Skip to content

use pod or workload identity#924

Draft
till wants to merge 3 commits intoopeneverest:mainfrom
till:use-pod-or-workload-identity
Draft

use pod or workload identity#924
till wants to merge 3 commits intoopeneverest:mainfrom
till:use-pod-or-workload-identity

Conversation

@till
Copy link
Copy Markdown

@till till commented Feb 2, 2026

  • feat(backup): workload identity for Azure/AWS
  • fix: correct backupStorages map lookup by using backup storage name instead of repo name

  • someone needs to test/review the AWS part
  • pgbackrest is currently too old 👇🏼

pgbackrest 2.58.0 was released a couple of days ago and adds support for managed identities. I briefly tested if it was already available in the percona repository:

# rebuild the image in percona-docker:
docker run --rm -it till/percona-pgbackrest:latest bash
bash-5.1$ pgbackrest version
pgBackRest 2.57.0

Generally, not sure what the procedure is to get the images rebuild in percona-docker (once it is available).

CHANGE DESCRIPTION


Problem:

EVEREST-0

Short explanation of the problem.

I want to use workload identity so that we don't have to maintain credentials for backups.

Related pull requests

  • [link]

Cause:

Maintaining and rotating credentials is a nightmare.

Solution:

The solution is (hopefully) this PR as it adds the feature for Azure and AWS.

CHECKLIST


Helm chart

  • Is the helm chart updated with the new changes? (if applicable)

Jira

  • Is the Jira ticket created and referenced properly?

Tests

  • Is an Integration test/test case added for the new feature/change?
  • Are unit tests added where appropriate?

@till till requested a review from a team as a code owner February 2, 2026 19:46
@it-percona-cla
Copy link
Copy Markdown

it-percona-cla commented Feb 2, 2026

CLA assistant check
All committers have signed the CLA.

@till till marked this pull request as draft February 2, 2026 19:51
Copy link
Copy Markdown
Contributor

@recharte recharte left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @till thanks for driving this initiative, overall the changes look to be heading in the right direction. I still need to spend some more time with pg_repos_reconciler.go to make sure everything is fine.
Also, it would be great if you could extend the integration tests with these new cases. You'll see Makefile targets that will help you run those integration tests

till added 3 commits February 4, 2026 19:04
the backupStorageName function was causing nil pointer dereference crashes
when processing Azure backups because it assumed all repos were S3 storage.

updated to check storage type and match appropriate fields for both S3 and
Azure storage types.

added unit tests to verify correct behavior for S3, Azure, namespace
mismatch, and error cases.
@till till force-pushed the use-pod-or-workload-identity branch from cf4e13b to f763334 Compare February 4, 2026 18:05
@till
Copy link
Copy Markdown
Author

till commented Mar 29, 2026

@recharte I'd pick this up again in April and see if Percona updated pgbackrest, did you have any feedback?

@recharte
Copy link
Copy Markdown
Contributor

@till Percona will release PGO v2.9.0 within 1 week and it will feature PGBackRest 2.58.0 as you can see here, that file is part of this PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants