K8SPSMDB-1602: support Workload Identity for GCS backup storage#2315
Open
TineoC wants to merge 2 commits intopercona:mainfrom
Open
K8SPSMDB-1602: support Workload Identity for GCS backup storage#2315TineoC wants to merge 2 commits intopercona:mainfrom
TineoC wants to merge 2 commits intopercona:mainfrom
Conversation
Add support for GKE Workload Identity Federation when authenticating with Google Cloud Storage for backups. This eliminates the requirement for exported service account JSON keys (credentialsSecret). Changes: - Add GCSCredentials struct with WorkloadIdentity field to BackupStorageGCSSpec - Make credentialsSecret optional (omitempty) when workloadIdentity is enabled - Update GetPBMStorageGCSConfig to skip credential secret loading when WI is enabled - Patch PBM's newGoogleClient to fall back to Application Default Credentials (ADC) when no explicit credentials are provided, enabling transparent GKE WI auth When credentials.workloadIdentity is true in the CR: spec.backup.storages.gcs.credentials.workloadIdentity: true The operator skips reading credentialsSecret and PBM authenticates via the pod's Kubernetes Service Account, which is federated to a GCP SA through GKE Workload Identity. This aligns with PBM 2.13.0's native WIF support and Google's security best practice of avoiding exported service account keys, which is required for IL4/FedRAMP environments. Closes: percona#2314
TineoC
requested review from
egegunes,
gkech,
hors,
mayankshah1607,
nmarukovich,
oksana-grishchenko and
pooknull
as code owners
|
|
The PBM ADC fallback should be contributed separately to percona/percona-backup-mongodb. This commit retains only the operator API type changes (GCSCredentials struct) and the backup logic to skip credential loading when WI is enabled.
Collaborator
commit: 83c87ce |
Member
mayankshah1607
left a comment
mayankshah1607
left a comment
There was a problem hiding this comment.
Hi, thanks for your PR. I believe we also need to add E2E tests for this
Comment on lines
+505
to
+509
| // When WorkloadIdentity is enabled, skip credential secret loading entirely. | ||
| // PBM will use Application Default Credentials (ADC) provided by GKE Workload Identity. | ||
| useWorkloadIdentity := stg.GCS.Credentials != nil && stg.GCS.Credentials.WorkloadIdentity | ||
|
|
||
| if !useWorkloadIdentity && stg.GCS.CredentialsSecret != "" { |
Member
There was a problem hiding this comment.
Please add coverage for this in pbm_test.go
| // When WorkloadIdentity is true, PBM uses Application Default Credentials (ADC) | ||
| // provided by GKE Workload Identity instead of a credentialsSecret. | ||
| type GCSCredentials struct { | ||
| WorkloadIdentity bool `json:"workloadIdentity,omitempty"` |
Member
There was a problem hiding this comment.
Why does it need to be embedded inside GCSCredentials object?
egegunes
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
credentials.workloadIdentityfield toBackupStorageGCSSpecenabling GCS backups via GKE Workload Identity without exported service account keysnewGoogleClientto fall back to Application Default Credentials (ADC) when no explicit credentials are providedcredentialsSecretoptional when workload identity is enabledMotivation
GKE environments using Workload Identity (Google's recommended approach) currently cannot use GCS backups because:
credentialsSecretand passesclientEmail/privateKeyto PBMnewGoogleClientrequires these fields and errors with:"clientEmail and privateKey are required for GCS credentials"roles/storage.objectUser, PBM never tries ADCThis is blocking for IL4/FedRAMP environments where exporting service account JSON keys is not permitted.
Closes #2314
Changes
Operator API (
pkg/apis/psmdb/v1/psmdb_types.go)GCSCredentialsstruct withWorkloadIdentity boolfieldCredentials *GCSCredentialstoBackupStorageGCSSpecCredentialsSecrettagomitemptyOperator Backup Logic (
pkg/psmdb/backup/pbm.go)credentials.workloadIdentity: true, skip readingcredentialsSecretPBM GCS Client (
pbm/storage/gcs/google_client.go)ClientEmailandPrivateKeyare both empty, usestoragegcs.NewClient(ctx)(ADC) instead of erroringUsage
Test plan
go test ./pkg/...)credentialsSecretstill works (backward compat)credentials.workloadIdentity: trueon GKE with WI succeeds🤖 Generated with Claude Code