cloudnative-pg / cloudnative-pg/plugin-barman-cloud

Cluster fails to start when using Azure AD Workload Identity with Barman plugin

Abierto
#649 7 comentarios 0 reacciones 0 asignados Ver en GitHub
question
Lenguaje dominante
Go
Estrellas
191
Forks
72
Merge medio
2 d 21 h
PR fusionados (30 d)
21

Descripción

### Environment
**CNPG Version**: v1.26
**PostgreSQL Image**: ghcr.io/cloudnative-pg/postgresql:17.5-standard-bookworm
**Barman Plugin Version**: 0.5.0
**Kubernetes**: AKS (with Azure AD Workload Identity)

### Goal

I’m trying to configure **Barman Cloud Plugin** to take backups to **Azure Blob Storage** using **Azure AD Workload Identity** (instead of using storage account key credentials).

**ObjectStore configuration (with Workload Identity)**

```apiVersion: barmancloud.cnpg.io/v1
kind: ObjectStore
metadata:
name: azure-store
spec:
configuration:
destinationPath: https://akspgdbbackup.blob.core.windows.net/mypgBackup
azureCredentials:
inheritFromAzureAD: true
wal:
compression: gzip
data:
compression: bzip2
retentionPolicy: "3d"
```

**Cluster configuration**

```
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
name: test-1
namespace: test-namespace
labels:
env: devl
app: test
svc: db
podname: "test-1"
wa: NALA
spec:
instances: 1
imagePullPolicy: Always
imageCatalogRef:
apiGroup: postgresql.cnpg.io
kind: ImageCatalog
name: test-postgres-catalog
major: 17
enableSuperuserAccess: true
imagePullSecrets:
- name: testcregcred
storage:
size: 1Gi
plugins:
- name: barman-cloud.cloudnative-pg.io
isWALArchiver: true
parameters:
barmanObjectName: azure-store
```

**Observed behavior**

When I create the cluster, reconciliation fails with the following error:

```
Pre-reconcile hook stopped the reconciliation loop","controller":"cluster","controllerGroup":"postgresql.cnpg.io","controllerKind":"Cluster","Cluster":{"test-1","namespace":"test-namespace"},"namespace":"test-namespace","name":"test-1","reconcileID":"e00c4983-8c70-45e4-ab3a-32e4bf8bfe6f","hookResult":{"result":{"Requeue":true,"RequeueAfter":0},"err":null,"stopReconciliation":true,"identifier":"barman-cloud.cloudnative-pg.io"}}

no orphan PVCs found, skipping the restored cluster
```
The cluster remains in a failed reconciliation loop.

**Expected behavior**

Cluster should initialize successfully and be able to use the configured Azure Blob Storage via Workload Identity

**Workaround**

If I change the ObjectStore to use storage account credentials instead of Azure AD identity, everything works — the cluster starts and backups are successfully taken.

**Working configuration:**

```
apiVersion: barmancloud.cnpg.io/v1
kind: ObjectStore
metadata:
name: azure-store
spec:
configuration:
destinationPath: https://akspgdbbackup.blob.core.windows.net/mypgBackup
azureCredentials:
storageAccount:
name: azure-credentials
key: AZURE_STG_ACC
storageKey:
name: azure-credentials
key: AZURE_STG_KEY
wal:
compression: gzip
data:
compression: bzip2
retentionPolicy: "3d"

```

**Question**

Is **Workload Identity authentication** currently supported by the Barman Cloud plugin (v0.5.0)?
If yes, could you please clarify what additional configuration or permissions might be required for:
```
azureCredentials:
inheritFromAzureAD: true
```

**Contact**

If you need more details or logs, feel free to reach out to me at vishal.tanawade@emerson.com

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

No se nombra ningún archivo fuente ni ninguna prueba. Comienza en el hook pre-reconcile de barman-cloud.cloudnative-pg.io y sigue el procesamiento de azureCredentials.inheritFromAzureAD, comparándolo con la ruta funcional de credenciales de la cuenta de almacenamiento; el trabajo estará terminado cuando se identifique la compatibilidad o configuración que falta y se confirme una reconciliación exitosa del clúster con Azure Blob Storage.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
azure, go, kubernetes, postgresql
Área
authentication, backend, cloud
Tipo de issue
Error
Dificultad
4/5
Tiempo estimado
3-5 días
Estado de actividad
Estancado
Claridad
Bastante claro
Aptitud para principiantes
35/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.