Use credentials/ secrets from Azure Key Vault

[beingvishalt]

I am using CNPG 1.26 with Barman Plugin 0.11.0.

For Barman plugin Object Store is required with Credentials or SAS Token .
But this should be kept in k8s secrets. Can we directly use it from key Vault?

@dosu

[dosubot]

Direct use of Azure Key Vault secrets by the Barman plugin isn't supported. The plugin expects credentials (like storage account keys or SAS tokens) to be stored in Kubernetes secrets, which it references for object store access. The recommended way to use Azure Key Vault is to set up the External Secrets Operator (ESO) to sync your secrets from Azure Key Vault into Kubernetes secrets—these are then used by the Barman plugin as usual.

If you want to avoid storing credentials in Kubernetes secrets entirely, you can use Azure AD Workload Identity by setting inheritFromAzureAD: true in your backup configuration, but this is a different mechanism and doesn't use Key Vault as the credential source for the plugin itself.

References:

• Object store credentials and Barman plugin usage
• External Secrets Operator integration with Azure Key Vault

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}