GCS: support --send-credentials-to-tikv and get credentials from GKE or GCE

[SunRunAway]

1. We can get credentials from GKE or GCE, see https://cloud.google.com/docs/authentication/production#auth-cloud-compute-engine-go as example
2. We should support --send-credentials-to-tikv when using GCS.

[gregwebs]

You don't have to send any credentials to TiKV. TiKV can already have the credentials that it needs deployed to it.

[SunRunAway]

If TiKV is not deployed on GKE/GCE, they still need credentials sended from BR.

[gregwebs]

But then this issue doesn't apply since it is for GKE/GCE ?

[SunRunAway]

It is for GCS, users can deploy TiDB&TiKV on their own IDC and save backups on any object storage.

[SunRunAway]

Because TiDB/TiKV/BR can deployed as a multi-region cluster to avoiding single IDC(cloud service) failure, different BR or TiKV instances may be deployed on different environments.

As a summary,

BR	TiKV	backup to	How
on own IDC	on own IDC	GCS	BR should be configued with credentials BR should send credentials to TiKV
on own IDC	on GCE	GCS	BR should be configued with credentials BR need not send credentials to TiKV
on GCE	on own IDC	GCS	BR should be configued with credentials BR should send credentials to TiKV
on GCE	on GCE	GCS	BR need not be configued with credentials BR need not send credentials to TiKV

[gregwebs]

okay, I see. They are just using the object storage from the cloud provider. 👍

For the third scenario: BR on GCP, TiKV on own IDC, sending credentials may not work. I doubt this scenario would be used by someone though.

[SunRunAway]

For the third scenario:
If we support deploying TiKV instance across cloud providers, for example, one copy on GCE, two copies on AWS EC2. BR on GCE need to send credentials to TiKV which on EC2, then backup sst files to GCS.

[gregwebs]

In the third scenario, a credential retrieved from metadata could have restrictions on usage that won't allow it to be transferred. Already the metadata credentials are temporary and would have to be re-sent periodically. To send a credential it is probably required for BR to be configured with it.