Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Change key/secret to optional in apoc.nlp calls for AWS #1596

Closed
bbenzikry opened this issue Jul 17, 2020 · 0 comments
Closed

Change key/secret to optional in apoc.nlp calls for AWS #1596

bbenzikry opened this issue Jul 17, 2020 · 0 comments

Comments

@bbenzikry
Copy link

Currently verifyKey is called for key & secret when using apoc.nlp.aws procedures.
This poses several issues, especially under an orchestrated environment ( we use k8s )

  1. We don't want to rely on key/secret use ( we prefer using roles when calling the AWS APIs. specifically via IRSA )

  2. As we have to explicitly use credentials, we rotate them. in our setup Vault is in charge of rotating keys and the key / secret pair is passed to the apoc static value storage via environment variables.
    This has the downside of the need to allocate a new pod, which means we can encounter call failures until the original pod is replaced.

Note: We considered mounting a secret volume, but that also has the same downside as currently kubernetes secret updates don't work for subPath mounts ( which is required if we mount into the conf/ dir without overriding neo4j.conf, as it's populated in the official docker image entrypoint )
This could potentially be circumvented if we can change the apoc.conf location via another variable ( I would love to hear whether this is possible )

Expected Behavior (Mandatory)

When called without key and secret, AWS calls should fall back to normal credential chain ( env var, instance profile, role etc. )

Actual Behavior (Mandatory)

Failed to invoke procedure `apoc.nlp.aws.entities.graph`: Caused by: java.lang.IllegalArgumentException: Missing parameter `key`. An API key for the Amazon Comprehend API can be generated from https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/setup-credentials.html

Specifications (Mandatory)

Versions

  • OS: EKS, several underlying OS ( all linux ), official docker build for 4.1
  • Neo4j: 4.1
  • Neo4j-Apoc: 4.1.0.0
@vga91 vga91 closed this as completed May 16, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Status: Done (to cherry-pick)
Development

No branches or pull requests

3 participants