search

zalando / spilo

Highly available elephant herd: HA PostgreSQL cluster using Docker
Apache License 2.0
1.56k stars 387 forks source link

S3 Backups/Restores Shouldn't Use Instance Profile When Assuming Roles #837

Open estein9825 opened 1 year ago

estein9825 commented 1 year ago

With the advent of assumed roles and OIDC, we should not be using instance profile to retrieve credentials. Instead it should be through the boto sts. This creates problems because I have a pod that has assumed one role thanks to annotations on the service account, but a meta-data call to 169.254.169.254 returns the instance profile ID instead.

We should allow one to disable BOTH instance profile AND aws key/secret, and just get the info from the assumed role.

Issue is because of here: https://github.com/zalando/spilo/blob/4731ce3f26ace36d6c7687a194f4055edce2dc7e/postgres-appliance/scripts/wal-e-wal-fetch.sh#L118

CyberDem0n commented 1 year ago

This script was introduced to address slowness of wal-e. Now you should just use wal-g instead.