From 7e9e666008aae2857518bd112be502d2edf5ac8d Mon Sep 17 00:00:00 2001
From: ris <79858083+RidRisR@users.noreply.github.com>
Date: Fri, 17 Jan 2025 18:52:37 +0800
Subject: [PATCH]  Add serivce account requirement for tiflash pod while
 restore (#2651)

---
 en/grant-permissions-to-remote-storage.md | 6 ++++++
 en/renew-tls-certificate.md               | 2 +-
 zh/grant-permissions-to-remote-storage.md | 8 ++++++++
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/en/grant-permissions-to-remote-storage.md b/en/grant-permissions-to-remote-storage.md
index 2e6607999..fb4d7cec0 100644
--- a/en/grant-permissions-to-remote-storage.md
+++ b/en/grant-permissions-to-remote-storage.md
@@ -150,6 +150,12 @@ When you use this method to grant permissions, you can [create the EKS cluster](
 
     Modify the value of `spec.tikv.serviceAccount` to `tidb-backup-manager`. After the TiKV Pod is restarted, check whether the Pod's `serviceAccountName` is changed.
 
+5. (Optional) If your cluster includes TiFlash Pods, repeat step 4 to associate the `ServiceAccount` with the TiFlash Pod.
+
+    ```shell
+    kubectl patch tc demo1 -n test1 --type merge -p '{"spec":{"tiflash":{"serviceAccount": "tidb-backup-manager"}}}'
+    ```
+
 > **Note:**
 >
 > `arn:aws:iam::123456789012:role/user` is the IAM role created in Step 2.
diff --git a/en/renew-tls-certificate.md b/en/renew-tls-certificate.md
index 6fee2cddf..2826837d2 100644
--- a/en/renew-tls-certificate.md
+++ b/en/renew-tls-certificate.md
@@ -110,7 +110,7 @@ If the original TLS certificates are issued by [the `cfssl` system](enable-tls-b
 
     > **Note:**
     >
-    >  The above command only renews the server-side and the client-side certificate between PD, TiKV, and TiDB components. If you need to renew the server-side certificates for other components, such as TiCDC, TiFlash and TiProxy, you can execute the similar command.
+    > The above command only renews the server-side and the client-side certificate between PD, TiKV, and TiDB components. If you need to renew the server-side certificates for other components, such as TiCDC, TiFlash and TiProxy, you can execute the similar command.
 
 3. [Perform the rolling restart](restart-a-tidb-cluster.md) to components that need to load the new certificates.
 
diff --git a/zh/grant-permissions-to-remote-storage.md b/zh/grant-permissions-to-remote-storage.md
index 271c021db..11716b05e 100644
--- a/zh/grant-permissions-to-remote-storage.md
+++ b/zh/grant-permissions-to-remote-storage.md
@@ -148,6 +148,14 @@ kubectl create secret generic s3-secret --from-literal=access_key=xxx --from-lit
 
     将 `spec.tikv.serviceAccount` 修改为 tidb-backup-manager，等到 TiKV Pod 重启后，查看 Pod 的 `serviceAccountName` 是否有变化。
 
+5. (可选)如果集群中包含 TiFlash 节点，重复步骤 4 将 ServiceAccount 绑定到 TiFlash Pod：
+
+    {{< copyable "shell-regular" >}}
+
+    ```shell
+    kubectl patch tc demo1 -n test1 --type merge -p '{"spec":{"tiflash":{"serviceAccount": "tidb-backup-manager"}}}'
+    ```
+
 > **注意：**
 >
 > `arn:aws:iam::123456789012:role/user` 为步骤 2 中创建的 IAM 角色。