You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@dolphinscheduler.apache.org by "Zzih96 (via GitHub)" <gi...@apache.org> on 2026/01/12 02:02:38 UTC
[I] [Feature][authentication] Add AWS WebIdentityTokenCredentialsProvider authentication [dolphinscheduler]
Zzih96 opened a new issue, #17867:
URL: https://github.com/apache/dolphinscheduler/issues/17867
### Search before asking
- [x] I had searched in the [issues](https://github.com/apache/dolphinscheduler/issues?q=is%3Aissue) and found no similar feature requirement.
### Description
Add AWS WebIdentityTokenCredentialsProvider authentication
<img width="2250" height="1270" alt="Image" src="https://github.com/user-attachments/assets/9f99d6b7-b621-4dc8-82a2-a02dafe9c745" />
### Use case
Add AWS WebIdentityTokenCredentialsProvider authentication
### Related issues
--
### Are you willing to submit a PR?
- [x] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Feature][Authentication] Add AWS WebIdentityTokenCredentialsProvider authentication [dolphinscheduler]
Posted by "Zzih96 (via GitHub)" <gi...@apache.org>.
Zzih96 commented on issue #17867:
URL: https://github.com/apache/dolphinscheduler/issues/17867#issuecomment-3737544025
> Hi [@Zzih96](https://github.com/Zzih96) , I'm curious, in what scenario will you use this function?
Using IRSA for AWS authentication in a Kubernetes environment.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Feature][Authentication] Add AWS WebIdentityTokenCredentialsProvider authentication [dolphinscheduler]
Posted by "SbloodyS (via GitHub)" <gi...@apache.org>.
SbloodyS commented on issue #17867:
URL: https://github.com/apache/dolphinscheduler/issues/17867#issuecomment-3737568090
> Using IRSA for AWS authentication in a Kubernetes environment.
AFAIK, DS has no plugins that implemented `AWS EKS`. And the most commonly used `AWS S3` does not use this verification method. So what is the scenario of this function on DS?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Feature][Authentication] Add AWS WebIdentityTokenCredentialsProvider authentication [dolphinscheduler]
Posted by "SbloodyS (via GitHub)" <gi...@apache.org>.
SbloodyS commented on issue #17867:
URL: https://github.com/apache/dolphinscheduler/issues/17867#issuecomment-3737771531
> When DolphinScheduler runs in a Kubernetes Pod, the AWS SDK automatically uses environment variables
> (AWS_WEB_IDENTITY_TOKEN_FILE, AWS_ROLE_ARN) to authenticate.
Deploying DS in `AWS EKS` is not aware of the interior of DS itself. This has nothing to do with the deployment of DS in `AWS EKS`.
BTW, from my experience, the best practice is to use `Role-based` strategy when using `AWS` services. And for `AWS S3`, `WebIdentityTokenCredentialsProvider ` is a way used by very few users.
So I think we don't need this feature.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Feature][Authentication] Add AWS WebIdentityTokenCredentialsProvider authentication [dolphinscheduler]
Posted by "SbloodyS (via GitHub)" <gi...@apache.org>.
SbloodyS closed issue #17867: [Feature][Authentication] Add AWS WebIdentityTokenCredentialsProvider authentication
URL: https://github.com/apache/dolphinscheduler/issues/17867
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Feature][Authentication] Add AWS WebIdentityTokenCredentialsProvider authentication [dolphinscheduler]
Posted by "Zzih96 (via GitHub)" <gi...@apache.org>.
Zzih96 commented on issue #17867:
URL: https://github.com/apache/dolphinscheduler/issues/17867#issuecomment-3737734476
> > Using IRSA for AWS authentication in a Kubernetes environment.
>
> AFAIK, DS has no plugins that implemented `AWS EKS`. And the most commonly used `AWS S3` does not use this verification method. So what is the scenario of this function on DS?
I think there's a misunderstanding - this isn't about a specific AWS service. WebIdentityToken authentication is supported by all AWS services (S3, EMR, Glue, Athena, etc.), not just EKS.
When DolphinScheduler runs in a Kubernetes Pod, the AWS SDK automatically uses environment variables (AWS_WEB_IDENTITY_TOKEN_FILE, AWS_ROLE_ARN) to authenticate. The problem is DolphinScheduler's AwsCredentialsProvider doesn't include this provider in its chain, so it can't use IRSA even when properly configured.
This PR adds the missing WebIdentityTokenCredentialsProvider to support AWS's recommended authentication for Kubernetes deployments.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [Feature][authentication] Add AWS WebIdentityTokenCredentialsProvider authentication [dolphinscheduler]
Posted by "SbloodyS (via GitHub)" <gi...@apache.org>.
SbloodyS commented on issue #17867:
URL: https://github.com/apache/dolphinscheduler/issues/17867#issuecomment-3736719929
Hi @Zzih96 , I'm curious, in what scenario will you use this function?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org