add env var for spilo with irsa

[tcondeixa]

Problem detected on smoke tests

Standby and clone clusters fail to bootstrap when the operator is configured with IRSA (irsa_role_arn). Patroni exits with PatroniFatalException: Failed to bootstrap cluster after wal-g repeatedly fails with NoCredentialProviders.

Root cause: The EKS admission webhook injects AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE into the pod environment (bare, unprefixed). Spilo's configure_spilo.py writes these into the main envdir (/run/etc/wal-e.d/env/) correctly, but for standby and clone it looks for the prefixed versions (STANDBY_AWS_ROLE_ARN, CLONE_AWS_ROLE_ARN) which are never set. wal-g runs under envdir which replaces the entire environment with only the files in the target directory — so without the prefixed vars being written there, wal-g has no credentials.

Proposed Fix

In generateCloneEnvironment() and generateStandbyEnvironment() in pkg/cluster/k8sres.go, when IRSARoleARN is configured, add the prefixed IRSA env vars to the pod spec:

• CLONE_AWS_ROLE_ARN / CLONE_AWS_WEB_IDENTITY_TOKEN_FILE
• STANDBY_AWS_ROLE_ARN / STANDBY_AWS_WEB_IDENTITY_TOKEN_FILE

Spilo then finds these in the pod environment and writes them into the respective envdirs, giving wal-g valid IRSA credentials for S3 access.

This is the PR created for spilo: zalando/spilo#1206

[tcondeixa]

I was using AI to investigate the issue with the smoke tests, @FxKu does this change make sense? I see the env vars are copied for spilo.

[tcondeixa]

I'm closing this since this was solved in spilo directly in zalando/spilo#1206

[tcondeixa]

This can be temporary merged if that helps, but spilo already provides support

[FxKu]

👍

[tcondeixa]

👍