[DNM] MCO-2250: AWS Marketplace bootimage update support#6015
Draft
djoshy wants to merge 2 commits into
Draft
Conversation
Contributor
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
the
jira/valid-reference
Contributor
|
@djoshy: This pull request references MCO-2250 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the spike to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
Contributor
|
Skipping CI for Draft Pull Request. |
WalkthroughThis PR adds AWS Marketplace support to the Machine Config Operator's boot image reconciliation. It introduces AMI classification (standard, marketplace, ROSA), marketplace product ID extraction, version token derivation from RHCOS release strings, and region-scoped ChangesAWS Marketplace Boot Image Resolution
Sequence DiagramsequenceDiagram
participant MCO as Machine Config<br/>Operator
participant K8s as Kubernetes<br/>(Secrets)
participant EC2 as AWS EC2<br/>API
MCO->>MCO: Start AMI reconciliation
MCO->>K8s: Fetch aws-cloud-credentials<br/>secret
K8s-->>MCO: AWS access keys
MCO->>EC2: DescribeImages<br/>(current AMI ID)
EC2-->>MCO: Current AMI details<br/>(owner, name, description)
MCO->>MCO: Detect AMI kind<br/>(extract product ID<br/>from name if marketplace)
alt Marketplace/ROSA AMI
MCO->>MCO: Derive version token<br/>from target OCP<br/>release string
MCO->>EC2: DescribeImages<br/>(owner alias,<br/>product ID filter)
EC2-->>MCO: List marketplace AMIs
MCO->>MCO: Filter by version token<br/>in description,<br/>sort by CreationDate
MCO-->>MCO: Select newest<br/>matching AMI
else Standard RHCOS
MCO->>MCO: Resolve from stream<br/>regional mapping
end
MCO->>MCO: Compare current<br/>vs. target AMI
alt Target differs
MCO->>K8s: Update ProviderSpec<br/>with new AMI ID
K8s-->>MCO: Update complete
else Same AMI
MCO-->>MCO: Skip update
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~50 minutes 🚥 Pre-merge checks | ✅ 12✅ Passed checks (12 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 Microsoft Presidio Analyzer (2.2.362)docs/design/aws-marketplace.mdMicrosoft Presidio Analyzer failed to scan this file Comment |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: djoshy The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
djoshy
commented
May 7, 2026
|
|
||
| From the results, filter to images whose `Description` field contains the version token derived in step 2, matching against both description formats (space-bounded for RHEL marketplace, dash/dot-bounded for ROSA). Among those, select the AMI with the latest `CreationDate`. | ||
|
|
||
| If no matching AMI is found in the region (e.g. replication lag), the MCO skips and retries on the next reconcile cycle rather than falling back to a different version. |
Contributor
Author
There was a problem hiding this comment.
I'm a bit conflicted on this, if a RHEL version match isn't found in the marketplace, it likely means that the latest RHEL version hasn't been mirrored yet.
Would it make sense to just use the latest published value for that flavor? The only issue I can see if the marketplace skips a RHEL minor for some reason, and an older y stream could accidentally do a boot image update to a newer RHEL release than appropriate. Still - I think a RHEL minor not being published would be quite unlikely?
For now, the controller just skips the update if the bootimage for that RHEL version isn't found in the marketplace.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/design/aws-marketplace.md`:
- Around line 13-15: Several fenced code blocks are missing language tags
(causing MD040); add appropriate languages: for the AMI/name example blocks such
as the string
"RHEL-9.4-RHCOS-4.18_HVM_GA-20251119-x86_64-0-59ead7de-2540-4653-a8b0-fa7926d5c845"
mark the fence as ```text, and for the AWS DescribeImages command block mark the
fence as ```bash (apply the same change to the other untyped fences noted around
lines with similar AMI/name examples and the DescribeImages snippet).
In `@pkg/controller/bootimage/aws_helpers.go`:
- Around line 113-118: The awsMarketplaceOwnerID branch currently treats any
image as marketplace even when extractProductID(aws.ToString(image.Name))
returns "", which causes findMarketplaceAMI to match overly broad AMIs; update
the branch in pkg/controller/bootimage/aws_helpers.go (the case handling
awsMarketplaceOwnerID) to detect an empty productID and treat it as unsupported
instead of amiKindMarketplace—i.e., if productID == "" return an
unsupported/invalid kind (or nil/empty indicator used elsewhere) along with the
productID, otherwise keep the existing rosaProductID -> amiKindROSA and
non-empty productID -> amiKindMarketplace behavior so downstream
findMarketplaceAMI never receives an empty product ID.
- Around line 81-90: The current EC2 client loader in aws_helpers.go only uses
static keys (accessKeyID/secretAccessKey) and fails for STS/web-identity
secrets; update the logic in the function that builds the ec2.Options (the
section using accessKeyID, secretAccessKey and
credentials.NewStaticCredentialsProvider) to detect STS format (presence of
role_arn and web_identity_token_file) and, when present, construct a
WebIdentity/ST S credentials provider from the token file and role_arn and set
that as the Credentials in ec2.New; if both static keys and STS fields are
missing return a clear error referencing awsCredentialsSecretName. Ensure the
new branch populates ec2.New(ec2.Options{Region: region, Credentials:
<web-identity provider>}) while keeping the existing static-credentials branch
using credentials.NewStaticCredentialsProvider(accessKeyID, secretAccessKey,
"").
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 44b4faa6-fc82-4bea-ab8f-f48e9b912740
⛔ Files ignored due to path filters (296)
go.sumis excluded by!**/*.sumvendor/github.com/aws/aws-sdk-go-v2/LICENSE.txtis excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/NOTICE.txtis excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/accountid_endpoint_mode.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/checksum.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/context.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/credential_cache.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/credentials.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/defaults/auto.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/defaults/configuration.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/defaults/defaults.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/defaults/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/defaultsmode.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/endpoints.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/from_ptr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/go_module_metadata.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/logging.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/logging_generate.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/middleware/metadata.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/middleware/middleware.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/middleware/osname.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/middleware/osname_go115.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/middleware/recursion_detection.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/middleware/request_id.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/middleware/request_id_retriever.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/middleware/user_agent.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/protocol/ec2query/error_utils.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/protocol/query/array.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/protocol/query/encoder.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/protocol/query/map.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/protocol/query/middleware.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/protocol/query/object.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/protocol/query/value.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/ratelimit/none.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/ratelimit/token_bucket.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/ratelimit/token_rate_limit.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/request.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/retry/adaptive.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/retry/adaptive_ratelimit.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/retry/adaptive_token_bucket.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/retry/attempt_metrics.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/retry/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/retry/errors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/retry/jitter_backoff.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/retry/metadata.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/retry/middleware.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/retry/retry.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/retry/retryable_error.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/retry/standard.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/retry/throttle_error.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/retry/timeout_error.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/retryer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/runtime.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4/cache.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4/const.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4/header_rules.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4/headers.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4/hmac.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4/host.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4/scope.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4/time.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/signer/internal/v4/util.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/signer/v4/middleware.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/signer/v4/presign_middleware.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/signer/v4/stream.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/signer/v4/v4.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/to_ptr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/transport/http/client.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/transport/http/content_type.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/transport/http/response_error.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/transport/http/response_error_middleware.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/transport/http/timeout_read_closer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/types.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/version.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/CHANGELOG.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/LICENSE.txtis excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/go_module_metadata.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/static_provider.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/auth/auth.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/auth/scheme.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/auth/smithy/bearer_token_adapter.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/auth/smithy/bearer_token_signer_adapter.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/auth/smithy/credentials_adapter.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/auth/smithy/smithy.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/auth/smithy/v4signer_adapter.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/configsources/CHANGELOG.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/configsources/LICENSE.txtis excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/configsources/config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/configsources/endpoints.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/configsources/go_module_metadata.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/context/context.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/awsrulesfn/arn.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/awsrulesfn/doc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/awsrulesfn/generate.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/awsrulesfn/host.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/awsrulesfn/partition.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/awsrulesfn/partitions.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/awsrulesfn/partitions.jsonis excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/endpoints.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/CHANGELOG.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/LICENSE.txtis excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/endpoints.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/go_module_metadata.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/rand/rand.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/sdk/interfaces.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/sdk/time.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/strings/strings.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/sync/singleflight/LICENSEis excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/sync/singleflight/docs.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/sync/singleflight/singleflight.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/timeconv/duration.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/CHANGELOG.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/LICENSE.txtis excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_client.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AcceptAddressTransfer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AcceptCapacityReservationBillingOwnership.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AcceptReservedInstancesExchangeQuote.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AcceptTransitGatewayClientVpnAttachment.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AcceptTransitGatewayMulticastDomainAssociations.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AcceptTransitGatewayPeeringAttachment.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AcceptTransitGatewayVpcAttachment.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AcceptVpcEndpointConnections.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AcceptVpcPeeringConnection.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AdvertiseByoipCidr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AllocateAddress.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AllocateHosts.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AllocateIpamPoolCidr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_ApplySecurityGroupsToClientVpnTargetNetwork.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AssignIpv6Addresses.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AssignPrivateIpAddresses.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AssignPrivateNatGatewayAddress.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AssociateAddress.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AssociateCapacityReservationBillingOwner.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AssociateClientVpnTargetNetwork.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AssociateDhcpOptions.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AssociateEnclaveCertificateIamRole.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AssociateIamInstanceProfile.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AssociateInstanceEventWindow.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AssociateIpamByoasn.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AssociateIpamResourceDiscovery.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AssociateNatGatewayAddress.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AssociateRouteServer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AssociateRouteTable.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AssociateSecurityGroupVpc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AssociateSubnetCidrBlock.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AssociateTransitGatewayMulticastDomain.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AssociateTransitGatewayPolicyTable.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AssociateTransitGatewayRouteTable.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AssociateTrunkInterface.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AssociateVpcCidrBlock.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AttachClassicLinkVpc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AttachInternetGateway.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AttachNetworkInterface.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AttachVerifiedAccessTrustProvider.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AttachVolume.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AttachVpnGateway.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AuthorizeClientVpnIngress.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AuthorizeSecurityGroupEgress.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_AuthorizeSecurityGroupIngress.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_BundleInstance.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CancelBundleTask.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CancelCapacityReservation.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CancelCapacityReservationFleets.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CancelConversionTask.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CancelDeclarativePoliciesReport.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CancelExportTask.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CancelImageLaunchPermission.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CancelImportTask.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CancelReservedInstancesListing.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CancelSpotFleetRequests.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CancelSpotInstanceRequests.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_ConfirmProductInstance.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CopyFpgaImage.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CopyImage.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CopySnapshot.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CopyVolumes.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateCapacityManagerDataExport.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateCapacityReservation.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateCapacityReservationBySplitting.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateCapacityReservationFleet.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateCarrierGateway.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateClientVpnEndpoint.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateClientVpnRoute.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateCoipCidr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateCoipPool.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateCustomerGateway.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateDefaultSubnet.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateDefaultVpc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateDelegateMacVolumeOwnershipTask.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateDhcpOptions.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateEgressOnlyInternetGateway.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateFleet.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateFlowLogs.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateFpgaImage.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateImage.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateImageUsageReport.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateInstanceConnectEndpoint.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateInstanceEventWindow.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateInstanceExportTask.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateInternetGateway.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateInterruptibleCapacityReservationAllocation.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateIpam.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateIpamExternalResourceVerificationToken.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateIpamPolicy.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateIpamPool.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateIpamPrefixListResolver.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateIpamPrefixListResolverTarget.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateIpamResourceDiscovery.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateIpamScope.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateKeyPair.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateLaunchTemplate.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateLaunchTemplateVersion.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateLocalGatewayRoute.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateLocalGatewayRouteTable.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateLocalGatewayRouteTableVirtualInterfaceGroupAssociation.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateLocalGatewayRouteTableVpcAssociation.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateLocalGatewayVirtualInterface.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateLocalGatewayVirtualInterfaceGroup.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateMacSystemIntegrityProtectionModificationTask.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateManagedPrefixList.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateNatGateway.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateNetworkAcl.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateNetworkAclEntry.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateNetworkInsightsAccessScope.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateNetworkInsightsPath.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateNetworkInterface.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateNetworkInterfacePermission.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreatePlacementGroup.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreatePublicIpv4Pool.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateReplaceRootVolumeTask.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateReservedInstancesListing.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateRestoreImageTask.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateRoute.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateRouteServer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateRouteServerEndpoint.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateRouteServerPeer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateRouteTable.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateSecondaryNetwork.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateSecondarySubnet.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateSecurityGroup.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateSnapshot.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateSnapshots.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateSpotDatafeedSubscription.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateStoreImageTask.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateSubnet.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateSubnetCidrReservation.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateTags.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateTrafficMirrorFilter.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateTrafficMirrorFilterRule.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateTrafficMirrorSession.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateTrafficMirrorTarget.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateTransitGateway.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateTransitGatewayConnect.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateTransitGatewayConnectPeer.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateTransitGatewayMeteringPolicy.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateTransitGatewayMeteringPolicyEntry.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateTransitGatewayMulticastDomain.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateTransitGatewayPeeringAttachment.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateTransitGatewayPolicyTable.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateTransitGatewayPrefixListReference.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateTransitGatewayRoute.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateTransitGatewayRouteTable.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateTransitGatewayRouteTableAnnouncement.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateTransitGatewayVpcAttachment.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateVerifiedAccessEndpoint.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateVerifiedAccessGroup.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateVerifiedAccessInstance.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateVerifiedAccessTrustProvider.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateVolume.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateVpc.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateVpcBlockPublicAccessExclusion.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateVpcEncryptionControl.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateVpcEndpoint.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateVpcEndpointConnectionNotification.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateVpcEndpointServiceConfiguration.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateVpcPeeringConnection.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateVpnConcentrator.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateVpnConnection.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateVpnConnectionRoute.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_CreateVpnGateway.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_DeleteCapacityManagerDataExport.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_DeleteCarrierGateway.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_DeleteClientVpnEndpoint.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_DeleteClientVpnRoute.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_DeleteCoipCidr.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_DeleteCoipPool.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_DeleteCustomerGateway.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_DeleteDhcpOptions.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_DeleteEgressOnlyInternetGateway.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_DeleteFleets.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_DeleteFlowLogs.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ec2/api_op_DeleteFpgaImage.gois excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (4)
docs/design/aws-marketplace.mdgo.modpkg/controller/bootimage/aws_helpers.gopkg/controller/bootimage/platform_helpers.go
Comment on lines
+13
to
+15
| ``` | ||
| RHEL-9.4-RHCOS-4.18_HVM_GA-20251119-x86_64-0-59ead7de-2540-4653-a8b0-fa7926d5c845 | ||
| ``` |
There was a problem hiding this comment.
Add language tags to the fenced code blocks.
These five fences are currently untyped, which is already tripping markdownlint (MD040). text fits the AMI/name examples, and bash fits the DescribeImages snippet.
Also applies to: 55-57, 102-104, 112-114, 122-125
🧰 Tools
🪛 markdownlint-cli2 (0.22.1)
[warning] 13-13: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/design/aws-marketplace.md` around lines 13 - 15, Several fenced code
blocks are missing language tags (causing MD040); add appropriate languages: for
the AMI/name example blocks such as the string
"RHEL-9.4-RHCOS-4.18_HVM_GA-20251119-x86_64-0-59ead7de-2540-4653-a8b0-fa7926d5c845"
mark the fence as ```text, and for the AWS DescribeImages command block mark the
fence as ```bash (apply the same change to the other untyped fences noted around
lines with similar AMI/name examples and the DescribeImages snippet).
Comment on lines
+81
to
+90
| accessKeyID := string(secret.Data["aws_access_key_id"]) | ||
| secretAccessKey := string(secret.Data["aws_secret_access_key"]) | ||
| if accessKeyID == "" || secretAccessKey == "" { | ||
| return nil, fmt.Errorf("%s secret is missing aws_access_key_id or aws_secret_access_key", awsCredentialsSecretName) | ||
| } | ||
|
|
||
| return ec2.New(ec2.Options{ | ||
| Region: region, | ||
| Credentials: credentials.NewStaticCredentialsProvider(accessKeyID, secretAccessKey, ""), | ||
| }), nil |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
In OpenShift and ROSA AWS credential flows, what formats can the aws-cloud-credentialssecret created from a CredentialsRequest take? Specifically, can it contain temporary credentials requiringaws_session_tokenor web-identity/role-based configuration instead of onlyaws_access_key_idandaws_secret_access_key?
💡 Result:
In OpenShift and ROSA AWS credential flows, the aws-cloud-credentials secret created from a CredentialsRequest can take two main formats depending on the Cloud Credential Operator (CCO) mode. In mint or passthrough modes (using long-lived credentials), the secret contains aws_access_key_id and aws_secret_access_key as base64-encoded keys [1][2][3]. In manual mode with AWS Security Token Service (STS), which is the default for ROSA and recommended for OpenShift on AWS, the secret uses a credentials key containing an AWS config profile with role_arn (or role_name), web_identity_token_file (typically /var/run/secrets/openshift/serviceaccount/token), and often sts_regional_endpoints = regional. This enables web-identity federation where components assume IAM roles using service account tokens to obtain temporary credentials; it does not store static keys or aws_session_token directly in the secret [4][5][1]. No sources indicate support for temporary credentials with aws_session_token (from AssumeRole etc.) in the secret itself; instead, STS mode uses web-identity config for dynamic temporary creds [6][7][8].
Citations:
- 1: https://docs.openshift.com/container-platform/latest/authentication/managing_cloud_provider_credentials/about-cloud-credential-operator.html
- 2: https://docs.redhat.com/en/documentation/openshift_container_platform/4.8/html/authentication_and_authorization/managing-cloud-provider-credentials
- 3: https://docs.redhat.com/en/documentation/openshift_container_platform/4.7/html/authentication_and_authorization/managing-cloud-provider-credentials
- 4: https://docs.okd.io/4.10/authentication/managing_cloud_provider_credentials/cco-mode-sts.html
- 5: https://github.com/openshift/cloud-credential-operator/blob/master/docs/sts.md
- 6: https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/security_apis/credentialsrequest-cloudcredential-openshift-io-v1
- 7: https://docs.redhat.com/it/documentation/red_hat_openshift_service_on_aws/4/html/introduction_to_rosa/cloud-experts-rosa-hcp-sts-explained
- 8: https://access.redhat.com/solutions/7031405
🏁 Script executed:
cd /tmp && git ls-files | head -20Repository: openshift/machine-config-operator
Length of output: 146
🏁 Script executed:
# Find the file and get full context around the function
find . -name "aws_helpers.go" -path "*/bootimage/*"Repository: openshift/machine-config-operator
Length of output: 119
🏁 Script executed:
# Once we locate it, examine the full function
# First, let's find it
fd -t f aws_helpers.go | grep -i bootimageRepository: openshift/machine-config-operator
Length of output: 117
🏁 Script executed:
wc -l pkg/controller/bootimage/aws_helpers.goRepository: openshift/machine-config-operator
Length of output: 121
🏁 Script executed:
cat -n pkg/controller/bootimage/aws_helpers.goRepository: openshift/machine-config-operator
Length of output: 11166
🏁 Script executed:
# Check if there are comments or context about credential mode support
rg -i "sts|credential.*mode|mint.*mode" pkg/controller/bootimage/ -A 2 -B 2Repository: openshift/machine-config-operator
Length of output: 9490
🏁 Script executed:
# Check README or documentation
find . -name "README*" -o -name "*.md" | xargs grep -l "bootimage\|credential" 2>/dev/null | head -5Repository: openshift/machine-config-operator
Length of output: 224
🏁 Script executed:
# Look for other credential handling patterns in the codebase
rg "aws_access_key_id|aws_secret_access_key" --type go | head -20Repository: openshift/machine-config-operator
Length of output: 437
Add support for AWS STS credentials in the EC2 client.
This loader only handles static key/secret pairs from the aws-cloud-credentials secret. However, OpenShift's Cloud Credential Operator supports multiple credential modes, and STS mode (the default for ROSA) stores AWS config profile data with role_arn and web_identity_token_file instead of static keys. The current code will fail when the secret contains STS-format credentials. If ROSA/STS clusters are in scope for this bootimage controller, this credential format must be supported.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pkg/controller/bootimage/aws_helpers.go` around lines 81 - 90, The current
EC2 client loader in aws_helpers.go only uses static keys
(accessKeyID/secretAccessKey) and fails for STS/web-identity secrets; update the
logic in the function that builds the ec2.Options (the section using
accessKeyID, secretAccessKey and credentials.NewStaticCredentialsProvider) to
detect STS format (presence of role_arn and web_identity_token_file) and, when
present, construct a WebIdentity/ST S credentials provider from the token file
and role_arn and set that as the Credentials in ec2.New; if both static keys and
STS fields are missing return a clear error referencing
awsCredentialsSecretName. Ensure the new branch populates
ec2.New(ec2.Options{Region: region, Credentials: <web-identity provider>}) while
keeping the existing static-credentials branch using
credentials.NewStaticCredentialsProvider(accessKeyID, secretAccessKey, "").
Comment on lines
+113
to
+118
| case awsMarketplaceOwnerID: | ||
| productID := extractProductID(aws.ToString(image.Name)) | ||
| if productID == rosaProductID { | ||
| return amiKindROSA, productID | ||
| } | ||
| return amiKindMarketplace, productID |
There was a problem hiding this comment.
Treat marketplace AMIs without a parsed product ID as unsupported.
If extractProductID returns "", this branch still classifies the image as marketplace. Downstream, findMarketplaceAMI turns that into Name=name,Values=*, which can select the newest matching marketplace AMI from the wrong offering.
Suggested fix
case awsMarketplaceOwnerID:
productID := extractProductID(aws.ToString(image.Name))
+ if productID == "" {
+ return amiKindUnknown, ""
+ }
if productID == rosaProductID {
return amiKindROSA, productID
}
return amiKindMarketplace, productID📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| case awsMarketplaceOwnerID: | |
| productID := extractProductID(aws.ToString(image.Name)) | |
| if productID == rosaProductID { | |
| return amiKindROSA, productID | |
| } | |
| return amiKindMarketplace, productID | |
| case awsMarketplaceOwnerID: | |
| productID := extractProductID(aws.ToString(image.Name)) | |
| if productID == "" { | |
| return amiKindUnknown, "" | |
| } | |
| if productID == rosaProductID { | |
| return amiKindROSA, productID | |
| } | |
| return amiKindMarketplace, productID |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pkg/controller/bootimage/aws_helpers.go` around lines 113 - 118, The
awsMarketplaceOwnerID branch currently treats any image as marketplace even when
extractProductID(aws.ToString(image.Name)) returns "", which causes
findMarketplaceAMI to match overly broad AMIs; update the branch in
pkg/controller/bootimage/aws_helpers.go (the case handling
awsMarketplaceOwnerID) to detect an empty productID and treat it as unsupported
instead of amiKindMarketplace—i.e., if productID == "" return an
unsupported/invalid kind (or nil/empty indicator used elsewhere) along with the
productID, otherwise keep the existing rosaProductID -> amiKindROSA and
non-empty productID -> amiKindMarketplace behavior so downstream
findMarketplaceAMI never receives an empty product ID.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implementation details can be found in docs/design/aws-marketplace.md attached to this PR. Scrapes from a sample run below:
To test:
Summary by CodeRabbit
New Features
Documentation