{"action":"created","comment":{"url":"https://api.github.com/repos/jtblin/kube2iam/pulls/comments/234773760","pull_request_review_id":176487960,"id":234773760,"node_id":"MDI0OlB1bGxSZXF1ZXN0UmV2aWV3Q29tbWVudDIzNDc3Mzc2MA==","diff_hunk":"@@ -126,7 +126,7 @@ func (iam *Client) EndpointFor(service, region string, optFns ...func(*endpoints\n }\n \n // AssumeRole returns an IAM role Credentials using AWS STS.\n-func (iam *Client) AssumeRole(roleARN, remoteIP string, sessionTTL time.Duration) (*Credentials, error) {\n+func (iam *Client) AssumeRole(roleARN, externalID string, remoteIP string, sessionTTL time.Duration) (*Credentials, error) {\n \thitCache := true\n \titem, err := cache.Fetch(roleARN, sessionTTL, func() (interface{}, error) {","path":"iam/iam.go","position":7,"original_position":7,"commit_id":"d2f79d8a4962b6dbb9ec8c70a9b1c3f88b788f59","original_commit_id":"d2f79d8a4962b6dbb9ec8c70a9b1c3f88b788f59","user":{"login":"ElliotGardiner","id":2171689,"node_id":"MDQ6VXNlcjIxNzE2ODk=","avatar_url":"https://avatars1.githubusercontent.com/u/2171689?v=4","gravatar_id":"","url":"https://api.github.com/users/ElliotGardiner","html_url":"https://github.com/ElliotGardiner","followers_url":"https://api.github.com/users/ElliotGardiner/followers","following_url":"https://api.github.com/users/ElliotGardiner/following{/other_user}","gists_url":"https://api.github.com/users/ElliotGardiner/gists{/gist_id}","starred_url":"https://api.github.com/users/ElliotGardiner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ElliotGardiner/subscriptions","organizations_url":"https://api.github.com/users/ElliotGardiner/orgs","repos_url":"https://api.github.com/users/ElliotGardiner/repos","events_url":"https://api.github.com/users/ElliotGardiner/events{/privacy}","received_events_url":"https://api.github.com/users/ElliotGardiner/received_events","type":"User","site_admin":false},"body":"It looks like this is the crux of the caching logic. For this `ccache` get-set mechanism, updating this key to `roleARN:externalID` would help with cache invalidation when an external id is added to an iam role. However it looks like there's no mechanism for invalidating the cache if a role's credentials are invalidated before it's original TTL (invalidation seems like a broader issue).\r\n\r\nOne other point I'll add, if an iam role requires an external id, there shouldn't be a scenario where two pods are successfully using that role but only one of them is passing in the external id. If Pod A isn't using the external id, sts.AssumeRole requests will fail and nil'ify the cache https://github.com/jtblin/kube2iam/pull/177/files#diff-d40ff635e38cff8f5959411f50e5a8a6R163\r\nmeanwhile Pod B is using the external id and is populating the cache with healthy credentials that Pod A could then grab.\r\n\r\nTLDRl; I need to update the key to include external id.","created_at":"2018-11-19T20:40:15Z","updated_at":"2018-11-19T20:40:15Z","html_url":"https://github.com/jtblin/kube2iam/pull/177#discussion_r234773760","pull_request_url":"https://api.github.com/repos/jtblin/kube2iam/pulls/177","author_association":"NONE","_links":{"self":{"href":"https://api.github.com/repos/jtblin/kube2iam/pulls/comments/234773760"},"html":{"href":"https://github.com/jtblin/kube2iam/pull/177#discussion_r234773760"},"pull_request":{"href":"https://api.github.com/repos/jtblin/kube2iam/pulls/177"}}},"pull_request":{"url":"https://api.github.com/repos/jtblin/kube2iam/pulls/177","id":229437047,"node_id":"MDExOlB1bGxSZXF1ZXN0MjI5NDM3MDQ3","html_url":"https://github.com/jtblin/kube2iam/pull/177","diff_url":"https://github.com/jtblin/kube2iam/pull/177.diff","patch_url":"https://github.com/jtblin/kube2iam/pull/177.patch","issue_url":"https://api.github.com/repos/jtblin/kube2iam/issues/177","number":177,"state":"open","locked":false,"title":"Add support for sts external-id authentication","user":{"login":"ElliotGardiner","id":2171689,"node_id":"MDQ6VXNlcjIxNzE2ODk=","avatar_url":"https://avatars1.githubusercontent.com/u/2171689?v=4","gravatar_id":"","url":"https://api.github.com/users/ElliotGardiner","html_url":"https://github.com/ElliotGardiner","followers_url":"https://api.github.com/users/ElliotGardiner/followers","following_url":"https://api.github.com/users/ElliotGardiner/following{/other_user}","gists_url":"https://api.github.com/users/ElliotGardiner/gists{/gist_id}","starred_url":"https://api.github.com/users/ElliotGardiner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ElliotGardiner/subscriptions","organizations_url":"https://api.github.com/users/ElliotGardiner/orgs","repos_url":"https://api.github.com/users/ElliotGardiner/repos","events_url":"https://api.github.com/users/ElliotGardiner/events{/privacy}","received_events_url":"https://api.github.com/users/ElliotGardiner/received_events","type":"User","site_admin":false},"body":"This change adds support for the `--external-id` parameter of aws `sts assume-role` [api calls](https://docs.aws.amazon.com/cli/latest/reference/sts/assume-role.html).\r\n\r\nWith this change clients can create pods with an external-id in addition to the role annotation. For example:\r\n```\r\napiVersion: v1\r\nkind: Pod\r\nmetadata:\r\n  name: a-pod-with-an-external-id\r\n  labels:\r\n    name: a-pod-with-an-external-id\r\n  annotations:\r\n    iam.amazonaws.com/role: arn:aws:iam::111111111111:role/an-iam-role-with-an-external-id\r\n    iam.amazonaws.com/external-id: external-id-preventing-confused-deputy-syndrome\r\n```","created_at":"2018-11-08T16:51:53Z","updated_at":"2018-11-19T20:40:15Z","closed_at":null,"merged_at":null,"merge_commit_sha":"daffecdf7fbf2bc2c6267b9f1119537ea41f12b6","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/jtblin/kube2iam/pulls/177/commits","review_comments_url":"https://api.github.com/repos/jtblin/kube2iam/pulls/177/comments","review_comment_url":"https://api.github.com/repos/jtblin/kube2iam/pulls/comments{/number}","comments_url":"https://api.github.com/repos/jtblin/kube2iam/issues/177/comments","statuses_url":"https://api.github.com/repos/jtblin/kube2iam/statuses/d2f79d8a4962b6dbb9ec8c70a9b1c3f88b788f59","head":{"label":"ElliotGardiner:external-id-support","ref":"external-id-support","sha":"d2f79d8a4962b6dbb9ec8c70a9b1c3f88b788f59","user":{"login":"ElliotGardiner","id":2171689,"node_id":"MDQ6VXNlcjIxNzE2ODk=","avatar_url":"https://avatars1.githubusercontent.com/u/2171689?v=4","gravatar_id":"","url":"https://api.github.com/users/ElliotGardiner","html_url":"https://github.com/ElliotGardiner","followers_url":"https://api.github.com/users/ElliotGardiner/followers","following_url":"https://api.github.com/users/ElliotGardiner/following{/other_user}","gists_url":"https://api.github.com/users/ElliotGardiner/gists{/gist_id}","starred_url":"https://api.github.com/users/ElliotGardiner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ElliotGardiner/subscriptions","organizations_url":"https://api.github.com/users/ElliotGardiner/orgs","repos_url":"https://api.github.com/users/ElliotGardiner/repos","events_url":"https://api.github.com/users/ElliotGardiner/events{/privacy}","received_events_url":"https://api.github.com/users/ElliotGardiner/received_events","type":"User","site_admin":false},"repo":{"id":156737475,"node_id":"MDEwOlJlcG9zaXRvcnkxNTY3Mzc0NzU=","name":"kube2iam","full_name":"ElliotGardiner/kube2iam","private":false,"owner":{"login":"ElliotGardiner","id":2171689,"node_id":"MDQ6VXNlcjIxNzE2ODk=","avatar_url":"https://avatars1.githubusercontent.com/u/2171689?v=4","gravatar_id":"","url":"https://api.github.com/users/ElliotGardiner","html_url":"https://github.com/ElliotGardiner","followers_url":"https://api.github.com/users/ElliotGardiner/followers","following_url":"https://api.github.com/users/ElliotGardiner/following{/other_user}","gists_url":"https://api.github.com/users/ElliotGardiner/gists{/gist_id}","starred_url":"https://api.github.com/users/ElliotGardiner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ElliotGardiner/subscriptions","organizations_url":"https://api.github.com/users/ElliotGardiner/orgs","repos_url":"https://api.github.com/users/ElliotGardiner/repos","events_url":"https://api.github.com/users/ElliotGardiner/events{/privacy}","received_events_url":"https://api.github.com/users/ElliotGardiner/received_events","type":"User","site_admin":false},"html_url":"https://github.com/ElliotGardiner/kube2iam","description":"kube2iam  provides different AWS IAM roles for pods running on Kubernetes","fork":true,"url":"https://api.github.com/repos/ElliotGardiner/kube2iam","forks_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/forks","keys_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/keys{/key_id}","collaborators_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/teams","hooks_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/hooks","issue_events_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/issues/events{/number}","events_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/events","assignees_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/assignees{/user}","branches_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/branches{/branch}","tags_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/tags","blobs_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/git/refs{/sha}","trees_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/git/trees{/sha}","statuses_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/statuses/{sha}","languages_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/languages","stargazers_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/stargazers","contributors_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/contributors","subscribers_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/subscribers","subscription_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/subscription","commits_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/commits{/sha}","git_commits_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/git/commits{/sha}","comments_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/comments{/number}","issue_comment_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/issues/comments{/number}","contents_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/contents/{+path}","compare_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/compare/{base}...{head}","merges_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/merges","archive_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/downloads","issues_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/issues{/number}","pulls_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/pulls{/number}","milestones_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/milestones{/number}","notifications_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/labels{/name}","releases_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/releases{/id}","deployments_url":"https://api.github.com/repos/ElliotGardiner/kube2iam/deployments","created_at":"2018-11-08T16:38:40Z","updated_at":"2018-11-08T16:38:43Z","pushed_at":"2018-11-08T19:23:12Z","git_url":"git://github.com/ElliotGardiner/kube2iam.git","ssh_url":"git@github.com:ElliotGardiner/kube2iam.git","clone_url":"https://github.com/ElliotGardiner/kube2iam.git","svn_url":"https://github.com/ElliotGardiner/kube2iam","homepage":"","size":192,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"jtblin:master","ref":"master","sha":"8dc96cf636a6a7798c12d37bf30b4da4584d22e4","user":{"login":"jtblin","id":1388974,"node_id":"MDQ6VXNlcjEzODg5NzQ=","avatar_url":"https://avatars2.githubusercontent.com/u/1388974?v=4","gravatar_id":"","url":"https://api.github.com/users/jtblin","html_url":"https://github.com/jtblin","followers_url":"https://api.github.com/users/jtblin/followers","following_url":"https://api.github.com/users/jtblin/following{/other_user}","gists_url":"https://api.github.com/users/jtblin/gists{/gist_id}","starred_url":"https://api.github.com/users/jtblin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jtblin/subscriptions","organizations_url":"https://api.github.com/users/jtblin/orgs","repos_url":"https://api.github.com/users/jtblin/repos","events_url":"https://api.github.com/users/jtblin/events{/privacy}","received_events_url":"https://api.github.com/users/jtblin/received_events","type":"User","site_admin":false},"repo":{"id":58301572,"node_id":"MDEwOlJlcG9zaXRvcnk1ODMwMTU3Mg==","name":"kube2iam","full_name":"jtblin/kube2iam","private":false,"owner":{"login":"jtblin","id":1388974,"node_id":"MDQ6VXNlcjEzODg5NzQ=","avatar_url":"https://avatars2.githubusercontent.com/u/1388974?v=4","gravatar_id":"","url":"https://api.github.com/users/jtblin","html_url":"https://github.com/jtblin","followers_url":"https://api.github.com/users/jtblin/followers","following_url":"https://api.github.com/users/jtblin/following{/other_user}","gists_url":"https://api.github.com/users/jtblin/gists{/gist_id}","starred_url":"https://api.github.com/users/jtblin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jtblin/subscriptions","organizations_url":"https://api.github.com/users/jtblin/orgs","repos_url":"https://api.github.com/users/jtblin/repos","events_url":"https://api.github.com/users/jtblin/events{/privacy}","received_events_url":"https://api.github.com/users/jtblin/received_events","type":"User","site_admin":false},"html_url":"https://github.com/jtblin/kube2iam","description":"kube2iam  provides different AWS IAM roles for pods running on Kubernetes","fork":false,"url":"https://api.github.com/repos/jtblin/kube2iam","forks_url":"https://api.github.com/repos/jtblin/kube2iam/forks","keys_url":"https://api.github.com/repos/jtblin/kube2iam/keys{/key_id}","collaborators_url":"https://api.github.com/repos/jtblin/kube2iam/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/jtblin/kube2iam/teams","hooks_url":"https://api.github.com/repos/jtblin/kube2iam/hooks","issue_events_url":"https://api.github.com/repos/jtblin/kube2iam/issues/events{/number}","events_url":"https://api.github.com/repos/jtblin/kube2iam/events","assignees_url":"https://api.github.com/repos/jtblin/kube2iam/assignees{/user}","branches_url":"https://api.github.com/repos/jtblin/kube2iam/branches{/branch}","tags_url":"https://api.github.com/repos/jtblin/kube2iam/tags","blobs_url":"https://api.github.com/repos/jtblin/kube2iam/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/jtblin/kube2iam/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/jtblin/kube2iam/git/refs{/sha}","trees_url":"https://api.github.com/repos/jtblin/kube2iam/git/trees{/sha}","statuses_url":"https://api.github.com/repos/jtblin/kube2iam/statuses/{sha}","languages_url":"https://api.github.com/repos/jtblin/kube2iam/languages","stargazers_url":"https://api.github.com/repos/jtblin/kube2iam/stargazers","contributors_url":"https://api.github.com/repos/jtblin/kube2iam/contributors","subscribers_url":"https://api.github.com/repos/jtblin/kube2iam/subscribers","subscription_url":"https://api.github.com/repos/jtblin/kube2iam/subscription","commits_url":"https://api.github.com/repos/jtblin/kube2iam/commits{/sha}","git_commits_url":"https://api.github.com/repos/jtblin/kube2iam/git/commits{/sha}","comments_url":"https://api.github.com/repos/jtblin/kube2iam/comments{/number}","issue_comment_url":"https://api.github.com/repos/jtblin/kube2iam/issues/comments{/number}","contents_url":"https://api.github.com/repos/jtblin/kube2iam/contents/{+path}","compare_url":"https://api.github.com/repos/jtblin/kube2iam/compare/{base}...{head}","merges_url":"https://api.github.com/repos/jtblin/kube2iam/merges","archive_url":"https://api.github.com/repos/jtblin/kube2iam/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/jtblin/kube2iam/downloads","issues_url":"https://api.github.com/repos/jtblin/kube2iam/issues{/number}","pulls_url":"https://api.github.com/repos/jtblin/kube2iam/pulls{/number}","milestones_url":"https://api.github.com/repos/jtblin/kube2iam/milestones{/number}","notifications_url":"https://api.github.com/repos/jtblin/kube2iam/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/jtblin/kube2iam/labels{/name}","releases_url":"https://api.github.com/repos/jtblin/kube2iam/releases{/id}","deployments_url":"https://api.github.com/repos/jtblin/kube2iam/deployments","created_at":"2016-05-08T07:34:36Z","updated_at":"2018-11-19T06:25:49Z","pushed_at":"2018-11-08T19:23:13Z","git_url":"git://github.com/jtblin/kube2iam.git","ssh_url":"git@github.com:jtblin/kube2iam.git","clone_url":"https://github.com/jtblin/kube2iam.git","svn_url":"https://github.com/jtblin/kube2iam","homepage":"","size":188,"stargazers_count":871,"watchers_count":871,"language":"Go","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":133,"mirror_url":null,"archived":false,"open_issues_count":32,"license":{"key":"other","name":"Other","spdx_id":"NOASSERTION","url":null,"node_id":"MDc6TGljZW5zZTA="},"forks":133,"open_issues":32,"watchers":871,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/jtblin/kube2iam/pulls/177"},"html":{"href":"https://github.com/jtblin/kube2iam/pull/177"},"issue":{"href":"https://api.github.com/repos/jtblin/kube2iam/issues/177"},"comments":{"href":"https://api.github.com/repos/jtblin/kube2iam/issues/177/comments"},"review_comments":{"href":"https://api.github.com/repos/jtblin/kube2iam/pulls/177/comments"},"review_comment":{"href":"https://api.github.com/repos/jtblin/kube2iam/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/jtblin/kube2iam/pulls/177/commits"},"statuses":{"href":"https://api.github.com/repos/jtblin/kube2iam/statuses/d2f79d8a4962b6dbb9ec8c70a9b1c3f88b788f59"}},"author_association":"NONE"}}
{"actor":{"display_login":"ElliotGardiner"}}