-
Notifications
You must be signed in to change notification settings - Fork 419
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Make 15-minute token limit configurable #63
Comments
Our team has a similar setup - and have been using the generated |
I followed the referenced #75 and saw that this technical capability is more complex than it seems. The technical blocker is AWS. Their "Authenticating Requests (AWS Signature Version 4)" does not provide configurability with regard to the token's time limit. ( here is the referenced document) This is really unfortunate. I'm all 👍 for security, but this limitation destroys team productivity and creates frustration. My team loves our Kubernetes tooling as is, this 15 minute token limit will kill that joy once we we begin enforcing it. I'm hoping there is a way to address this or perhaps a scalable work around we could consider. Is there anyone reading this that works at AWS that could comment or recommend potential next steps to take to move in a direction that allows this token's time limit to be increased? |
Issues go stale after 90d of inactivity. If this issue is safe to close now please do so with Send feedback to sig-testing, kubernetes/test-infra and/or fejta. |
Increasing the pre-signed URL duration is not something we can do at this point, but let me know if #193 addressed the difficulties around MFA. It caches the temporary credentials instead of the token. |
Stale issues rot after 30d of inactivity. If this issue is safe to close now please do so with Send feedback to sig-testing, kubernetes/test-infra and/or fejta. |
Rotten issues close after 30d of inactivity. Send feedback to sig-testing, kubernetes/test-infra and/or fejta. |
@fejta-bot: Closing this issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
For anyone else affected by this 15 minute limitation that is interested in a sideways hack around this issue, I have created a proxy that performs the regular aws-iam-authentication every 10 minutes for you and injects the tokens into the requests as it forwards them on. Hopefully one day there will be the ability to authenticate for more than 15 minutes at a time, but for now this solution improves my productivity: |
Definitely seems like this is still relevant. Seems like AWS Signature Version 4 should allow some reasonable range of token expiration. What's the best way to approach that request? |
…ure/release-1.3.0 release 1.3.0
15 minutes is annoying short for my dev team's experience. We use Okta federated AWS authentication, so having to go through the password + 2FA dance every 15 minutes is really asking too much.
The text was updated successfully, but these errors were encountered: