feat(operator): Allow setting explicit CredentialMode in LokiStack storage spec #12106
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
periklis
approved these changes
Mar 4, 2024
There was a problem hiding this comment.
Since we use Options.CredentialsMode in storage/configure.go to determine which mounts/volumes to consider we can probably remove S3.STS, GCS.WorkloadIdentity and Azure.WorkloadIdentity. WDYT?
|
Tested the new code on Azure and GCP as well. Seems to work fine 👍 |
periklis
reviewed
Mar 4, 2024
| @@ -19,9 +20,9 @@ import ( | |||
| "github.com/grafana/loki/operator/internal/manifests/openshift" | |||
| ) | |||
|
|
|||
| // CreateCredentialsRequest creates a new CredentialsRequest resource for a Lokistack | |||
| // CreateUpdateDeleteCredentialsRequest creates a new CredentialsRequest resource for a Lokistack | |||
There was a problem hiding this comment.
nit.
Suggested change
| // CreateUpdateDeleteCredentialsRequest creates a new CredentialsRequest resource for a Lokistack | |
| // CreateUpdateDeleteCredentialsRequest manages a new CredentialsRequest resource for a Lokistack |
periklis
approved these changes
Mar 4, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
Currently it is not possible to run the operator in managed mode and then deploy a LokiStack using a different mode for credentials to the object storage (static credentials or non-managed tokens). This is due to the credential-mode being determined only by the environment of the operator and the provided secret, making it an implicit consequence of the configuration instead of an explicit configuration.
This PR adds an optional attribute to the LokiStack's spec that allows the user to override the default credential mode. The main use-case for this is running a non-managed credential with an operator running in a managed-credentials OpenShift cluster, but it can also be used make the credentials-mode explicit for other deployments instead of having the operator decide based on the provided secret.
Which issue(s) this PR fixes:
Fixes LOG-5105
Special notes for your reviewer:
CredentialModeis an enum with just three possible values, but it is optional, so""is a possible value inside the operator as well, although this can not be set on theLokiStackresource.CredentialsRequestis only created when running in managed-mode. It is also removed when the mode changes and it had been created before.Checklist
CONTRIBUTING.mdguide (required)CHANGELOG.mdupdated