Add serivce account requirement for tiflash pod while restore (#2651) (

#2682)
pingcap · Jan 21, 2025 · 7131eed · 7131eed
1 parent 9bda47e
commit 7131eed
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/en/grant-permissions-to-remote-storage.md b/en/grant-permissions-to-remote-storage.md
@@ -150,6 +150,12 @@ When you use this method to grant permissions, you can [create the EKS cluster](
 
     Modify the value of `spec.tikv.serviceAccount` to `tidb-backup-manager`. After the TiKV Pod is restarted, check whether the Pod's `serviceAccountName` is changed.
 
+5. (Optional) If your cluster includes TiFlash Pods, repeat step 4 to associate the `ServiceAccount` with the TiFlash Pod.
+
+    ```shell
+    kubectl patch tc demo1 -n test1 --type merge -p '{"spec":{"tiflash":{"serviceAccount": "tidb-backup-manager"}}}'
+    ```
+
 > **Note:**
 >
 > `arn:aws:iam::123456789012:role/user` is the IAM role created in Step 2.

diff --git a/zh/grant-permissions-to-remote-storage.md b/zh/grant-permissions-to-remote-storage.md
@@ -148,6 +148,14 @@ kubectl create secret generic s3-secret --from-literal=access_key=xxx --from-lit
 
     将 `spec.tikv.serviceAccount` 修改为 tidb-backup-manager，等到 TiKV Pod 重启后，查看 Pod 的 `serviceAccountName` 是否有变化。
 
+5. (可选)如果集群中包含 TiFlash 节点，重复步骤 4 将 ServiceAccount 绑定到 TiFlash Pod：
+
+    {{< copyable "shell-regular" >}}
+
+    ```shell
+    kubectl patch tc demo1 -n test1 --type merge -p '{"spec":{"tiflash":{"serviceAccount": "tidb-backup-manager"}}}'
+    ```
+
 > **注意：**
 >
 > `arn:aws:iam::123456789012:role/user` 为步骤 2 中创建的 IAM 角色。