search

gardener / etcd-backup-restore

Collection of components to backup and restore the etcd of a Kubernetes cluster.
Apache License 2.0
288 stars 100 forks source link

[BUG] Temporarily enable passing of cloud provider credentials in JSON through the directory pointed by `${PROVIDER}_APPLICATION_CREDENTIALS` #729

Closed unmarshall closed 5 months ago

unmarshall commented 6 months ago

Describe the bug:

Example provides 2 options to specify the backup bucket secret. Option 2 (with data as JSON) is not supported today and should be removed.

NOTE: Please make the correction for all object store providers.

This only creates confusion for adopters. See https://kubernetes.slack.com/archives/CB57N0BFG/p1713778819927999

ishan16696 commented 6 months ago

This feature was introduced in this PR: https://github.com/gardener/etcd-backup-restore/pull/435, at that time backup-restore was also consumed by community via helm-charts(standalone) without etcd-druid. In this PR: https://github.com/gardener/etcd-druid/pull/301, I integrated this feature with etcd-druid and if you check the release note of this PR, it only mention about passing secrets via file path <ProviderName>_APPLICATION_CREDENTIALS , not via JSON format as it druid never supported this JSON format secret. Reason: How's etcd-druid get to know that storage secrets are in json format or not ? StorageProviderName is a part of etcd spec but not the format of provider secret .That's why may be I decided not to make it more complicated and limit the json format only to backup-restore. I hope you got the background of the issue.

Example provides 2 options to specify the backup bucket secret. Option 2 (with data as JSON) is not supported today and should be removed.

It should be not removed as community might be consuming it (those who are running backup-restore standalone). We can just harmonize the both type of secrets format in backup-restore.

shreyas-s-rao commented 6 months ago

/assign @renormalize

renormalize commented 6 months ago

It was decided to temporarily enable passing of cloud provider credentials to etcd-backup-restore as a JSON file which resides in the directory pointed to by ${PROVIDER}_APPLICATION_CREDENTIALS, since members of the community were passing credentials through a JSON file, while using the directory method of passing credentials to etcd-backup-restore.

Though this specific method was never supported by etcd-backup-restore, enabling of passing credentials to etcd-backup-restore through two different formats, i.e. directory with individual files, and a singular JSON file, caused confusion in the community while using gardener/etcd-druid.

Only ${PROVIDER}_APPLICATION_CREDENTIALS is supported by etcd-druid, and examples present in etcd-backup-restore of passing credentials in JSON caused community members to pass credentials as a JSON file, through the directory while using etcd-druid, which caused etcd-backup-restore to error.

Therefore, after discussion, the maintainers have decided to deprecate passing credentials in a JSON format to etcd-backup-restore, and only support credentials through individual files in a directory. This will be deprecated 3 releases from now, i.e. v0.31.0 even though the project is only in alpha.

This will make the both projects aligned on the way credentials are passed.

Please include the intent to deprecate JSON credentials in the release notes for v0.29.0.