cockroachdb / cockroachdb/cockroach-operator

Allow specifying GCS credentials directly through the environment

Open
#1,038 1 comment 0 reactions 0 assignees View on GitHub
T-dev-inf
Dominant language
Go
Stars
318
Forks
104
Avg merge
1d 6h
Merged PRs (30d)
1

Description

**Is your feature request related to a problem? Please describe.**
When using the operator there's seemingly no good way to add credentials for GCS with `AUTH=implicit`. Since it doesn't allow us to add volumes or volumeMounts and `GOOGLE_APPLICATION_CREDENTIALS` is expected to point to a file.

**Describe the solution you'd like**
An alternative environment variable where we can include the whole service account key json encoded in base64. E.g. `GOOGLE_APPLICATION_CREDENTIALS_BASE64`

**Describe alternatives you've considered**
* Using GCS with the S3 driver and HMAC keys instead, as these can be specified in their entirety from the environment.
* Shut down the cluster, add the credentials to each volume and read them from there.

**Additional context**
This could also be solved by implementing support for either additional volumes or additional initContainers in the operator, but not having to rely on the filesystem at all for this seems like a better approach.

Jira issue: CRDB-39766

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing how AUTH=implicit handles GOOGLE_APPLICATION_CREDENTIALS in the operator and how environment variables are passed to the relevant component. Review the requested GOOGLE_APPLICATION_CREDENTIALS_BASE64 behavior and its interaction with GCS. Done means credentials can be supplied through that variable without relying on a mounted file.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, google-cloud
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.