cloudnative-pg / cloudnative-pg/charts
barman_object_store has fixed keys for access and secret
- Dominant language
- Go Template
- Stars
- 621
- Forks
- 265
- Avg merge
- 7d 12h
- Merged PRs (30d)
- 7
Description
In charts/cluster/templates/_barman_object_store.tpl the keys for access and secret keys are fixed to ACCESS_KEY_ID and ACCESS_SECRET_KEY.
Some S3 implementations (like ceph) manage secrets on their own and they use different keys there. Those can't be changed.
You may also have some existing secret with other keys that needs to be reused (even if this is not recommended).
So you don't have to implement workarounds that copy secrets, it would be nice to be able to tell cnpg what's the name of these keys.
suggested improvement:
```
{{- $secretName := coalesce .scope.secret.name (printf "%s-%s-s3-creds" .chartFullname .secretPrefix) }}
{{- $accessKeyField := default "ACCESS_KEY_ID" .scope.s3.accessKeyField }}
{{- $secretKeyField := default "ACCESS_SECRET_KEY" .scope.s3.secretKeyField }}
s3Credentials:
{{- if .scope.s3.inheritFromIAMRole }}
inheritFromIAMRole: true
{{- else }}
accessKeyId:
name: {{ $secretName }}
key: {{ $accessKeyField }}
secretAccessKey:
name: {{ $secretName }}
key: {{ $secretKeyField }}
{{- end }}
```
Contributor guide
Research direction
Start with charts/cluster/templates/_barman_object_store.tpl and trace how the secret name and S3 credential keys are selected. The change is done when accessKeyField and secretKeyField can override the existing ACCESS_KEY_ID and ACCESS_SECRET_KEY defaults, while inheritFromIAMRole remains unchanged.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- helm
- Domain
- devops, infrastructure
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100