feat: Supporting using pod default credentials for Integration Source and Sink #8731

qswinson · 2025-09-17T19:23:10Z

Proposed Changes

This PR adds support for using the pod AWS default credentials for IntegrationSource and IntegrationSink resources. It adds an optional property .spec.aws.auth.serviceAccountName to specify the ServiceAccount the pod should run as. The ServiceAccount applies the desired role to the pod as the default credentials.

This change requires the latest images from aws-*-source in order for the Camel useDefaultCredentialsProvider property to be loaded from the environment variable.

Pre-review Checklist

At least 80% unit test coverage
E2E tests for any new behavior
Docs PR for any user-facing impact
Spec PR for any new API feature
Conformance test for any change to the spec

Release Note

Add support for using Pod default credentials in AWS IntegrationSource and IntegrationSink resources by specifying a ServiceAccount.

Docs
knative/docs#6394

knative-prow · 2025-09-17T19:23:19Z

Welcome @qswinson! It looks like this is your first PR to knative/eventing 🎉

knative-prow · 2025-09-17T19:23:20Z

Hi @qswinson. Thanks for your PR.

I'm waiting for a knative member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

dprotaso · 2025-09-18T00:59:09Z

/ok-to-test

codecov · 2025-09-18T01:07:10Z

Codecov Report

❌ Patch coverage is 43.18182% with 25 lines in your changes missing coverage. Please review.
✅ Project coverage is 50.60%. Comparing base (bfd6957) to head (f282427).
⚠️ Report is 5 commits behind head on main.

Files with missing lines	Patch %	Lines
...iler/integration/sink/resources/container_image.go	42.85%	11 Missing and 1 partial ⚠️
...er/integration/source/resources/containersource.go	47.61%	10 Missing and 1 partial ⚠️
pkg/apis/common/integration/v1alpha1/auth.go	0.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8731      +/-   ##
==========================================
+ Coverage   50.23%   50.60%   +0.36%     
==========================================
  Files         409      409              
  Lines       26665    26707      +42     
==========================================
+ Hits        13396    13515     +119     
+ Misses      12427    12341      -86     
- Partials      842      851       +9

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

dprotaso · 2025-09-18T14:17:38Z

/retest

dprotaso

LGTM

Added a question for the maintainers.

dprotaso · 2025-09-18T14:23:39Z

pkg/apis/common/integration/v1alpha1/auth.go

 	AccessKey string `json:"accessKey,omitempty"`

 	// SecretKey is the AWS secret access key.
 	SecretKey string `json:"secretKey,omitempty"`


@matzew @creydr how come I don't see this and accessKey field in the Integration* CRDs. Is stuff read from the secret and then these fields populated?

yes, that is via secret and there populated

qswinson · 2025-09-22T19:33:23Z

/retest

dprotaso · 2025-09-23T18:22:50Z

@qswinson I don't think it's a flake but a side-effect of something in your PR.

Looking at the testgrid here the test is stable - https://testgrid.k8s.io/r/knative-own-testgrid/eventing#continuous&include-filter-by-regex=TestIntegrationSourceWithTLS

dprotaso · 2025-09-29T16:54:48Z

cc @matzew @creydr for a review in the meantime

matzew · 2025-10-01T06:12:19Z

pkg/reconciler/integration/source/resources/containersource.go

 			}...)
+		} else {
+			envVars = append(envVars, corev1.EnvVar{
+				Name:  "CAMEL_KAMELET_AWS_S3_SOURCE_USEDEFAULTCREDENTIALSPROVIDER",


I think we should use the new version of supported ENV_VARs, seE: https://github.com/knative-extensions/eventing-integrations/blob/main/aws-s3-sink/properties.adoc

/cc @christophd

yes +1 for more readability

knative-prow · 2025-10-01T06:12:22Z

@matzew: GitHub didn't allow me to request PR reviews from the following users: christophd.

Note that only knative members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

I think we should use the new version of supported ENV_VARs, seE: https://github.com/knative-extensions/eventing-integrations/blob/main/aws-s3-sink/properties.adoc

/cc @christophd

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

dprotaso · 2025-10-02T15:55:21Z

/test reconciler-tests_eventing_main

dprotaso · 2025-10-02T15:55:30Z

/lgtm

dprotaso · 2025-10-02T16:01:45Z

Leaving approval for @matzew & @creydr

matzew

/lgtm
/approve

knative-prow · 2025-10-08T07:24:10Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: matzew, qswinson

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [matzew]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

dprotaso · 2025-10-08T12:32:06Z

/retest

dprotaso · 2025-10-08T15:01:55Z

I pushed a change increase the timeout. The reconciler failures were from cert manager certs not being deleted fast enough.

creydr · 2025-10-08T15:35:10Z

/lgtm

dprotaso · 2025-10-08T16:29:59Z

thanks @qswinson 🎉

Supporting using pod default credentials for Integration Source and Sink

1e60f57

knative-prow bot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Sep 17, 2025

knative-prow bot requested review from Cali0707 and matzew September 17, 2025 19:23

qswinson mentioned this pull request Sep 17, 2025

Add documentation for AWS sink and source authentication knative/docs#6394

Merged

knative-prow bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Sep 18, 2025

dprotaso reviewed Sep 18, 2025

View reviewed changes

dprotaso assigned matzew and creydr Sep 18, 2025

matzew reviewed Oct 1, 2025

View reviewed changes

qswinson added 2 commits October 1, 2025 15:45

use different environment variables

fb160b5

Merge remote-tracking branch 'origin/main' into aws-default-creds

2468aea

qswinson requested review from christophd, dprotaso and matzew October 2, 2025 01:11

knative-prow bot assigned dprotaso Oct 2, 2025

knative-prow bot added the lgtm Indicates that a PR is ready to be merged. label Oct 2, 2025

matzew approved these changes Oct 8, 2025

View reviewed changes

knative-prow bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 8, 2025

increase timeout in TLS test to allow cert manager to clean itself up

f282427

knative-prow bot added area/test-and-release Test infrastructure, tests or release and removed lgtm Indicates that a PR is ready to be merged. labels Oct 8, 2025

knative-prow bot added the lgtm Indicates that a PR is ready to be merged. label Oct 8, 2025

knative-prow bot merged commit 3f59df1 into knative:main Oct 8, 2025
36 checks passed

feat: Supporting using pod default credentials for Integration Source and Sink #8731

feat: Supporting using pod default credentials for Integration Source and Sink #8731

Uh oh!

Conversation

qswinson commented Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed Changes

Pre-review Checklist

Uh oh!

knative-prow bot commented Sep 17, 2025

Uh oh!

knative-prow bot commented Sep 17, 2025

Uh oh!

dprotaso commented Sep 18, 2025

Uh oh!

codecov bot commented Sep 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

dprotaso commented Sep 18, 2025

Uh oh!

dprotaso left a comment

Choose a reason for hiding this comment

Uh oh!

dprotaso Sep 18, 2025

Choose a reason for hiding this comment

Uh oh!

matzew Oct 1, 2025

Choose a reason for hiding this comment

Uh oh!

qswinson commented Sep 22, 2025

Uh oh!

dprotaso commented Sep 23, 2025

Uh oh!

dprotaso commented Sep 29, 2025

Uh oh!

matzew Oct 1, 2025

Choose a reason for hiding this comment

Uh oh!

christophd Oct 1, 2025

Choose a reason for hiding this comment

Uh oh!

knative-prow bot commented Oct 1, 2025

Uh oh!

dprotaso commented Oct 2, 2025

Uh oh!

dprotaso commented Oct 2, 2025

Uh oh!

dprotaso commented Oct 2, 2025

Uh oh!

matzew left a comment

Choose a reason for hiding this comment

Uh oh!

knative-prow bot commented Oct 8, 2025

Uh oh!

dprotaso commented Oct 8, 2025

Uh oh!

dprotaso commented Oct 8, 2025

Uh oh!

creydr commented Oct 8, 2025

Uh oh!

Uh oh!

dprotaso commented Oct 8, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

qswinson commented Sep 17, 2025 •

edited

Loading

codecov bot commented Sep 18, 2025 •

edited

Loading