consistency.

To remedy this, this PR includes the following changes:

- Keeps the `id-token` permission as `write`, but sets the remaining permissions as described in the `restricted` column [here](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token)
  - Also sets `pull_request` to `read` so that `fetch_base_branch` in `common.sh` can use it
- Moves the `permissions` block to the top of `ci_pipe.yml` to DRY it up
- ~~Removes the `permissions` block from `pull_request.yml` since that workflow only calls `ci_pipe.yml` and therefore is redundant~~ (this is required. otherwise this error occurs https://github.com/nv-morpheus/Morpheus/actions/runs/4359998192)

Authors:
  - AJ Schmidt (https://github.com/ajschmidt8)
  - David Gardner (https://github.com/dagardner-nv)

Approvers:
  - David Gardner (https://github.com/dagardner-nv)

URL: nv-morpheus#745
rapids-bot bot pushed a commit that referenced this pull request Mar 13, 2023
@dagardner-nv
23.01 back-patch of #742 - Use AWS OIDC to get AWS creds (#743)
a8daea8 
This PR is using the AWS OIDC to get AWS credentials ([doc](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services)). Currently we are using permanent tokens that we need to manually rotate every 90 days. This PR is removing this requirement.

The `AWS_ROLE_ARN` and `AWS_REGION` are orgs variables defined here: https://github.com/organizations/nv-morpheus/settings/variables/actions.

Authors:
  - Jordan Jacobelli (https://github.com/jjacobelli)
  - David Gardner (https://github.com/dagardner-nv)
 
Approvers:
  - AJ Schmidt (https://github.com/ajschmidt8)
  - Jordan Jacobelli (https://github.com/jjacobelli)
  - Michael Demoret (https://github.com/mdemoret-nv)

URL: #742

Authors:
  - David Gardner (https://github.com/dagardner-nv)
  - Jordan Jacobelli (https://github.com/jjacobelli)
  - AJ Schmidt (https://github.com/ajschmidt8)

Approvers:
  - AJ Schmidt (https://github.com/ajschmidt8)
  - Michael Demoret (https://github.com/mdemoret-nv)

URL: #743
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ajschmidt8 ajschmidt8 ajschmidt8 approved these changes

@mdemoret-nv mdemoret-nv mdemoret-nv approved these changes

@dagardner-nv dagardner-nv dagardner-nv approved these changes

Assignees

@jjacobelli jjacobelli

Labels
improvement Improvement to existing functionality non-breaking Non-breaking change
Projects
Morpheus Boards
Archived in project
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@jjacobelli @dagardner-nv @ajschmidt8 @mdemoret-nv