How do we add an AWS IRSA annotation to the backups to grant S3 access

MySQL & MariaDB Percona Operator for MySQL
9

I’m revisiting the Percona material here and those tickets seem to be completed, how far has this gone to make it workable? It’s been 2 years, and my current exploration seems to indicate this still doesn’t actually work.

$ kubectl get pod/xb-cron-mysql-pxc-db-sql-20241060610-3ldds-qwshg -o yaml
apiVersion: v1
kind: Pod
metadata:
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::1234567678:role/some-irsa-sql-s3-backup-rolename
  creationTimestamp: "2024-10-06T00:12:58Z"
...
status:
  conditions:
  - lastProbeTime: null
    lastTransitionTime: "2024-10-06T00:12:59Z"
    status: "True"
    type: Initialized
  - lastProbeTime: null
    lastTransitionTime: "2024-10-06T00:13:18Z"
    reason: PodFailed
    status: "False"
    type: Ready
...
  phase: Failed

Relevant configuration

    backup:
      enabled: true
      # image:
      #   tag: 1.15.0-pxc8.0-backup-pxb8.0.35-debug
      serviceAccountName: sql-db-backup-serviceaccount
      pitr:
        enabled: true
        storageName: binlogs
        # time in seconds between uploads
        timeBetweenUploads: 300
      storages:
        # the normal backups
        sql:
          type: s3
          annotations:
            eks.amazonaws.com/role-arn: arn:aws:iam::1234567678:role/some-irsa-sql-s3-backup-rolename
          s3:
            bucket: example-bucket-database-backups/sql/db1/
            ## with secret specified it does not work
            # credentialsSecret: example-sql-backup-aws-credentials
            # credentialsAccessKey: ""
            # credentialsSecretKey: ""
            region: us-west-2
        # the pitr binlogs for quick restore/replay
        binlogs:
          type: s3
          annotations:
            eks.amazonaws.com/role-arn: arn:aws:iam::1234567678:role/some-irsa-sql-s3-backup-rolename
          s3:
            bucket: example-bucket-database-backups/sql/pitr/
            ## with secret specified it does not work
            # credentialsSecret: example-sql-backup-aws-credentials
            # credentialsAccessKey: ""
            # credentialsSecretKey: ""
            region: us-west-2
Workflow identity for backup storage (AKS/Azure Blog Storage)