Skip to content

Commit d289bc8

Browse files
committed
s3: allow config value for secrets refresh interval
1 parent 59031da commit d289bc8

File tree

2 files changed

+22
-3
lines changed

2 files changed

+22
-3
lines changed

backends/s3/credentials.go

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,9 @@ type FileSecretsCredentials struct {
2121
// Path to the file containing the secret key,
2222
// e.g. /etc/s3-secrets/secret-key.
2323
SecretKeyFile string
24+
25+
// Time between each secrets retrieval.
26+
RefreshInterval time.Duration
2427
}
2528

2629
// Retrieve implements credentials.Provider.
@@ -40,7 +43,7 @@ func (c *FileSecretsCredentials) Retrieve() (credentials.Value, error) {
4043
SecretAccessKey: string(secretKey),
4144
}
4245

43-
c.SetExpiration(time.Now().Add(time.Second), -1)
46+
c.SetExpiration(time.Now().Add(c.RefreshInterval), -1)
4447

4548
return creds, err
4649
}

backends/s3/s3.go

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,9 @@ const (
3737
// DefaultUpdateMarkerForceListInterval is the default value for
3838
// UpdateMarkerForceListInterval.
3939
DefaultUpdateMarkerForceListInterval = 5 * time.Minute
40+
// DefaultSecretsRefreshInterval is the default value for RefreshSecrets.
41+
// It should not be too high so as to retrieve secrets regularly.
42+
DefaultSecretsRefreshInterval = 15 * time.Second
4043
)
4144

4245
// Options describes the storage options for the S3 backend
@@ -55,6 +58,12 @@ type Options struct {
5558
// e.g. /etc/s3-secrets/secret-key.
5659
SecretKeyFile string `yaml:"secret_key_file"`
5760

61+
// Time between each secrets retrieval.
62+
// Minimum is 1s, lower values are considered an error.
63+
// It defaults to DefaultSecretsRefreshInterval,
64+
// which is currently 15s.
65+
SecretsRefreshInterval time.Duration `yaml:"secrets_refresh_interval"`
66+
5867
// Region defaults to "us-east-1", which also works for Minio
5968
Region string `yaml:"region"`
6069
Bucket string `yaml:"bucket"`
@@ -108,6 +117,9 @@ func (o Options) Check() error {
108117
if !hasSecretsCreds && !hasStaticCreds {
109118
return fmt.Errorf("s3 storage.options: credentials are required, fill either (access_key and secret_key) or (access_key_filename and secret_key_filename)")
110119
}
120+
if d := o.SecretsRefreshInterval; hasSecretsCreds && d != 0 && d < time.Second {
121+
return fmt.Errorf("s3 storage.options: field refresh_secrets is required when using secret credentials")
122+
}
111123
if o.Bucket == "" {
112124
return fmt.Errorf("s3 storage.options: bucket is required")
113125
}
@@ -298,6 +310,9 @@ func New(ctx context.Context, opt Options) (*Backend, error) {
298310
if opt.EndpointURL == "" {
299311
opt.EndpointURL = DefaultEndpointURL
300312
}
313+
if opt.SecretsRefreshInterval == 0 {
314+
opt.SecretsRefreshInterval = DefaultSecretsRefreshInterval
315+
}
301316
if err := opt.Check(); err != nil {
302317
return nil, err
303318
}
@@ -354,8 +369,9 @@ func New(ctx context.Context, opt Options) (*Backend, error) {
354369
creds := credentials.NewStaticV4(opt.AccessKey, opt.SecretKey, "")
355370
if opt.AccessKeyFile != "" {
356371
creds = credentials.New(&FileSecretsCredentials{
357-
AccessKeyFile: opt.AccessKeyFile,
358-
SecretKeyFile: opt.SecretKeyFile,
372+
AccessKeyFile: opt.AccessKeyFile,
373+
SecretKeyFile: opt.SecretKeyFile,
374+
RefreshInterval: opt.SecretsRefreshInterval,
359375
})
360376
}
361377

0 commit comments

Comments
 (0)