Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Feature] Dynamically load IaaS credentials during runtime #422

Closed
timuthy opened this issue Jan 25, 2022 · 3 comments · Fixed by #435 or gardener/etcd-druid#301
Closed

[Feature] Dynamically load IaaS credentials during runtime #422

timuthy opened this issue Jan 25, 2022 · 3 comments · Fixed by #435 or gardener/etcd-druid#301
Labels
area/robustness Robustness, reliability, resilience related area/security Security related area/usability Usability related kind/enhancement Enhancement, improvement, extension

Comments

@timuthy
Copy link
Member

timuthy commented Jan 25, 2022

Feature (What you would like to be added):
The etcd-backup-restore process reads IaaS credentials for access cloud provider storage when it creates the Snapstore. Most of the times the credentials change, e.g. due to secret rotation, the process needs to be restarted (depending on Snapstore provider).

To circumvent a required restart, etcd-backup-restore should re-read the credentials every time it performs any action on the bucket.

Motivation (Why is this needed?):
Dynamic credential retrieval prevents avoidable pod/container restarts which always involves a downtime of the etcd cluster if only one replica is involved.

Approach/Hint to the implement solution (optional):
It's important to use a file-based approach for every supported provider (already true for GCP today) rather than storing the access information in env vars. etcd-backup-restore is mostly deployed as a sidecar and content refreshing is only supported if Kubernetes secrets are mounted into the container (see https://kubernetes.io/docs/concepts/configuration/secret/#mounted-secrets-are-updated-automatically).

@timuthy timuthy added kind/enhancement Enhancement, improvement, extension area/security Security related area/usability Usability related area/robustness Robustness, reliability, resilience related labels Jan 25, 2022
@timuthy
Copy link
Member Author

timuthy commented Jan 25, 2022

cc @ishan16696 @abdasgupta @mliepold

@ishan16696
Copy link
Member

ishan16696 commented Jan 31, 2022

etcd-backup-restore should re-read the credentials every time it performs any action on the bucket.

Currently we just create snapstore object once and used the same obj throughout to access object bucket.
To do this there is no other option but to create/update the snapstore object every time backup sidecar tries to take the snapshot(full or delta).

@ishan16696
Copy link
Member

ishan16696 commented Feb 3, 2022

To Dynamically load IaaS credentials during runtime:

  • To circumvent a required restart, etcd-backup-restore should recreate/update the snapstore object every time it performs any action on the bucket.
  • Mount Kubernetes secrets into the container:
    • Google cloud storage(GCS)
    • AWS s3
    • Azure Blob Storage
    • Alicloud Object storage
    • Swift (Openstack)
  • Open another similar PR for master branch

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/robustness Robustness, reliability, resilience related area/security Security related area/usability Usability related kind/enhancement Enhancement, improvement, extension
Projects
None yet
2 participants