add CLONE/STANDBY_AWS_STS_REGIONAL_ENDPOINTS when IRSA is configured - #3181
Open
jopadi wants to merge 1 commit into
Open
add CLONE/STANDBY_AWS_STS_REGIONAL_ENDPOINTS when IRSA is configured#3181jopadi wants to merge 1 commit into
jopadi wants to merge 1 commit into
Conversation
jopadi
requested review from
FxKu,
Jan-M,
hughcapet,
idanovinda and
mikkeloscar
as code owners
September 3, 2026 10:53
jopadi
changed the title
Collaborator
|
AWS_STS_REGIONAL_ENDPOINTS is not set anywhere today, so both the main pod and clone/standby currently use the global STS endpoint. Hardcoding "regional" only for clone/standby would make them inconsistent with the main pod. Additionally, changing the default STS endpoint behavior would be a breaking change for existing OSS users who may rely on the global endpoint. IMO the right approach would be to expose this as an operator config field (e.g. aws_sts_regional_endpoints) with no default, so users can opt in explicitly. I don't have much experience in this project, so I will let other provide also feedback. |
tcondeixa
reviewed
Sep 3, 2026
| result = append(result, v1.EnvVar{Name: "CLONE_AWS_ROLE_ARN", Value: c.OpConfig.IRSARoleARN}) | ||
| result = append(result, v1.EnvVar{Name: "CLONE_AWS_WEB_IDENTITY_TOKEN_FILE", Value: "/var/run/secrets/eks.amazonaws.com/serviceaccount/token"}) | ||
| result = append(result, v1.EnvVar{Name: "CLONE_AWS_REGION", Value: c.OpConfig.AWSRegion}) | ||
| result = append(result, v1.EnvVar{Name: "STANDBY_AWS_STS_REGIONAL_ENDPOINTS", Value: "regional"}) |
Collaborator
There was a problem hiding this comment.
this is in the wrong place
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Follows up on #3180.
When
irsa_role_arnis set, the operator injects IRSA-related env vars for clone and standby clusters. However,AWS_STS_REGIONAL_ENDPOINTSwas missing. Without it, WAL-G may fall back to a global STS endpoint or construct a broken one, causing credential retrieval to fail.This change adds
CLONE_AWS_STS_REGIONAL_ENDPOINTSandSTANDBY_AWS_STS_REGIONAL_ENDPOINTSwith valueregional, consistent with how the other IRSA vars are hardcoded.NOTE: PR created with the help of AI agents