Cob

Cob, yet another yum S3 plugin, provides a way to accessing yum repositories hosted on AWS S3.

What's the difference between Cob and original yum s3 plugin?

Support more secure AWS Signature Version 4 while original one still in version 2, especially for the new region eu-central-1 only SigV4 allowed
Hook on higher layer of Yum built-in library to avoid complicated low-level handlings
Support static AWS credentials prior to IAM role
Add retry mechanism to fetch IAM role credentials

Quick Start

Installation
- ./install.sh
- plugin conf: cob.conf --> /etc/yum/pluginconf.d/cob.conf
- plugin code: cob.py --> /usr/lib/yum-plugins/cob.py

Setup minimal IAM Role Policy for Cob

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject"
      ],
      "Resource": "*"
    }
  ]
}

For cross-account access, setup the policy of yum s3 bucket

{
  "Version": "2008-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": [
          "arn:aws:iam::37ABC0340XYZ:root",
          "arn:aws:iam::24ABC3058XYZ:root"
        ]
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::yum-s3-bucket-XYZ/*"
    }
  ]
}

"37ABC0340XYZ", "24ABC3058XYZ": AWS account id with the permission to access
"yum-s3-bucket-XYZ": S3 bucket for yum access

Configure your yum repo conf under /etc/yum.repos.d/, like the example below cob.repo
```
[cob]
name=cob
baseurl=https://your-bucket-name-0.s3.amazonaws.com/repo-name/arch/
        https://your-bucket-name-1.s3-eu-west-1.amazonaws.com/repo-name/arch/
        https://your-bucket-name-2.s3-us-west-2.amazonaws.com/repo-name/arch/
failovermethod=priority
enabled=1
gpgcheck=0
```
- add the bucket region name in the baseurl as shown in the example, especially for us-east-1, like your-bucket-name-0, no region name needed there
- s3 endpoint reference: http://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region

An example from cob.conf is taken to indicate its usages:

[main]
cachedir=/var/cache/yum/$basearch/$releasever
keepcache=1
debuglevel=4
logfile=/var/log/yum.log
exactarch=1
obsoletes=0
gpgcheck=0
plugins=1
distroverpkg=centos-release
enabled=1

[aws]
# access_key = 
# secret_key =
timeout = 60
retries = 5
metadata_server = http://169.254.169.254

set main/enabled=1 to enable this yum plugin
for static AWS credentials, you could specify via aws/access_key, aws/secret_key
aws/timeout and aws/retries, used to indicate params in the way of fetching IAM role credentials
metadata_server used to help testing

Enable verbose log to help troubleshoot the Cob issue:
```
URLGRABBER_DEBUG=1 yum -v makecache
```

PhilGrayson/cob

Cob

Quick Start