cloudnative-pg / cloudnative-pg/plugin-barman-cloud

Cluster fails to start when using Azure AD Workload Identity with Barman plugin

Open
#649 7 comments 0 reactions 0 assignees View on GitHub
question
Dominant language
Go
Stars
191
Forks
72
Avg merge
1d 16h
Merged PRs (30d)
18

Description

### Environment
**CNPG Version**: v1.26
**PostgreSQL Image**: ghcr.io/cloudnative-pg/postgresql:17.5-standard-bookworm
**Barman Plugin Version**: 0.5.0
**Kubernetes**: AKS (with Azure AD Workload Identity)

### Goal

I’m trying to configure **Barman Cloud Plugin** to take backups to **Azure Blob Storage** using **Azure AD Workload Identity** (instead of using storage account key credentials).

**ObjectStore configuration (with Workload Identity)**

```apiVersion: barmancloud.cnpg.io/v1
kind: ObjectStore
metadata:
name: azure-store
spec:
configuration:
destinationPath: https://akspgdbbackup.blob.core.windows.net/mypgBackup
azureCredentials:
inheritFromAzureAD: true
wal:
compression: gzip
data:
compression: bzip2
retentionPolicy: "3d"
```

**Cluster configuration**

```
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
name: test-1
namespace: test-namespace
labels:
env: devl
app: test
svc: db
podname: "test-1"
wa: NALA
spec:
instances: 1
imagePullPolicy: Always
imageCatalogRef:
apiGroup: postgresql.cnpg.io
kind: ImageCatalog
name: test-postgres-catalog
major: 17
enableSuperuserAccess: true
imagePullSecrets:
- name: testcregcred
storage:
size: 1Gi
plugins:
- name: barman-cloud.cloudnative-pg.io
isWALArchiver: true
parameters:
barmanObjectName: azure-store
```

**Observed behavior**

When I create the cluster, reconciliation fails with the following error:

```
Pre-reconcile hook stopped the reconciliation loop","controller":"cluster","controllerGroup":"postgresql.cnpg.io","controllerKind":"Cluster","Cluster":{"test-1","namespace":"test-namespace"},"namespace":"test-namespace","name":"test-1","reconcileID":"e00c4983-8c70-45e4-ab3a-32e4bf8bfe6f","hookResult":{"result":{"Requeue":true,"RequeueAfter":0},"err":null,"stopReconciliation":true,"identifier":"barman-cloud.cloudnative-pg.io"}}

no orphan PVCs found, skipping the restored cluster
```
The cluster remains in a failed reconciliation loop.

**Expected behavior**

Cluster should initialize successfully and be able to use the configured Azure Blob Storage via Workload Identity

**Workaround**

If I change the ObjectStore to use storage account credentials instead of Azure AD identity, everything works — the cluster starts and backups are successfully taken.

**Working configuration:**

```
apiVersion: barmancloud.cnpg.io/v1
kind: ObjectStore
metadata:
name: azure-store
spec:
configuration:
destinationPath: https://akspgdbbackup.blob.core.windows.net/mypgBackup
azureCredentials:
storageAccount:
name: azure-credentials
key: AZURE_STG_ACC
storageKey:
name: azure-credentials
key: AZURE_STG_KEY
wal:
compression: gzip
data:
compression: bzip2
retentionPolicy: "3d"

```

**Question**

Is **Workload Identity authentication** currently supported by the Barman Cloud plugin (v0.5.0)?
If yes, could you please clarify what additional configuration or permissions might be required for:
```
azureCredentials:
inheritFromAzureAD: true
```

**Contact**

If you need more details or logs, feel free to reach out to me at vishal.tanawade@emerson.com

Contributor guide

Open the contributing guide

Research direction

No source file or test is named. Start at the barman-cloud.cloudnative-pg.io pre-reconcile hook and trace handling of azureCredentials.inheritFromAzureAD, comparing it with the working storage-account credential path; done means identifying the missing support or configuration and confirming successful cluster reconciliation with Azure Blob Storage.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, go, kubernetes, postgresql
Domain
authentication, backend, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.