[FEATURE] Support IRSA for access

[akloss-terion]

Is your feature request related to a problem? Please describe.

Using static AWS credentials is discouraged. IRSA is the canonical way for Kubernetes pods to access AWS services, including S3.

Describe the solution you'd like

Support using IRSA to provision credentials rather than explicitly provided credentials.

Describe alternatives you've considered

Creating static credentials is generally discouraged. If the provider supporter a session token in addition to the access key id and secret key one could implement a helper pod to keep the secret populated with current credentials derived from IRSA.

Additional context

It does not appear that the plugin supports configuration without static keys. When I remove .spec.storage.s3.accessKeyId and .spec.storage.s3.accessKeySecret the controller crashes with a nil dereference.

Impact

Implementing this would improve the security and simplify the configuration for clusters already using IRSA.

Implementation ideas (optional)

There are environment variables (AWS_WEB_IDENTITY_TOKEN_FILE and AWS_ROLE_ARN) which can be used to identify that IRSA is the desired credential source.

[akloss-terion]

This is from the controller manager pod:

panic caught: runtime error: invalid memory address or nil pointer dereference

goroutine 131981 [running]:
github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/recovery.recoverFrom({0x2594a10?, 0xc0020aec00?}, {0x1ed1be0, 0x37d2bd0}, 0xc000894a4f?)
	/go/pkg/mod/github.com/grpc-ecosystem/go-grpc-middleware/v2@v2.2.0/interceptors/recovery/interceptors.go:57 +0x65
github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/recovery.UnaryServerInterceptor.func1.1()
	/go/pkg/mod/github.com/grpc-ecosystem/go-grpc-middleware/v2@v2.2.0/interceptors/recovery/interceptors.go:30 +0x67
panic({0x1ed1be0?, 0x37d2bd0?})
	/usr/local/go/src/runtime/panic.go:791 +0x132
github.com/wal-g/cnpg-plugin-wal-g/internal/controller.collectSecretsAndConfigMapsNamesFromBackupConfig(0xc001e11c20)
	/cnpg-plugin-wal-g/internal/controller/backupconfig_roles.go:93 +0x70
github.com/wal-g/cnpg-plugin-wal-g/internal/controller.BuildRoleForBackupConfigs(0xc0016ee120, 0xa?, {0xc001e11c20, 0x1, 0x1?})
	/cnpg-plugin-wal-g/internal/controller/backupconfig_roles.go:43 +0x1e5
github.com/wal-g/cnpg-plugin-wal-g/internal/operator.ReconcilerImplementation.ensureRole({{0x25a7fe0?, 0xc0006a27e0?}, {}}, {0x2594a10, 0xc0020aefc0}, 0xc001e7e008, {0xc001e11c20, 0x1, 0x1})
	/cnpg-plugin-wal-g/internal/operator/plugin_reconciler.go:181 +0x5bb
github.com/wal-g/cnpg-plugin-wal-g/internal/operator.ReconcilerImplementation.Pre({{0x25a7fe0?, 0xc0006a27e0?}, {}}, {0x2594a10, 0xc0020aec00}, 0xc0026995c0)
	/cnpg-plugin-wal-g/internal/operator/plugin_reconciler.go:128 +0x8b8
github.com/cloudnative-pg/cnpg-i/pkg/reconciler._ReconcilerHooks_Pre_Handler.func1({0x2594a10?, 0xc0020aec00?}, {0x2028f60?, 0xc0026995c0?})
	/go/pkg/mod/github.com/cloudnative-pg/cnpg-i@v0.2.0/pkg/reconciler/reconciler_grpc.pb.go:152 +0xcb
github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors/recovery.UnaryServerInterceptor.func1({0x2594a10?, 0xc0020aec00?}, {0x2028f60?, 0xc0026995c0?}, 0x1ed2600?, 0x3843b40?)
	/go/pkg/mod/github.com/grpc-ecosystem/go-grpc-middleware/v2@v2.2.0/interceptors/recovery/interceptors.go:34 +0x8a
google.golang.org/grpc.getChainUnaryHandler.func1({0x2594a10, 0xc0020aec00}, {0x2028f60, 0xc0026995c0})
	/go/pkg/mod/google.golang.org/grpc@v1.71.0/server.go:1217 +0xb2
github.com/cloudnative-pg/cnpg-i-machinery/pkg/pluginhelper/http.(*Server).Start.loggingUnaryServerInterceptor.func3({0x2594a10?, 0xc0020aebd0?}, {0x2028f60, 0xc0026995c0}, 0xc0018a1360?, 0xc000916080)
	/go/pkg/mod/github.com/cloudnative-pg/cnpg-i-machinery@v0.2.0/pkg/pluginhelper/http/grpc.go:37 +0x4e
google.golang.org/grpc.getChainUnaryHandler.func1({0x2594a10, 0xc0020aebd0}, {0x2028f60, 0xc0026995c0})
	/go/pkg/mod/google.golang.org/grpc@v1.71.0/server.go:1217 +0xb2
github.com/cloudnative-pg/cnpg-i-machinery/pkg/pluginhelper/http.(*Server).Start.logFailedRequestsUnaryServerInterceptor.func2({0x2594a10?, 0xc0020aebd0?}, {0x2028f60?, 0xc0026995c0?}, 0xc0018a1360, 0xc002908ff0?)
	/go/pkg/mod/github.com/cloudnative-pg/cnpg-i-machinery@v0.2.0/pkg/pluginhelper/http/grpc.go:49 +0x55
google.golang.org/grpc.NewServer.chainUnaryServerInterceptors.chainUnaryInterceptors.func1({0x2594a10, 0xc0020aebd0}, {0x2028f60, 0xc0026995c0}, 0xc0018a1360, 0x80?)
	/go/pkg/mod/google.golang.org/grpc@v1.71.0/server.go:1208 +0x85
github.com/cloudnative-pg/cnpg-i/pkg/reconciler._ReconcilerHooks_Pre_Handler({0x20c0ea0, 0xc000397050}, {0x2594a10, 0xc0020aebd0}, 0xc002084200, 0xc0004c4ca0)
	/go/pkg/mod/github.com/cloudnative-pg/cnpg-i@v0.2.0/pkg/reconciler/reconciler_grpc.pb.go:154 +0x143
google.golang.org/grpc.(*Server).processUnaryRPC(0xc000168400, {0x2594a10, 0xc0020aeb10}, 0xc002699560, 0xc000951da0, 0x37fb5f8, 0x0)
	/go/pkg/mod/google.golang.org/grpc@v1.71.0/server.go:1405 +0x103b
google.golang.org/grpc.(*Server).handleStream(0xc000168400, {0x2595828, 0xc001694000}, 0xc002699560)
	/go/pkg/mod/google.golang.org/grpc@v1.71.0/server.go:1815 +0xbaa
google.golang.org/grpc.(*Server).serveStreams.func2.1()
	/go/pkg/mod/google.golang.org/grpc@v1.71.0/server.go:1035 +0x7f
created by google.golang.org/grpc.(*Server).serveStreams.func2 in goroutine 130260
	/go/pkg/mod/google.golang.org/grpc@v1.71.0/server.go:1046 +0x125

or if I set accessKeyId and accessKeySecret to {} I get this from the running database pod:

github.com/cloudnative-pg/machinery/pkg/log.(*logger).Error
	pkg/mod/github.com/cloudnative-pg/machinery@v0.3.1/pkg/log/log.go:125
github.com/cloudnative-pg/cloudnative-pg/internal/cnpi/plugin/client.(*data).innerArchiveWAL
	internal/cnpi/plugin/client/wal.go:77
github.com/cloudnative-pg/cloudnative-pg/internal/cnpi/plugin/client.(*data).ArchiveWAL
	internal/cnpi/plugin/client/wal.go:39
github.com/cloudnative-pg/cloudnative-pg/pkg/management/postgres/archiver.archiveWALViaPlugins
	pkg/management/postgres/archiver/archiver.go:304
github.com/cloudnative-pg/cloudnative-pg/pkg/management/postgres/archiver.internalRun
	pkg/management/postgres/archiver/archiver.go:168
github.com/cloudnative-pg/cloudnative-pg/pkg/management/postgres/archiver.Run
	pkg/management/postgres/archiver/archiver.go:153
github.com/cloudnative-pg/cloudnative-pg/internal/cmd/manager/walarchive.NewCmd.func1
	internal/cmd/manager/walarchive/cmd.go:65
github.com/spf13/cobra.(*Command).execute
	pkg/mod/github.com/spf13/cobra@v1.10.1/command.go:1015
github.com/spf13/cobra.(*Command).ExecuteC
	pkg/mod/github.com/spf13/cobra@v1.10.1/command.go:1148
github.com/spf13/cobra.(*Command).Execute
	pkg/mod/github.com/spf13/cobra@v1.10.1/command.go:1071
main.main
	cmd/manager/main.go:71
runtime.main
	/opt/hostedtoolcache/go/1.25.5/x64/src/runtime/proc.go:285
github.com/cloudnative-pg/machinery/pkg/log.(*logger).Error
	pkg/mod/github.com/cloudnative-pg/machinery@v0.3.1/pkg/log/log.go:125
github.com/cloudnative-pg/cloudnative-pg/internal/cmd/manager/walarchive.NewCmd.func1
	internal/cmd/manager/walarchive/cmd.go:70
github.com/spf13/cobra.(*Command).execute
	pkg/mod/github.com/spf13/cobra@v1.10.1/command.go:1015
github.com/spf13/cobra.(*Command).ExecuteC
	pkg/mod/github.com/spf13/cobra@v1.10.1/command.go:1148
github.com/spf13/cobra.(*Command).Execute
	pkg/mod/github.com/spf13/cobra@v1.10.1/command.go:1071
main.main
	cmd/manager/main.go:71
runtime.main
	/opt/hostedtoolcache/go/1.25.5/x64/src/runtime/proc.go:285

I've poked at this enough that I think it's just a few nil checks away from working. That is, if I enable IRSA for the pod and have an access key, wal-g will use the access key and then assume the role as configured by IRSA.

[akloss-terion]

An update... the plugin/wal-g does work with IRSA if:

• the environment is adjusted to include AWS_ROLE_SESSION_NAME=wal-g
• the assume policy for the role allows the role to assume itself
• the accessKeyId and accessKeySecret in the BackupConfig point to a Secret containing empty strings for the key id and secret

I didn't see a way to inject environment variables though configuration. I made a custom image:

% cat Dockerfile
FROM ghcr.io/wal-g/cnpg-plugin-wal-g:0.2.2
COPY wal-g /usr/local/sbin/wal-g
% cat wal-g
#!/bin/sh
exec env AWS_ROLE_SESSION_NAME=wal-g /usr/local/bin/wal-g "$@"
%