-
Notifications
You must be signed in to change notification settings - Fork 83
adding support for workload identity in neo4j admin backup #1131
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
|
Thanks for the documentation updates. The preview documentation has now been torn down - reopening this PR will republish it. |
4271d00 to
a60b0f2
Compare
| ==== Configure the _backup-values.yaml_ file using service account workload identity integration | ||
|
|
||
| In some deployment situations, it may be desirable to assign a Kubernetes Service Account to the Neo4j backup pod. | ||
| For example, if processes in the pod want to connect to services that require Service Account authorization. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
For example , a service account with workload identity if you want to use workload identity integration to access the cloud provider bucket.
You can use the above line instead of if processes....
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
But it doesn't say why it is desirable... How about something like this:
"In certain situations, it may be useful to assign a Kubernetes Service Account with workload identity integration to the Neo4j backup pod. This is particularly relevant when you want to improve security and have more precise access control for the pod. Doing so ensures that secure access to resources is granted based on the pod's identity within the cloud ecosystem."
|
|
||
| [.tabbed-example] | ||
| ===== | ||
| [.include-with-gke] |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
serviceAccountName field is not part of neo4j ..and keep secretNAme and secretKeyName empty for serviceAccount with workload identity examples
neo4j:
image: "neo4j/helm-charts-backup"
imageTag: "5.13.0"
jobSchedule: "* * * * *"
successfulJobsHistoryLimit: 3
failedJobsHistoryLimit: 1
backoffLimit: 3
backup:
bucketName: "my-bucket"
databaseAdminServiceName: "standalone-admin" #This is the Neo4j Admin Service name.
database: "neo4j,system"
cloudProvider: "gcp"
secretName: ""
secretKeyName: ""
consistencyCheck:
enabled: true
serviceAccountName: "demo-service-account"
Cherry-picks #1131 and updates the version and the yaml file.
No description provided.