Support flag to override listening address on serve

[KenFigueiredo]

Hey there!

I'm attempting to run the credential-helper in a container within Kubernetes where it is a standalone pod in serve mode.
Currently this runs into issues where I'm unable to reach the application running in serve mode due to the listening address binding being hardcoded to 127.0.0.1.

I've ran some manual validation where I've changed: https://github.com/aws/rolesanywhere-credential-helper/blob/main/aws_signing_helper/serve.go#L23 to 0.0.0.0 and this seems to resolve the issue.

To support this use case it would be worthwhile to add an additional startup flag --listening-addr that overrides that value but defaults to localhost to keep the current behavior.

Thanks!

[dwmw2]

This should not be limited to Legacy IP only. It's over a quarter of a century since the IPv6 standard was published.

[BeyondEvil]

This please.

As a workaround you can use socat

apiVersion: apps/v1
kind: Deployment
metadata:
  name: iamra-helper
  namespace: cert-manager
  labels:
    app: iamra-helper
spec:
  replicas: 1
  selector:
    matchLabels:
      app: iamra-helper
  template:
    metadata:
      labels:
        app: iamra-helper
    spec:
      containers:
        - name: iamra
          image: IMAGE-HERE
          command: ['aws_signing_helper']
          args:
            - 'serve'
            - '--certificate'
            - '/mnt/credentials/tls.crt'
            - '--private-key'
            - '/mnt/credentials/tls.key'
            - '--trust-anchor-arn'
            - '$(TRUST_ANCHOR_ARN)'
            - '--profile-arn'
            - '$(PROFILE_ARN)'
            - '--role-arn'
            - '$(ROLE_ARN)'
          env:
            - name: TRUST_ANCHOR_ARN
              valueFrom:
                configMapKeyRef:
                  key: IAMRA_TRUST_ANCHOR_ARN
                  name: iamra-helper
            - name: PROFILE_ARN
              valueFrom:
                configMapKeyRef:
                  key: IAMRA_PROFILE_ARN
                  name: iamra-helper
            - name: ROLE_ARN
              valueFrom:
                configMapKeyRef:
                  key: IAMRA_ROLE_ARN
                  name: iamra-helper
          volumeMounts:
            - mountPath: /mnt/credentials
              name: credentials
          resources:
            requests:
              memory: '64Mi'
              cpu: '50m'
            limits:
              memory: '128Mi'
          imagePullPolicy: IfNotPresent
        - name: socat
          image: alpine/socat
          command: ['socat']
          args: ['TCP-LISTEN:8080,fork,reuseaddr', 'TCP:127.0.0.1:9911']
          ports:
            - containerPort: 8080
          resources:
            requests:
              memory: '16Mi'
              cpu: '10m'
            limits:
              memory: '32Mi'
      volumes:
        - name: credentials
          secret:
            secretName: iamra-helper-cert

apiVersion: v1
kind: Service
metadata:
  name: iamra-helper
  namespace: cert-manager
  labels:
    app: iamra-helper
spec:
  selector:
    app: iamra-helper
  ports:
    - name: metadata
      port: 80
      targetPort: 8080

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-iamra-helper
  namespace: cert-manager
spec:
  podSelector:
    matchLabels:
      app: iamra-helper
  ingress:
    - from:
        - podSelector:
            matchLabels:
              access: iamra
  policyTypes:
    - Ingress

[philipmw]

There is a pull request for this feature: #29