Commit a4ecbfbd authored by Naseem's avatar Naseem Committed by GitHub

[stable/Influxdb] make mounting of GSA key optional for backups to GCS (#20780)

* influxdb-fix-labels Signed-off-by: 's avatarNaseem <naseem@transit.app> * Fix labels Signed-off-by: 's avatarNaseem <naseem@transit.app> * Allow use of workload identity to auth to GCS By making the mounting of a GSA key optional, it give the option of using workload identity to provide the backup with access to GCS. For more info on workload identity please see https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identitySigned-off-by: 's avatarNaseem <naseem@transit.app>
parent 12ae9f17
apiVersion: v1 apiVersion: v1
name: influxdb name: influxdb
version: 4.0.1 version: 4.1.0
appVersion: 1.7.6 appVersion: 1.7.6
description: Scalable datastore for metrics, events, and real-time analytics. description: Scalable datastore for metrics, events, and real-time analytics.
keywords: keywords:
...@@ -15,4 +15,6 @@ maintainers: ...@@ -15,4 +15,6 @@ maintainers:
email: jack@influxdb.com email: jack@influxdb.com
- name: aisuko - name: aisuko
email: urakiny@gmail.com email: urakiny@gmail.com
- name: naseemkullah
email: naseem@transit.app
engine: gotpl engine: gotpl
approvers: approvers:
- jackzampolin - jackzampolin
- aisuko - aisuko
- naseemkullah
reviewers: reviewers:
- jackzampolin - jackzampolin
- aisuko - aisuko
- naseemkullah
...@@ -22,11 +22,13 @@ spec: ...@@ -22,11 +22,13 @@ spec:
volumes: volumes:
- name: backups - name: backups
emptyDir: {} emptyDir: {}
{{- if and .Values.backup.gcs }} {{- if .Values.backup.gcs }}
{{- if .Values.backup.gcs.serviceAccountSecret }}
- name: google-cloud-key - name: google-cloud-key
secret: secret:
secretName: {{ .Values.backup.gcs.serviceAccountSecret | quote }} secretName: {{ .Values.backup.gcs.serviceAccountSecret | quote }}
{{- end }} {{- end }}
{{- end }}
serviceAccountName: {{ include "influxdb.serviceAccountName" . }} serviceAccountName: {{ include "influxdb.serviceAccountName" . }}
initContainers: initContainers:
- name: influxdb-backup - name: influxdb-backup
...@@ -41,7 +43,7 @@ spec: ...@@ -41,7 +43,7 @@ spec:
- | - |
influxd backup -host {{ template "influxdb.fullname" . }}.{{ .Release.Namespace }}.svc:{{ .Values.config.rpc.bind_address }} -portable /backups/backup_$(date +%Y%m%d_%H%M%S) influxd backup -host {{ template "influxdb.fullname" . }}.{{ .Release.Namespace }}.svc:{{ .Values.config.rpc.bind_address }} -portable /backups/backup_$(date +%Y%m%d_%H%M%S)
containers: containers:
{{- if .Values.backup.gcs}} {{- if .Values.backup.gcs }}
- name: gsutil-cp - name: gsutil-cp
image: google/cloud-sdk:alpine image: google/cloud-sdk:alpine
command: command:
...@@ -49,21 +51,27 @@ spec: ...@@ -49,21 +51,27 @@ spec:
args: args:
- '-c' - '-c'
- | - |
if [ -n "$KEY_FILE" ]; then
gcloud auth activate-service-account --key-file $KEY_FILE gcloud auth activate-service-account --key-file $KEY_FILE
fi
gsutil -m cp -r "$SRC_URL" "$DST_URL" gsutil -m cp -r "$SRC_URL" "$DST_URL"
volumeMounts: volumeMounts:
- name: backups - name: backups
mountPath: /backups mountPath: /backups
{{- if .Values.backup.gcs.serviceAccountSecretKey}}
- name: google-cloud-key - name: google-cloud-key
mountPath: /var/secrets/google/ mountPath: /var/secrets/google/
{{- end }}
env: env:
- name: SRC_URL - name: SRC_URL
value: /backups value: /backups
- name: DST_URL - name: DST_URL
value: {{ .Values.backup.gcs.destination}} value: {{ .Values.backup.gcs.destination}}
{{- if .Values.backup.gcs.serviceAccountSecretKey}}
- name: KEY_FILE - name: KEY_FILE
value: /var/secrets/google/{{ .Values.backup.gcs.serviceAccountSecretKey }} value: /var/secrets/google/{{ .Values.backup.gcs.serviceAccountSecretKey }}
{{- end }} {{- end }}
{{- end }}
{{- if .Values.backup.azure }} {{- if .Values.backup.azure }}
- name: azure-cli - name: azure-cli
image: microsoft/azure-cli image: microsoft/azure-cli
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment