cloudnative-pg / cloudnative-pg/charts

barman_object_store has fixed keys for access and secret

Open Beginner friendly
#929 0 comments 1 reaction 0 assignees View on GitHub
chart( cluster )
Dominant language
Go Template
Stars
621
Forks
265
Avg merge
7d 12h
Merged PRs (30d)
7

Description

In charts/cluster/templates/_barman_object_store.tpl the keys for access and secret keys are fixed to ACCESS_KEY_ID and ACCESS_SECRET_KEY.

Some S3 implementations (like ceph) manage secrets on their own and they use different keys there. Those can't be changed.
You may also have some existing secret with other keys that needs to be reused (even if this is not recommended).

So you don't have to implement workarounds that copy secrets, it would be nice to be able to tell cnpg what's the name of these keys.

suggested improvement:

```
{{- $secretName := coalesce .scope.secret.name (printf "%s-%s-s3-creds" .chartFullname .secretPrefix) }}
{{- $accessKeyField := default "ACCESS_KEY_ID" .scope.s3.accessKeyField }}
{{- $secretKeyField := default "ACCESS_SECRET_KEY" .scope.s3.secretKeyField }}

s3Credentials:
{{- if .scope.s3.inheritFromIAMRole }}
inheritFromIAMRole: true
{{- else }}
accessKeyId:
name: {{ $secretName }}
key: {{ $accessKeyField }}
secretAccessKey:
name: {{ $secretName }}
key: {{ $secretKeyField }}
{{- end }}
```

Contributor guide

Open the contributing guide

Research direction

Start with charts/cluster/templates/_barman_object_store.tpl and trace how the secret name and S3 credential keys are selected. The change is done when accessKeyField and secretKeyField can override the existing ACCESS_KEY_ID and ACCESS_SECRET_KEY defaults, while inheritFromIAMRole remains unchanged.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm
Domain
devops, infrastructure
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.