From 2fd70dac2d68206b152a068c4976892c09188d80 Mon Sep 17 00:00:00 2001 From: Taksh Date: Sat, 8 Aug 2026 05:55:55 +0530 Subject: [PATCH] docs(chart): note Pod Identity support rests on the aws-creds fork pin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The relay resolves S3 credentials from the pod IAM role (EKS Pod Identity / IRSA) only because the workspace pins aws-creds to a fork adopting the aws-creds portion of durch/rust-s3#449; the crates.io release cannot read EKS Pod Identity credentials. That pin is temporary and reverts to crates.io once #449 lands upstream, so operators relying on Pod Identity support are depending on an unmerged fork — worth calling out in the chart README's "Honest limitations" section. See #5211. Signed-off-by: Taksh --- deploy/charts/buzz/README.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/deploy/charts/buzz/README.md b/deploy/charts/buzz/README.md index b2778df28b..f22a374211 100644 --- a/deploy/charts/buzz/README.md +++ b/deploy/charts/buzz/README.md @@ -227,6 +227,15 @@ Save these. Losing any of them is data loss. See NOTES.txt printed by `helm inst - **Cosign signing of the published chart** is a follow-up (the relay image is attested via `actions/attest-build-provenance`; the chart is not yet). The chart itself is published to GHCR — see [Releasing](#releasing). +- **EKS Pod Identity / IRSA support rests on a temporary `aws-creds` fork pin.** + The relay resolves S3 credentials from the pod IAM role only because the + workspace pins `aws-creds` to a fork (Cargo.toml `[patch.crates-io]`) that + adopts the aws-creds portion of durch/rust-s3#449 — the crates.io release + cannot read EKS Pod Identity credentials + (`AWS_CONTAINER_CREDENTIALS_FULL_URI` + `AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE`). + The pin reverts to crates.io once #449 lands upstream; until then, Pod Identity + support depends on an unmerged fork, so operators relying on it should track + that upstream issue. ## Releasing