cockroachdb / cockroachdb/cockroach-operator
Allow specifying GCS credentials directly through the environment
- Dominant language
- Go
- Stars
- 318
- Forks
- 104
- Avg merge
- 1d 6h
- Merged PRs (30d)
- 1
Description
**Is your feature request related to a problem? Please describe.**
When using the operator there's seemingly no good way to add credentials for GCS with `AUTH=implicit`. Since it doesn't allow us to add volumes or volumeMounts and `GOOGLE_APPLICATION_CREDENTIALS` is expected to point to a file.
**Describe the solution you'd like**
An alternative environment variable where we can include the whole service account key json encoded in base64. E.g. `GOOGLE_APPLICATION_CREDENTIALS_BASE64`
**Describe alternatives you've considered**
* Using GCS with the S3 driver and HMAC keys instead, as these can be specified in their entirety from the environment.
* Shut down the cluster, add the credentials to each volume and read them from there.
**Additional context**
This could also be solved by implementing support for either additional volumes or additional initContainers in the operator, but not having to rely on the filesystem at all for this seems like a better approach.
Jira issue: CRDB-39766
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by tracing how AUTH=implicit handles GOOGLE_APPLICATION_CREDENTIALS in the operator and how environment variables are passed to the relevant component. Review the requested GOOGLE_APPLICATION_CREDENTIALS_BASE64 behavior and its interaction with GCS. Done means credentials can be supplied through that variable without relying on a mounted file.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, google-cloud
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100