cloudnative-pg / cloudnative-pg/plugin-barman-cloud

Cluster fails to start when using Azure AD Workload Identity with Barman plugin

Ouverte
#649 7 commentaires 0 réactions 0 personnes assignées Voir sur GitHub
question
Langage dominant
Go
Étoiles
191
Forks
72
Merge moyen
2 j 21 h
PR mergées (30 j)
21

Description

### Environment
**CNPG Version**: v1.26
**PostgreSQL Image**: ghcr.io/cloudnative-pg/postgresql:17.5-standard-bookworm
**Barman Plugin Version**: 0.5.0
**Kubernetes**: AKS (with Azure AD Workload Identity)

### Goal

I’m trying to configure **Barman Cloud Plugin** to take backups to **Azure Blob Storage** using **Azure AD Workload Identity** (instead of using storage account key credentials).

**ObjectStore configuration (with Workload Identity)**

```apiVersion: barmancloud.cnpg.io/v1
kind: ObjectStore
metadata:
name: azure-store
spec:
configuration:
destinationPath: https://akspgdbbackup.blob.core.windows.net/mypgBackup
azureCredentials:
inheritFromAzureAD: true
wal:
compression: gzip
data:
compression: bzip2
retentionPolicy: "3d"
```

**Cluster configuration**

```
apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
name: test-1
namespace: test-namespace
labels:
env: devl
app: test
svc: db
podname: "test-1"
wa: NALA
spec:
instances: 1
imagePullPolicy: Always
imageCatalogRef:
apiGroup: postgresql.cnpg.io
kind: ImageCatalog
name: test-postgres-catalog
major: 17
enableSuperuserAccess: true
imagePullSecrets:
- name: testcregcred
storage:
size: 1Gi
plugins:
- name: barman-cloud.cloudnative-pg.io
isWALArchiver: true
parameters:
barmanObjectName: azure-store
```

**Observed behavior**

When I create the cluster, reconciliation fails with the following error:

```
Pre-reconcile hook stopped the reconciliation loop","controller":"cluster","controllerGroup":"postgresql.cnpg.io","controllerKind":"Cluster","Cluster":{"test-1","namespace":"test-namespace"},"namespace":"test-namespace","name":"test-1","reconcileID":"e00c4983-8c70-45e4-ab3a-32e4bf8bfe6f","hookResult":{"result":{"Requeue":true,"RequeueAfter":0},"err":null,"stopReconciliation":true,"identifier":"barman-cloud.cloudnative-pg.io"}}

no orphan PVCs found, skipping the restored cluster
```
The cluster remains in a failed reconciliation loop.

**Expected behavior**

Cluster should initialize successfully and be able to use the configured Azure Blob Storage via Workload Identity

**Workaround**

If I change the ObjectStore to use storage account credentials instead of Azure AD identity, everything works — the cluster starts and backups are successfully taken.

**Working configuration:**

```
apiVersion: barmancloud.cnpg.io/v1
kind: ObjectStore
metadata:
name: azure-store
spec:
configuration:
destinationPath: https://akspgdbbackup.blob.core.windows.net/mypgBackup
azureCredentials:
storageAccount:
name: azure-credentials
key: AZURE_STG_ACC
storageKey:
name: azure-credentials
key: AZURE_STG_KEY
wal:
compression: gzip
data:
compression: bzip2
retentionPolicy: "3d"

```

**Question**

Is **Workload Identity authentication** currently supported by the Barman Cloud plugin (v0.5.0)?
If yes, could you please clarify what additional configuration or permissions might be required for:
```
azureCredentials:
inheritFromAzureAD: true
```

**Contact**

If you need more details or logs, feel free to reach out to me at vishal.tanawade@emerson.com

Guide de contribution

Ouvrir le guide de contribution

Piste de recherche

Aucun fichier source ni test n’est indiqué. Commencez par le hook pre-reconcile de barman-cloud.cloudnative-pg.io et suivez le traitement de azureCredentials.inheritFromAzureAD, en le comparant au chemin fonctionnel des identifiants du compte de stockage ; le travail est terminé lorsque la prise en charge ou la configuration manquante est identifiée et qu’une réconciliation réussie du cluster avec Azure Blob Storage est confirmée.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Évaluation

Stack technique
azure, go, kubernetes, postgresql
Domaine
authentication, backend, cloud
Type d'issue
Bug
Difficulté
4/5
Temps estimé
3-5 jours
Activité
À l'abandon
Clarté
Plutôt claire
Accessibilité débutants
35/100

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.