Does ECK 1.3.0 supports workload identity

[knagasri (karri Nagasri)]

For ECK 1.3.0 , does operator supports workload identity feature instead of creating k8s secrets(service account credentials JSON file which has storage admin permissions for that GCS bucket) manually for easticsearch backup and restore.

If it is not supported in current version. Do we have future road map

[Thibault_Richard (Thibault)]

What you are looking for is currently not supported in the Google Cloud Storage Repository Plugin. This is not a limitation at the operator level.

This was discussed here:

Using GKE workflow identity to snapshot and restore elasticsearch data

If I am reading the plugin docs correctly, this is expected: The plugin must authenticate the requests it makes to the Google Cloud Storage service. It is common for Google client libraries to employ a strategy named application default credentials. However, that strategy is not supported for use with Elasticsearch. The plugin operates under the Elasticsearch process, which runs with the security manager enabled. The security manager obstructs the "automatic" credential discovery. Therefore, y…