diff --git a/README.md b/README.md index 3440e173..7f68c613 100644 --- a/README.md +++ b/README.md @@ -330,10 +330,14 @@ require 'aws-sdk-core' credentials = Aws::Credentials.new(access_key, secret_key) # Or a profile credentials = Aws::SharedCredentials.new(profile_name: 'default').credentials +# Or for an STS Assumed Role Credentials or any other credential Provider other than Static Credentials +credentials = Aws::AssumeRoleCredentials.new({ client: sts_client, role_arn: role_arn, role_session_name: session_name }) +# Kubeclient Auth Options auth_options = { bearer_token: Kubeclient::AmazonEksCredentials.token(credentials, eks_cluster_name) } + client = Kubeclient::Client.new( eks_cluster_https_endpoint, 'v1', auth_options: auth_options ) diff --git a/lib/kubeclient/aws_eks_credentials.rb b/lib/kubeclient/aws_eks_credentials.rb index 1522c958..2e018f73 100644 --- a/lib/kubeclient/aws_eks_credentials.rb +++ b/lib/kubeclient/aws_eks_credentials.rb @@ -20,11 +20,21 @@ def token(credentials, eks_cluster, region: 'us-east-1') end # https://github.com/aws/aws-sdk-ruby/pull/1848 # Get a signer - signer = Aws::Sigv4::Signer.new( - service: 'sts', - region: region, - credentials: credentials - ) + signer = if credentials.respond_to?(:credentials) + Aws::Sigv4::Signer.new( + service: 'sts', + region: region, + credentials_provider: credentials + ) + else + Aws::Sigv4::Signer.new( + service: 'sts', + region: region, + credentials: credentials + ) + end + + credentials = credentials.credentials if credentials.respond_to?(:credentials) # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/Sigv4/Signer.html#presign_url-instance_method presigned_url_string = signer.presign_url(