[Feature] Dynamically load IaaS credentials during runtime #422
Labels
area/robustness
Robustness, reliability, resilience related
area/security
Security related
area/usability
Usability related
kind/enhancement
Enhancement, improvement, extension
Feature (What you would like to be added):
The etcd-backup-restore process reads IaaS credentials for access cloud provider storage when it creates the Snapstore. Most of the times the credentials change, e.g. due to secret rotation, the process needs to be restarted (depending on Snapstore provider).
To circumvent a required restart, etcd-backup-restore should re-read the credentials every time it performs any action on the bucket.
Motivation (Why is this needed?):
Dynamic credential retrieval prevents avoidable pod/container restarts which always involves a downtime of the etcd cluster if only one replica is involved.
Approach/Hint to the implement solution (optional):
It's important to use a file-based approach for every supported provider (already true for GCP today) rather than storing the access information in env vars.
etcd-backup-restore
is mostly deployed as a sidecar and content refreshing is only supported if Kubernetes secrets are mounted into the container (see https://kubernetes.io/docs/concepts/configuration/secret/#mounted-secrets-are-updated-automatically).The text was updated successfully, but these errors were encountered: