mirror of
https://github.com/cloudnative-pg/plugin-barman-cloud.git
synced 2026-01-11 13:23:09 +01:00
2c134eafe4
This commit adds support for the DefaultAzureCredential authentication mechanism in Azure Blob Storage. Users can now use the `useDefaultAzureCredentials` option to enable Azure's default credential chain, which automatically discovers and uses available credentials in the following order 1. Environment Variables (Service Principal) 2. Managed Identity 3. Azure CLI 4. Azure PowerShell This is particularly useful when running on Azure Kubernetes Service (AKS) with Workload Identity, eliminating the need to explicitly store credentials in Kubernetes Secrets. Signed-off-by: Armando Ruocco <armando.ruocco@enterprisedb.com> Signed-off-by: Gabriele Fedi <gabriele.fedi@enterprisedb.com> Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com> Co-authored-by: Gabriele Fedi <gabriele.fedi@enterprisedb.com> Co-authored-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
71 lines
2.1 KiB
Go
71 lines
2.1 KiB
Go
/*
|
|
Copyright © contributors to CloudNativePG, established as
|
|
CloudNativePG a Series of LF Projects, LLC.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
|
|
SPDX-License-Identifier: Apache-2.0
|
|
*/
|
|
|
|
package specs
|
|
|
|
import (
|
|
barmanapi "github.com/cloudnative-pg/barman-cloud/pkg/api"
|
|
machineryapi "github.com/cloudnative-pg/machinery/pkg/api"
|
|
)
|
|
|
|
// CollectSecretNamesFromCredentials collects the names of the secrets
|
|
func CollectSecretNamesFromCredentials(barmanCredentials *barmanapi.BarmanCredentials) []string {
|
|
var references []*machineryapi.SecretKeySelector
|
|
if barmanCredentials.AWS != nil {
|
|
references = append(
|
|
references,
|
|
barmanCredentials.AWS.AccessKeyIDReference,
|
|
barmanCredentials.AWS.SecretAccessKeyReference,
|
|
barmanCredentials.AWS.RegionReference,
|
|
barmanCredentials.AWS.SessionToken,
|
|
)
|
|
}
|
|
if barmanCredentials.Azure != nil {
|
|
// When using default Azure credentials or managed identity, no secrets are required
|
|
if !barmanCredentials.Azure.UseDefaultAzureCredentials &&
|
|
!barmanCredentials.Azure.InheritFromAzureAD {
|
|
references = append(
|
|
references,
|
|
barmanCredentials.Azure.ConnectionString,
|
|
barmanCredentials.Azure.StorageAccount,
|
|
barmanCredentials.Azure.StorageKey,
|
|
barmanCredentials.Azure.StorageSasToken,
|
|
)
|
|
}
|
|
}
|
|
if barmanCredentials.Google != nil {
|
|
references = append(
|
|
references,
|
|
barmanCredentials.Google.ApplicationCredentials,
|
|
)
|
|
}
|
|
|
|
result := make([]string, 0, len(references))
|
|
for _, reference := range references {
|
|
if reference == nil {
|
|
continue
|
|
}
|
|
result = append(result, reference.Name)
|
|
}
|
|
|
|
// TODO: stringset belongs to machinery :(
|
|
|
|
return result
|
|
}
|