Skip to content

Fix credential provider chain for aws_request_signing filter#45644

Open
freedomljc wants to merge 2 commits into
envoyproxy:mainfrom
freedomljc:fixCredentialProviderChain
Open

Fix credential provider chain for aws_request_signing filter#45644
freedomljc wants to merge 2 commits into
envoyproxy:mainfrom
freedomljc:fixCredentialProviderChain

Conversation

@freedomljc

@freedomljc freedomljc commented Jun 15, 2026

Copy link
Copy Markdown
Contributor

It's to fix #45643: AWS AssumeRole provider hangs indefinitely when using WebIdentity source credentials in EKS

Here's the root Cause:
To fetch the base credentials needed to sign the STS AssumeRole request, createAssumeRoleCredentialsProvider instantiates an inner CommonCredentialsProviderChain. However, setupSubscriptions() is never called on this newly created inner chain.
Because subscriptions are never set up, the inner chain fails to register its CredentialSubscriberCallbacks with any underlying asynchronous metadata providers (like WebIdentityCredentialsProvider or InstanceProfileCredentialsProvider). When the background metadata fetch eventually succeeds (e.g., STS successfully exchanges the EKS pod's OIDC token for web identity credentials), the base provider fires onCredentialUpdate(). But because there are no registered subscribers, the inner chain is never notified.
Consequently, the pending callbacks attached by the SigV4SignerImpl (via addCallbackIfChainCredentialsPending) are never executed, and the outbound AWS request is left paused indefinitely waiting for credentials to resolve.

Commit Message:
Additional Description:
Risk Level: low
Testing: Have validated the fix: After applying the change, the aws_request_sigining filter would be able to fetch aws credentials.
Docs Changes:
Release Notes:
Platform Specific Features:
[Optional Runtime guard:]
[Optional Fixes commit #PR or SHA]
[Optional Deprecated:]
[Optional API Considerations:]

@freedomljc freedomljc requested a review from mattklein123 as a code owner June 15, 2026 17:28
Signed-off-by: Junchao Lyu <ljc0711@gmail.com>
Signed-off-by: Junchao Lyu <ljc0711@gmail.com>
@freedomljc freedomljc force-pushed the fixCredentialProviderChain branch from 5b3bde6 to 633ac5a Compare June 16, 2026 03:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

AWS AssumeRole provider hangs indefinitely when using WebIdentity source credentials in EKS

1 participant