Distribution: Feature request: upgrade aws-sdk-go to support IRSA

[tmeneau]

Amazon recently released support for IRSA (IAM Roles for Service Accounts), which is supported starting in aws-sdk-go 1.23.13.

From my understanding the IRSA workflow checks environment variables for relevant credentials. If that's true, upgrading the aws-sdk-go dependency to >= 1.23.13 should do the trick here. Then again, it looks like Docker Distribution is currently using version 1.15.11, so this might require some peripheral changes.

References

• https://docs.aws.amazon.com/en_pv/eks/latest/userguide/iam-roles-for-service-accounts.html
• https://github.com/aws/containers-roadmap/issues/23

[jonathan-mothership]

I just tried building the registry with aws-sdk-go v1.28.2 and deploying to EKS to see if that would provide support for IRSA with no luck. I haven't looked too deeply at this but there might be more steps beyond bumping the SDK version.

[jackivanov]

any progress on this?

[cep21]

Hi, for context this will make deploying on EKS much easier and secure since we won't have to embed IAM credentials into our kub deployments.