Support backups via IRSA

[james-callahan]

Proposal

I should be able to add an annotation to my service account rather than managing IAM credentials.

Use-Case

IAM Roles for service accounts is the most common way to inject AWS credentials into a kubernetes cluster. It should be supported in addition to old style access key + secrets

Is this a feature you are interested in implementing yourself?

No

Anything else?

This is essentially a cross post of https://perconadev.atlassian.net/browse/PXB-3270
This was previously blocked on #1687

[james-callahan]

Confirming my notes from the linked JIRA ticket. As of v1.18.0:

• The aws cli needs writable ~/.aws/cli/cache (Allow customization of directory where cached credential data is stored aws/aws-cli#1804), I worked around it by adding

      containerOptions:
        env:
          - name: HOME
            value: /tmp/home
  

• AWS_ENDPOINT_URL gets unconditionally set, which causes communication to sts to fail. https://github.com/percona/percona-docker/blob/pxc-operator-1.18.0/percona-xtradb-cluster-8.0-backup/lib/pxc/aws.sh#L6 Please remove that line or at least remove the default value. I worked around it via setting

      containerOptions:
        env:
          - name: AWS_IGNORE_CONFIGURED_ENDPOINT_URLS
            value: "true"
  

• Aside: the setting of AWS_REGION at https://github.com/percona/percona-docker/blob/e276f6ff24ceb3ecb05960d549b5343618c653c9/percona-xtradb-cluster-8.0-backup/lib/pxc/aws.sh#L7 is annoying; I already have the pod identity webhook injecting AWS_REGION, so this ends up unsetting it/setting it to us-west-2. This line should just be removed
• xbcloud fails at https://github.com/percona/percona-xtrabackup/blob/324c3910d6916a95abb60ad6f6d06ad0e8eced77/storage/innobase/xtrabackup/src/xbcloud/xbcloud.cc#L1456 with "S3 access key is not specified\n"

The critical missing piece right now is the lack of AssumeRoleWithWebIdentity support in xbcloud

[gkech]

Since this is a xbcloud issue, mostly from what I understand, the related repo is this: https://github.com/percona/percona-xtrabackup and documentation is this: https://docs.percona.com/percona-xtrabackup/8.0/

Let's us check this again!