auth: Disable the Authorization header for ECR redirects. #6728
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ECR uses S3 pre-signed URLs for OCI blobs. If the ECR auth header is added to the pre-signed URL, S3 returns a 400 error. We address the issue by checking whether the request host matches the one specified in the OCI configuration. Signed-off-by: Grégoire Payen de La Garanderie <gregoire.payen.de.la.garanderie@intel.com>
|
@ashutosh-narkar Yes, I have tested ECR with the S3 redirection. As far as I am aware, ECR always does a redirection to S3. For testing, we also ported this change to opa-envoy-plugin and deployed it as a K8s sidecar and it is working as expected. |
ashutosh-narkar
approved these changes
May 9, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Why the changes in this PR are needed?
I am attempting to address #6580
ECR serves OCI blobs by redirecting to S3 using pre-signed URLs. Currently, OPA adds the ECR auth header to the S3 request in addition to the pre-signed parameter, and S3 returns a 400 Bad Request:
What are the changes in this PR?
I removed the auth header from the redirects to S3.
I hesitated between checking whether the request is generated by a 307 redirect, or whether the request host matches the host specified in the OPA OCI config. I went for the second option because http auth is usually tied to a specific origin, and should not be shared across origin. The
Preparefunction adds the auth header only if the host matches, and returns early if doesn’t.