Cluster fails to start when using Azure AD Workload Identity with Barman plugin

Environment

CNPG Version: v1.26
PostgreSQL Image: ghcr.io/cloudnative-pg/postgresql:17.5-standard-bookworm
Barman Plugin Version: 0.5.0
Kubernetes: AKS (with Azure AD Workload Identity)

Goal

I’m trying to configure Barman Cloud Plugin to take backups to Azure Blob Storage using Azure AD Workload Identity (instead of using storage account key credentials).

ObjectStore configuration (with Workload Identity)

kind: ObjectStore
metadata:
  name: azure-store
spec:
  configuration:
    destinationPath: https://akspgdbbackup.blob.core.windows.net/mypgBackup
    azureCredentials:
      inheritFromAzureAD: true
    wal:
      compression: gzip
    data:
      compression: bzip2
  retentionPolicy: "3d"

Cluster configuration

apiVersion: postgresql.cnpg.io/v1
kind: Cluster
metadata:
  name: test-1
  namespace: test-namespace
  labels:
    env: devl
    app: test
    svc: db
    podname: "test-1"
    wa: NALA
spec:
  instances: 1
  imagePullPolicy: Always
  imageCatalogRef:
    apiGroup: postgresql.cnpg.io
    kind: ImageCatalog
    name: test-postgres-catalog
    major: 17
  enableSuperuserAccess: true
  imagePullSecrets:
    - name: testcregcred
  storage:
    size: 1Gi
  plugins:
    - name: barman-cloud.cloudnative-pg.io
      isWALArchiver: true
      parameters:
        barmanObjectName: azure-store

Observed behavior

When I create the cluster, reconciliation fails with the following error:

Pre-reconcile hook stopped the reconciliation loop","controller":"cluster","controllerGroup":"postgresql.cnpg.io","controllerKind":"Cluster","Cluster":{"test-1","namespace":"test-namespace"},"namespace":"test-namespace","name":"test-1","reconcileID":"e00c4983-8c70-45e4-ab3a-32e4bf8bfe6f","hookResult":{"result":{"Requeue":true,"RequeueAfter":0},"err":null,"stopReconciliation":true,"identifier":"barman-cloud.cloudnative-pg.io"}}


no orphan PVCs found, skipping the restored cluster

The cluster remains in a failed reconciliation loop.

Expected behavior

Cluster should initialize successfully and be able to use the configured Azure Blob Storage via Workload Identity

Workaround

If I change the ObjectStore to use storage account credentials instead of Azure AD identity, everything works — the cluster starts and backups are successfully taken.

Working configuration:

apiVersion: barmancloud.cnpg.io/v1
kind: ObjectStore
metadata:
  name: azure-store
spec:
  configuration:
    destinationPath: https://akspgdbbackup.blob.core.windows.net/mypgBackup
    azureCredentials:
      storageAccount:
        name: azure-credentials
        key: AZURE_STG_ACC
      storageKey:
        name: azure-credentials
        key: AZURE_STG_KEY
    wal:
      compression: gzip
    data:
      compression: bzip2
  retentionPolicy: "3d"

Question

Is Workload Identity authentication currently supported by the Barman Cloud plugin (v0.5.0)?
If yes, could you please clarify what additional configuration or permissions might be required for:

azureCredentials:
  inheritFromAzureAD: true

Contact

If you need more details or logs, feel free to reach out to me at vishal.tanawade@emerson.com

未指定源文件或测试。从 barman-cloud.cloudnative-pg.io 的 pre-reconcile hook 开始，跟踪 azureCredentials.inheritFromAzureAD 的处理，并将其与正常工作的存储帐户凭据路径进行比较；完成的标准是确定缺失的支持或配置，并确认集群与 Azure Blob Storage 的协调成功完成。