BR: support Azure blob storage sas token #5720
Conversation
| values.Add("sas-token", conf.sasToken) | ||
| } | ||
| if v := values.Encode(); v != "" { | ||
| path = path + "?" + v |
There was a problem hiding this comment.
|
/run-pull-e2e-kind-br |
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #5720 +/- ##
===========================================
- Coverage 61.47% 21.02% -40.45%
===========================================
Files 235 219 -16
Lines 30653 30618 -35
===========================================
- Hits 18843 6437 -12406
- Misses 9920 23269 +13349
+ Partials 1890 912 -978
|
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: csuzhangxc The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
[LGTM Timeline notifier]Timeline:
|
|
New changes are detected. LGTM label has been removed. |
|
/cherry-pick release-1.6 |
|
@csuzhangxc: once the present PR merges, I will cherry-pick it on top of release-1.6 in the new PR and assign it to you. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the ti-community-infra/tichi repository. |
|
@csuzhangxc: new pull request created to branch DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the ti-community-infra/tichi repository. |
Co-authored-by: tennix <[email protected]>
4 participants
What problem does this PR solve?
Previously, tidb-operator only supports access key and AAD authentication for Azure blob storage. The SAS (Shared Access Signature) token is also commonly used, especially for cross Azure tenant scenario. The BR kernel already supports SAS token authentication. This PR adds SAS token support in tidb-operator.
On Azure, the storage account is a namespace for Azure storage. In this respect, it's similar to S3 and GCS bucket. Though Azure blob storage has another hierarchy
container. So the storage account should also be in theBackupCR spec. The BR kernel should also re-organize the storage account as normal argument.What is changed and how does it work?
I add two new fields (
StorageAccount,SasToken) inAzblobStorageProviderand concatenate the br command arguments with these two new fields. Now the authentication for Azure is as follows:Backup.Spec.StorageProvider.Azblob.SasTokenis specified, then use SAS token authenticationBackup.Spec.StorageProvider.Azblob.StorageAccountis specified, then use this to set backup-manager pod env. Otherwise get storage account from secret as before.Code changes
Tests
I've tested this PR manually in local kind environment with Azure blob storage SAS token. The backup job finished successfully. The storage account and sas token are all set in
BackupCR spec without specifyingspec.azblob.secretNameI've also tested backup via access key with following two cases:
AZURE_STORAGE_KEYand specifying the storage account in thespec.azblob.storageAccountAZURE_STORAGE_KEYandAZURE_STORAGE_ACCOUNTin secret, but not specifyingspec.azblob.storageAccountBoth cases succeeded as expected.
Side effects
Related changes
Release Notes
Please refer to Release Notes Language Style Guide before writing the release note.