Repository: zalando-incubator/kube-ingress-aws-controller
Pull request #550 (2022-09-14 15:28:26)

Bump github.com/aws/aws-sdk-go from 1.44.91 to 1.44.97
Bumps [github.com/aws/aws-sdk-go](https://github.com/aws/aws-sdk-go) from 1.44.91 to 1.44.97.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/aws/aws-sdk-go/releases">github.com/aws/aws-sdk-go's releases</a>.</em></p>
<blockquote>
<h1>Release v1.44.97 (2022-09-13)</h1>
<h3>Service Client Updates</h3>
<ul>
<li><code>service/customer-profiles</code>: Updates service API and documentation</li>
<li><code>service/drs</code>: Updates service API and documentation</li>
<li><code>service/ec2</code>: Updates service API and documentation
<ul>
<li>Two new features for local gateway route tables: support for static routes targeting Elastic Network Interfaces and direct VPC routing.</li>
</ul>
</li>
<li><code>service/evidently</code>: Updates service API and documentation</li>
<li><code>service/kendra</code>: Updates service API and documentation
<ul>
<li>This release enables our customer to choose the option of Sharepoint 2019 for the on-premise Sharepoint connector.</li>
</ul>
</li>
<li><code>service/transfer</code>: Updates service API and documentation
<ul>
<li>This release introduces the ability to have multiple server host keys for any of your Transfer Family servers that use the SFTP protocol.</li>
</ul>
</li>
</ul>
<h1>Release v1.44.96 (2022-09-12)</h1>
<h3>Service Client Updates</h3>
<ul>
<li><code>service/eks</code>: Updates service API and documentation</li>
</ul>
<h1>Release v1.44.95 (2022-09-09)</h1>
<h3>Service Client Updates</h3>
<ul>
<li><code>service/cloudtrail</code>: Updates service API, documentation, and paginators
<ul>
<li>This release adds CloudTrail getChannel and listChannels APIs to allow customer to view the ServiceLinkedChannel configurations.</li>
</ul>
</li>
<li><code>service/models.lex.v2</code>: Updates service API and documentation</li>
<li><code>service/pi</code>: Updates service API</li>
<li><code>service/redshift</code>: Updates service documentation
<ul>
<li>This release updates documentation for AQUA features and other description updates.</li>
</ul>
</li>
<li><code>service/runtime.lex.v2</code>: Updates service API and documentation</li>
</ul>
<h1>Release v1.44.94 (2022-09-08)</h1>
<h3>Service Client Updates</h3>
<ul>
<li><code>service/ec2</code>: Updates service API and documentation
<ul>
<li>This release adds support to send VPC Flow Logs to kinesis-data-firehose as new destination type</li>
</ul>
</li>
<li><code>service/emr-containers</code>: Updates service API and documentation</li>
<li><code>service/lookoutmetrics</code>: Updates service API and documentation</li>
<li><code>service/medialive</code>: Updates service API and documentation
<ul>
<li>This change exposes API settings which allow Dolby Atmos and Dolby Vision to be used when running a channel using Elemental Media Live</li>
</ul>
</li>
<li><code>service/route53</code>: Updates service API and documentation
<ul>
<li>Amazon Route 53 now supports the Middle East (UAE) Region (me-central-1) for latency records, geoproximity records, and private DNS for Amazon VPCs in that region.</li>
</ul>
</li>
<li><code>service/sagemaker</code>: Updates service API and documentation
<ul>
<li>This release adds Mode to AutoMLJobConfig.</li>
</ul>
</li>
<li><code>service/ssm</code>: Updates service API and documentation
<ul>
<li>This release adds support for Systems Manager State Manager Association tagging.</li>
</ul>
</li>
</ul>
<p>Release v1.44.93 (2022-09-07)</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/aws/aws-sdk-go/commit/6fa20357e9892dabcdf3092069db7075af9c5df8"><code>6fa2035</code></a> Release v1.44.97 (2022-09-13) (<a href="https://github-redirect.dependabot.com/aws/aws-sdk-go/issues/4556">#4556</a>)</li>
<li><a href="https://github.com/aws/aws-sdk-go/commit/6fcfde5b3429cb00ea9dfc16157299cc6ec0bcaf"><code>6fcfde5</code></a> Release v1.44.96 (2022-09-12) (<a href="https://github-redirect.dependabot.com/aws/aws-sdk-go/issues/4555">#4555</a>)</li>
<li><a href="https://github.com/aws/aws-sdk-go/commit/9e7ca5ae08141365830537ac3a480fa44e92997f"><code>9e7ca5a</code></a> Release v1.44.95 (2022-09-09) (<a href="https://github-redirect.dependabot.com/aws/aws-sdk-go/issues/4553">#4553</a>)</li>
<li><a href="https://github.com/aws/aws-sdk-go/commit/2f6c8c48d30e47f5ec3ac2a59bd521fafb99d69d"><code>2f6c8c4</code></a> Release v1.44.94 (2022-09-08) (<a href="https://github-redirect.dependabot.com/aws/aws-sdk-go/issues/4551">#4551</a>)</li>
<li><a href="https://github.com/aws/aws-sdk-go/commit/e7580638c40d98f4fe9bb475db0b65605ddad81e"><code>e758063</code></a> Release v1.44.93 (2022-09-07) (<a href="https://github-redirect.dependabot.com/aws/aws-sdk-go/issues/4550">#4550</a>)</li>
<li><a href="https://github.com/aws/aws-sdk-go/commit/0fd00b9cda788fd459184e92e57ee25d3c816dcc"><code>0fd00b9</code></a> Release v1.44.92 (2022-09-06) (<a href="https://github-redirect.dependabot.com/aws/aws-sdk-go/issues/4548">#4548</a>)</li>
<li>See full diff in <a href="https://github.com/aws/aws-sdk-go/compare/v1.44.91...v1.44.97">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/aws/aws-sdk-go&package-manager=go_modules&previous-version=1.44.91&new-version=1.44.97)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


Patch:
diff --git a/go.mod b/go.mod
index 3eb26e5..3d5b1f1 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/zalando-incubator/kube-ingress-aws-controller
 go 1.18
 
 require (
-	github.com/aws/aws-sdk-go v1.44.91
+	github.com/aws/aws-sdk-go v1.44.97
 	github.com/ghodss/yaml v1.0.0
 	github.com/google/go-cmp v0.5.8
 	github.com/google/uuid v1.3.0
diff --git a/go.sum b/go.sum
index a849fcd..493b3b9 100644
--- a/go.sum
+++ b/go.sum
@@ -60,8 +60,8 @@ github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
 github.com/aryszka/jobqueue v0.0.2 h1:LYPhzklo0XFpVF+QtzfP9XRQPEsbJ2EW5Pur6pxxaS4=
 github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
-github.com/aws/aws-sdk-go v1.44.91 h1:SRWmuX7PTyhBdLuvSfM7KWrWISJsrRsUPcFDSFduRxY=
-github.com/aws/aws-sdk-go v1.44.91/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
+github.com/aws/aws-sdk-go v1.44.97 h1:lxgxp7d6uuGsP7jHKIX3GHd7ExFigCIF04VuKf8XUII=
+github.com/aws/aws-sdk-go v1.44.97/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
diff --git a/kubernetes/adapter.go b/kubernetes/adapter.go
index 9263982..615cff1 100644
--- a/kubernetes/adapter.go
+++ b/kubernetes/adapter.go
@@ -395,7 +395,7 @@ func (a *Adapter) UpdateIngressLoadBalancer(ingress *Ingress, loadBalancerDNSNam
 	case TypeIngress:
 		return a.ingressClient.updateIngressLoadBalancer(a.kubeClient, ingress.Namespace, ingress.Name, loadBalancerDNSName)
 	}
-	return fmt.Errorf("Unknown resourceType '%s', failed to update Kubernetes resource", ingress.ResourceType)
+	return fmt.Errorf("unknown resourceType '%s', failed to update Kubernetes resource", ingress.ResourceType)
 }
 
 // GetConfigMap retrieves the ConfigMap with name from namespace.
diff --git a/kubernetes/client.go b/kubernetes/client.go
index 5ec196b..2b334e7 100644
--- a/kubernetes/client.go
+++ b/kubernetes/client.go
@@ -154,8 +154,12 @@ func (c *simpleClient) createRequest(method, resource string, body io.Reader) (*
 	if c.cfg.UserAgent != "" {
 		req.Header.Set("User-Agent", c.cfg.UserAgent)
 	}
-	if c.cfg.BearerToken != "" {
-		req.Header.Set("Authorization", "Bearer "+c.cfg.BearerToken)
+	if c.cfg.TokenProvider != nil {
+		token, ok := c.cfg.TokenProvider.GetSecret(serviceAccountTokenKey)
+		if !ok {
+			return nil, fmt.Errorf("secret not found: %v", serviceAccountTokenKey)
+		}
+		req.Header.Set("Authorization", "Bearer "+string(token))
 	}
 	return req, nil
 }
@@ -163,7 +167,7 @@ func (c *simpleClient) createRequest(method, resource string, body io.Reader) (*
 func (a *Adapter) NewInclusterConfigClientset(ctx context.Context) error {
 	cfg, err := rest.InClusterConfig()
 	if err != nil {
-		return fmt.Errorf("Can't get in cluster config: %w", err)
+		return fmt.Errorf("can't get in cluster config: %w", err)
 	}
 	// cfg.Timeout = timeout
 	trCfg, err := cfg.TransportConfig()
diff --git a/kubernetes/config.go b/kubernetes/config.go
index f401bb4..9f37e89 100644
--- a/kubernetes/config.go
+++ b/kubernetes/config.go
@@ -1,9 +1,12 @@
 package kubernetes
 
 import (
+	"fmt"
 	"net"
 	"os"
 	"time"
+
+	"github.com/zalando/skipper/secrets"
 )
 
 // Config holds the common attributes that can be passed to a
@@ -17,7 +20,7 @@ type Config struct {
 	// Server requires Bearer authentication. This client will not
 	// attempt to use refresh tokens for an OAuth2 flow.
 	// TODO: demonstrate an OAuth2 compatible client.
-	BearerToken string
+	TokenProvider secrets.SecretsProvider
 
 	// TLSClientConfig contains settings to enable transport layer
 	// security
@@ -67,10 +70,13 @@ func InClusterConfig() (*Config, error) {
 	}
 
 	dir := serviceAccountLocator()
-	token, err := os.ReadFile(dir + serviceAccountTokenKey)
+	tokenProvider := secrets.NewSecretPaths(time.Minute)
+	err := tokenProvider.Add(dir + serviceAccountTokenKey)
+
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("error when adding token file to token provider: %v", err)
 	}
+
 	rootCAFile := dir + serviceAccountRootCAKey
 	if _, err := os.Stat(rootCAFile); os.IsNotExist(err) {
 		return nil, err
@@ -79,7 +85,7 @@ func InClusterConfig() (*Config, error) {
 	return &Config{
 		BaseURL:         "https://" + net.JoinHostPort(host, port),
 		UserAgent:       "kube-ingress-aws-controller",
-		BearerToken:     string(token),
+		TokenProvider:   tokenProvider,
 		Timeout:         10 * time.Second,
 		TLSClientConfig: TLSClientConfig{CAFile: rootCAFile},
 	}, nil
diff --git a/kubernetes/pods.go b/kubernetes/pods.go
index a4f42c3..b358b4b 100644
--- a/kubernetes/pods.go
+++ b/kubernetes/pods.go
@@ -29,7 +29,7 @@ func (a *Adapter) PodInformer(ctx context.Context, endpointChan chan<- []string)
 	informer := factory.Core().V1().Pods().Informer()
 	factory.Start(ctx.Done())
 	if !cache.WaitForCacheSync(ctx.Done(), informer.HasSynced) {
-		return fmt.Errorf("Timed out waiting for caches to sync")
+		return fmt.Errorf("timed out waiting for caches to sync")
 	}
 
 	// list warms the pod cache and verifies whether pods for given specs can be found, preventing to fail silently


Test patch:
diff --git a/kubernetes/adapter_test.go b/kubernetes/adapter_test.go
index ecbb123..730338b 100644
--- a/kubernetes/adapter_test.go
+++ b/kubernetes/adapter_test.go
@@ -469,8 +469,8 @@ func TestInsecureConfig(t *testing.T) {
 	if cfg.CAFile != "" {
 		t.Error("unexpected CAFile attribute")
 	}
-	if cfg.BearerToken != "" {
-		t.Error("unexpected Bearer token attribute")
+	if cfg.TokenProvider != nil {
+		t.Error("unexpected token provider attribute")
 	}
 	if cfg.UserAgent != defaultControllerUserAgent {
 		t.Error("unexpected User Agent attribute")
diff --git a/kubernetes/client_test.go b/kubernetes/client_test.go
index f7a0b68..0e37f0c 100644
--- a/kubernetes/client_test.go
+++ b/kubernetes/client_test.go
@@ -166,7 +166,7 @@ func TestTLS(t *testing.T) {
 	cfg := &Config{
 		BaseURL:         server.URL,
 		UserAgent:       "kube-ingress-aws-controller",
-		BearerToken:     "foo",
+		TokenProvider:   mockSecretProvider("foo"),
 		TLSClientConfig: TLSClientConfig{CAFile: "testdata/cert.pem"},
 		Timeout:         5 * time.Second,
 	}
@@ -183,3 +183,17 @@ func TestTLS(t *testing.T) {
 		defer r.Close()
 	}
 }
+
+// mock the SecretProvider from skipper module
+type mockSecretProvider string
+
+func (sp mockSecretProvider) GetSecret(_ string) ([]byte, bool) {
+	return []byte(sp), true
+}
+
+func (sp mockSecretProvider) Add(_ string) error {
+	return nil
+}
+
+func (sp mockSecretProvider) Close() {
+}