Feature #23160
closedSalt installer grants access to Loki S3 backend bucket through roles instead of credentials
Description
The current implementation of Loki config is to create an access key/secret for the Loki service to write data to the S3 bucket.
This implies having clear text credentials on Loki's config file, something is not considered best practice.
We should give the Loki server access to the S3 data bucket via alternative means. One possibility can be adding those permissions to the Loki service instance profile.
Updated by Lucas Di Pentima 6 months ago
- Subject changed from salt installer grants access to Loki S3 backend bucket trhough roles instead of credentials to Salt installer grants access to Loki S3 backend bucket through roles instead of credentials
Updated by Brett Smith 6 months ago
- Release deleted (
81) - Target version changed from Future to Development 2025-10-01
- Assigned To set to Lucas Di Pentima
Updated by Lucas Di Pentima 6 months ago
Have been trying to set up an initial test cluster but bumped into this: https://github.com/phusion/passenger/issues/2625 -- hopefully it gets fixed soon.
Updated by Lucas Di Pentima 6 months ago
23160-installer-loki-s3-perms @ f2d860ba85
test-provision: #1296
run-tests-doc-pysdk-api-fuse: #1236 (for doc updates)
- All agreed upon points are implemented / addressed. Describe changes from pre-implementation design.
- Yes. Instead of using an IAM User with access key & secret, we now assign S3 access to Loki's bucket to the entire instance.
- Anything not implemented (discovered or discussed during work) has a follow-up story.
- No.
- Code is tested and passing, both automated and manual, what manual testing was done is described.
- Manually tested by deploying a multi node cluster in our sandbox account. Automated test-provision tests make sure that I haven't broken anything else.
- The tested code incorporates recent main branch changes.
- Yes
- New or changed UI/UX has gotten feedback from stakeholders.
- UI simplified as it's not necessary anymore to save access key & secret on
local.params.secrets
- UI simplified as it's not necessary anymore to save access key & secret on
- Documentation has been updated.
- Yes. Updated multi-node installation instructions and added a deprecation note in the Upgrading section.
- Behaves appropriately at the intended scale (describe intended scale).
- No change in scale
- Considered backwards and forwards compatibility issues between client and server.
- No incompatible changes with previous version. Old credentials are invalidated and cause no issues if left in
local.params.secretsfile.
- No incompatible changes with previous version. Old credentials are invalidated and cause no issues if left in
- Follows our coding standards and GUI style guidelines.
- N/A
Updated by Brett Smith 6 months ago
Updated by Lucas Di Pentima 6 months ago
- Status changed from In Progress to Resolved
Applied in changeset arvados|9231d6f14f0f9c2eb0681a44ee0ddc5fd0bb1f88.