diff options
Diffstat (limited to 'jdisc-cloud-aws/src/main/java/com/yahoo/jdisc/cloud')
-rw-r--r-- | jdisc-cloud-aws/src/main/java/com/yahoo/jdisc/cloud/aws/VespaAwsCredentialsProvider.java | 56 |
1 files changed, 49 insertions, 7 deletions
diff --git a/jdisc-cloud-aws/src/main/java/com/yahoo/jdisc/cloud/aws/VespaAwsCredentialsProvider.java b/jdisc-cloud-aws/src/main/java/com/yahoo/jdisc/cloud/aws/VespaAwsCredentialsProvider.java index fc9c03a824a..6de8b5c0142 100644 --- a/jdisc-cloud-aws/src/main/java/com/yahoo/jdisc/cloud/aws/VespaAwsCredentialsProvider.java +++ b/jdisc-cloud-aws/src/main/java/com/yahoo/jdisc/cloud/aws/VespaAwsCredentialsProvider.java @@ -14,45 +14,87 @@ import java.io.IOException; import java.io.UncheckedIOException; import java.nio.file.Files; import java.nio.file.Path; +import java.time.Clock; +import java.time.Duration; +import java.time.Instant; import java.util.concurrent.atomic.AtomicReference; +import java.util.logging.Level; +import java.util.logging.Logger; public class VespaAwsCredentialsProvider implements AWSCredentialsProvider { + private static final Logger logger = Logger.getLogger(VespaAwsCredentialsProvider.class.getName()); private static final String DEFAULT_CREDENTIALS_PATH = "/opt/vespa/var/vespa/aws/credentials.json"; - - private final AtomicReference<AWSCredentials> credentials = new AtomicReference<>(); + private static final Duration REFRESH_INTERVAL = Duration.ofMinutes(30); + private final AtomicReference<Credentials> credentials = new AtomicReference<>(); private final Path credentialsPath; - + private final Clock clock; public VespaAwsCredentialsProvider() { - this.credentialsPath = Path.of(DEFAULT_CREDENTIALS_PATH); + this(Path.of(DEFAULT_CREDENTIALS_PATH), Clock.systemUTC()); + } + + VespaAwsCredentialsProvider(Path credentialsPath, Clock clock) { + this.credentialsPath = credentialsPath; + this.clock = clock; refresh(); } @Override public AWSCredentials getCredentials() { - return credentials.get(); + Credentials sessionCredentials = credentials.get(); + if (Duration.between(clock.instant(), sessionCredentials.expiry).abs().compareTo(REFRESH_INTERVAL)<0) { + refresh(); + sessionCredentials = credentials.get(); + } + return sessionCredentials; } @Override public void refresh() { try { + logger.log(Level.FINE, "Refreshing credentials from disk"); credentials.set(readCredentials()); } catch (Exception e) { throw new RuntimeException("Unable to get credentials. Please ensure cluster is configured as exclusive. See: https://cloud.vespa.ai/en/reference/services#nodes"); } } - private AWSSessionCredentials readCredentials() { + private Credentials readCredentials() { try { Slime slime = SlimeUtils.jsonToSlime(Files.readAllBytes(credentialsPath)); Cursor cursor = slime.get(); String accessKey = cursor.field("awsAccessKey").asString(); String secretKey = cursor.field("awsSecretKey").asString(); String sessionToken = cursor.field("sessionToken").asString(); - return new BasicSessionCredentials(accessKey, secretKey, sessionToken); + Instant defaultExpiry = Instant.now().plus(Duration.ofHours(1)); + Instant expiry; + try { + expiry = SlimeUtils.optionalString(cursor.field("expiry")).map(Instant::parse).orElse(defaultExpiry); + } catch (Exception e) { + expiry = defaultExpiry; + logger.warning("Unable to read expiry from credentials"); + } + return new Credentials(accessKey, secretKey, sessionToken, expiry); } catch (IOException e) { throw new UncheckedIOException(e); } } + + record Credentials (String awsAccessKey, String awsSecretKey, String sessionToken, Instant expiry) implements AWSSessionCredentials { + @Override + public String getSessionToken() { + return sessionToken; + } + + @Override + public String getAWSAccessKeyId() { + return awsAccessKey; + } + + @Override + public String getAWSSecretKey() { + return awsSecretKey; + } + } } |