cloudnative-pg / cloudnative-pg/plugin-barman-cloud

Cluster fails to start when using Azure AD Workload Identity with Barman plugin

Open
#649 7 comments 0 reactions 0 assignees View on GitHub
question
Dominant language
Go
Stars
191
Forks
72
Avg merge
2d 21h
Merged PRs (30d)
21

Description

### Environment
**CNPG Version**: v1.26
**PostgreSQL Image**: ghcr.io/cloudnative-pg/postgresql:17.5-standard-bookworm
**Barman Plugin Version**: 0.5.0
**Kubernetes**: AKS (with Azure AD Workload Identity)

### Goal

I’m trying to configure **Barman Cloud Plugin** to take backups to **Azure Blob Storage** using **Azure AD Workload Identity** (instead of using storage account key credentials).

**ObjectStore configuration (with Workload Identity)**

```apiVersion: barmancloud.cnpg.io/v1
kind: ObjectStore
metadata:
name: azure-store
spec:
configuration:
destinationPath: https://akspgdbbackup.blob.core.windows.net/mypgBackup
azureCredentials:
inheritFromAzureAD: true
wal:
compression: gzip
data:
compression: bzip2
retentionPolicy: "3d"
```

**Cluster configuration**

```
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
name: test-1
namespace: test-namespace
labels:
env: devl
app: test
svc: db
podname: "test-1"
wa: NALA
spec:
instances: 1
imagePullPolicy: Always
imageCatalogRef:
apiGroup: postgresql.cnpg.io
kind: ImageCatalog
name: test-postgres-catalog
major: 17
enableSuperuserAccess: true
imagePullSecrets:
- name: testcregcred
storage:
size: 1Gi
plugins:
- name: barman-cloud.cloudnative-pg.io
isWALArchiver: true
parameters:
barmanObjectName: azure-store
```

**Observed behavior**

When I create the cluster, reconciliation fails with the following error:

```
Pre-reconcile hook stopped the reconciliation loop","controller":"cluster","controllerGroup":"postgresql.cnpg.io","controllerKind":"Cluster","Cluster":{"test-1","namespace":"test-namespace"},"namespace":"test-namespace","name":"test-1","reconcileID":"e00c4983-8c70-45e4-ab3a-32e4bf8bfe6f","hookResult":{"result":{"Requeue":true,"RequeueAfter":0},"err":null,"stopReconciliation":true,"identifier":"barman-cloud.cloudnative-pg.io"}}

no orphan PVCs found, skipping the restored cluster
```
The cluster remains in a failed reconciliation loop.

**Expected behavior**

Cluster should initialize successfully and be able to use the configured Azure Blob Storage via Workload Identity

**Workaround**

If I change the ObjectStore to use storage account credentials instead of Azure AD identity, everything works — the cluster starts and backups are successfully taken.

**Working configuration:**

```
apiVersion: barmancloud.cnpg.io/v1
kind: ObjectStore
metadata:
name: azure-store
spec:
configuration:
destinationPath: https://akspgdbbackup.blob.core.windows.net/mypgBackup
azureCredentials:
storageAccount:
name: azure-credentials
key: AZURE_STG_ACC
storageKey:
name: azure-credentials
key: AZURE_STG_KEY
wal:
compression: gzip
data:
compression: bzip2
retentionPolicy: "3d"

```

**Question**

Is **Workload Identity authentication** currently supported by the Barman Cloud plugin (v0.5.0)?
If yes, could you please clarify what additional configuration or permissions might be required for:
```
azureCredentials:
inheritFromAzureAD: true
```

**Contact**

If you need more details or logs, feel free to reach out to me at vishal.tanawade@emerson.com

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.