Postgres-operator: Google Cloud Storage Credentials

[michailbrynard]

After experimenting with the Patroni helm chart, I've decided to go with the postgres-operator instead.

The Patroni helm chart allows Gcloud credentials to be stored as a secret which is then mounted as a volume referenced by the GOOGLE_APPLICATION_CREDENTIALS environmental variable. It looks like the operator makes no such provision. What would be the suggested way to inject the Google Cloud credentials for WALE backups into the Spillo pods using the operator?

[Jan-M]

Sounds like the operator should take care of this, similar to it already specifying the IAM role in an AWS environment. We can probably take a quick look at this, as we know from the helm chart how this should look like and would make the operator more attractive to non AWS users.

[michailbrynard]

Yes, that would be great for users running on GKE!

[michailbrynard]

After a bit of experimentation on GKE, it seems that if the GOOGLE_APPLICATION_CREDENTIALS environmental variable is not set, the gcloud sdk in the spilo container defaults to using the gcloud service account associated with the kubernetes service account for the pod. This makes the feature to allow the mounting of the gcloud credentials less critical as the default behaviour is similar to --aws-instance-profile as long as the RBAC and Google Cloud service accounts are set up properly.

[Jan-M]

:+1:

[rporres]

We use the operator to deploy postgres in bare metal kubernetes. We're interested in this as we keep our infra backups in GCE. Unfortunately @michailbrynard's workaround won't work in our case as there are no gcloud service account associated to the kubernetes service account for the pod. Any suggestions about how to proceed? We're happy to contribute if needed, but since we're starting using the operator guidance would be more than welcomed.

[FxKu]

@rporres take a look the PR #535. Another user who runs the operator on bare metal and came up with a solution.