K8SPSMDB-1602: address review comments

Author: TineoC

config/crd/bases/psmdb.percona.com_perconaservermongodbbackups.yaml

@@ -139,9 +139,10 @@ spec:
                     - backoffMax
                     - backoffMultiplier
                     type: object
+                  workloadIdentity:
+                    type: boolean
                 required:
                 - bucket
-                - credentialsSecret
                 type: object
               lastTransition:
                 format: date-time

config/crd/bases/psmdb.percona.com_perconaservermongodbrestores.yaml

@@ -97,9 +97,10 @@ spec:
                         - backoffMax
                         - backoffMultiplier
                         type: object
+                      workloadIdentity:
+                        type: boolean
                     required:
                     - bucket
-                    - credentialsSecret
                     type: object
                   lastTransition:
                     format: date-time

config/crd/bases/psmdb.percona.com_perconaservermongodbs.yaml

@@ -361,9 +361,10 @@ spec:
                               - backoffMax
                               - backoffMultiplier
                               type: object
+                            workloadIdentity:
+                              type: boolean
                           required:
                           - bucket
-                          - credentialsSecret
                           type: object
                         main:
                           type: boolean

pkg/apis/psmdb/v1/psmdb_types.go

@@ -1290,19 +1290,12 @@ type GCSRetryer struct {
 }
 
 type BackupStorageGCSSpec struct {
-	Bucket            string          `json:"bucket"`
-	Prefix            string          `json:"prefix,omitempty"`
-	CredentialsSecret string          `json:"credentialsSecret,omitempty"`
-	Credentials       *GCSCredentials `json:"credentials,omitempty"`
-	ChunkSize         int             `json:"chunkSize,omitempty"`
-	Retryer           *GCSRetryer     `json:"retryer,omitempty"`
-}
-
-// GCSCredentials configures how PBM authenticates with GCS.
-// When WorkloadIdentity is true, PBM uses Application Default Credentials (ADC)
-// provided by GKE Workload Identity instead of a credentialsSecret.
-type GCSCredentials struct {
-	WorkloadIdentity bool `json:"workloadIdentity,omitempty"`
+	Bucket            string      `json:"bucket"`
+	Prefix            string      `json:"prefix,omitempty"`
+	CredentialsSecret string      `json:"credentialsSecret,omitempty"`
+	WorkloadIdentity  bool        `json:"workloadIdentity,omitempty"`
+	ChunkSize         int         `json:"chunkSize,omitempty"`
+	Retryer           *GCSRetryer `json:"retryer,omitempty"`
 }
 
 type BackupStorageAzureSpec struct {

pkg/apis/psmdb/v1/zz_generated.deepcopy.go

@@ -507,9 +507,7 @@ func GetPBMStorageGCSConfig(
 
 	// When WorkloadIdentity is enabled, skip credential secret loading entirely.
 	// PBM will use Application Default Credentials (ADC) provided by GKE Workload Identity.
-	useWorkloadIdentity := stg.GCS.Credentials != nil && stg.GCS.Credentials.WorkloadIdentity
-
-	if !useWorkloadIdentity && stg.GCS.CredentialsSecret != "" {
+	if !stg.GCS.WorkloadIdentity && stg.GCS.CredentialsSecret != "" {
 		gcsSecret, err := getSecret(ctx, k8sclient, cluster.Namespace, stg.GCS.CredentialsSecret)
 		if err != nil {
 			return config.StorageConf{}, errors.Wrap(err, "get GCS credentials secret")

pkg/psmdb/backup/pbm.go

@@ -346,6 +346,26 @@ func TestPBMStorageConfig(t *testing.T) {
 				},
 			},
 		},
+		"gcs workload identity": {
+			[]client.Object{},
+			api.BackupStorageSpec{
+				Type: api.BackupStorageGCS,
+				GCS: api.BackupStorageGCSSpec{
+					Bucket:           "operator-testing",
+					Prefix:           "psmdb",
+					WorkloadIdentity: true,
+					ChunkSize:        1024 * 1024 * 10,
+				},
+			},
+			config.StorageConf{
+				Type: storage.GCS,
+				GCS: &gcs.Config{
+					Bucket:    "operator-testing",
+					Prefix:    "psmdb",
+					ChunkSize: 1024 * 1024 * 10,
+				},
+			},
+		},
 		"gcs s3 compatibility": {
 			[]client.Object{
 				&corev1.Secret{