Skip to content

fix: clone cluster failure with IRSA due to wrong AWS_REGION and overwritten AWS_ACCESS_KEY_ID #1213

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hughcapet merged 8 commits into from
Sep 8, 2026
Merged

fix: clone cluster failure with IRSA due to wrong AWS_REGION and overwritten AWS_ACCESS_KEY_ID #1213

Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
a172c35
inject IRSA credentials into wal-g envdir for standby and clone clusters
tcondeixa Jul 22, 2026
31bf266
Merge branch 'trigger' of github-tcondeixa:zalando/spilo into trigger
tcondeixa Sep 2, 2026
24708a2
Fix AWS_ACCESS_KEY_ID being overwritten with S3 prefix when using IRSA
tcondeixa Sep 2, 2026
560eece
Fix AWS_REGION extracted from path instead of bucket name when PGVERS…
tcondeixa Sep 2, 2026
76119c0
Fall back to bare AWS_REGION when CLONE_AWS_REGION is not set
tcondeixa Sep 2, 2026
effa39b
Merge branch 'trigger' into fix/irsa-access-key-id-clobbered-by-s3-pr…
tcondeixa Sep 4, 2026
a23f25e
fix local variable shadowing function parameter prefix in write_walg_…
tcondeixa Sep 8, 2026
6f0307f
Merge branch 'fix/irsa-access-key-id-clobbered-by-s3-prefix' of githu…
tcondeixa Sep 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions postgres-appliance/scripts/configure_spilo.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -896,9 +896,12 @@ def write_walg_environment(placeholders, prefix, overwrite):
if aws_region:
walg['AWS_REGION'] = aws_region
elif not aws_region:
# try to determine region from the endpoint or bucket name
name = walg.get('WAL_S3_BUCKET') or walg.get('WALG_S3_PREFIX')
match = re.search(r'.*(\w{2}-\w+-\d)-.*', name)
# try to determine region from the bucket name
bucket_or_prefix = walg.get('WAL_S3_BUCKET') or walg.get('WALG_S3_PREFIX') or ''
# extract bucket name only to avoid false matches on path segments (e.g. /wal/ suffix)
bucket_match = re.match(r'^(?:s3://)?([^/]+)', bucket_or_prefix)
name = bucket_match.group(1) if bucket_match else bucket_or_prefix
match = re.search(r'(\w{2}-\w+-\d)-', name)
if match:
aws_region = match.group(1)
else:
Expand All @@ -919,7 +922,7 @@ def write_walg_environment(placeholders, prefix, overwrite):
walg[name] = placeholders.get(name)

# fall back to bare IRSA vars if prefixed versions are not set
irsa_names = ['AWS_ROLE_ARN', 'AWS_WEB_IDENTITY_TOKEN_FILE', 'AWS_STS_REGIONAL_ENDPOINTS']
irsa_names = ['AWS_ROLE_ARN', 'AWS_WEB_IDENTITY_TOKEN_FILE', 'AWS_STS_REGIONAL_ENDPOINTS', 'AWS_REGION']
for name in irsa_names:
if not walg.get(name) and placeholders.get(name):
walg[name] = placeholders.get(name)
Expand Down Expand Up @@ -966,9 +969,6 @@ def write_walg_environment(placeholders, prefix, overwrite):
bucket_path = '/spilo/{WAL_BUCKET_SCOPE_PREFIX}{SCOPE}{WAL_BUCKET_SCOPE_SUFFIX}/wal/{PGVERSION}'.format(**walg)
prefix_template = '{0}://{{WAL_{1}_BUCKET}}{2}'.format(store_type.lower(), store_type, bucket_path)
walg[prefix_env_name] = prefix_template.format(**walg)
# Set WALG_*_PREFIX for future compatibility
if store_type in ('S3', 'GS') and not walg.get(write_envdir_names[1]):
walg[write_envdir_names[1]] = walg[prefix_env_name]

if not os.path.exists(walg['WALG_ENV_DIR']):
os.makedirs(walg['WALG_ENV_DIR'])
Expand Down
Loading