app/services/clusters/aws/fetch_credentials_service.rb


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

# frozen_string_literal: true

module Clusters
  module Aws
    class FetchCredentialsService
      attr_reader :provision_role

      MissingRoleError = Class.new(StandardError)

      def initialize(provision_role, region:, provider: nil)
        @provision_role = provision_role
        @region = region
        @provider = provider
      end

      def execute
        raise MissingRoleError.new('AWS provisioning role not configured') unless provision_role.present?

        ::Aws::AssumeRoleCredentials.new(
          client: client,
          role_arn: provision_role.role_arn,
          role_session_name: session_name,
          external_id: provision_role.role_external_id
        ).credentials
      end

      private

      attr_reader :provider, :region

      def client
        ::Aws::STS::Client.new(credentials: gitlab_credentials, region: region)
      end

      def gitlab_credentials
        ::Aws::Credentials.new(access_key_id, secret_access_key)
      end

      def access_key_id
        Gitlab::CurrentSettings.eks_access_key_id
      end

      def secret_access_key
        Gitlab::CurrentSettings.eks_secret_access_key
      end

      def session_name
        if provider.present?
          "gitlab-eks-cluster-#{provider.cluster_id}-user-#{provision_role.user_id}"
        else
          "gitlab-eks-autofill-user-#{provision_role.user_id}"
        end
      end
    end
  end
end