Merge pull request #2241 from kaovilai/cherry-pick-oadp-641-to-1.4

OADP-4817, OADP-1945, OADP-641: Add AWS_CA_BUNDLE support for custom CA certificates in BSLs

Author: openshift-merge-bot[bot]

controllers/bsl.go

@@ -487,3 +487,69 @@ func (r *DPAReconciler) ensureSecretDataExists(dpa *oadpv1alpha1.DataProtectionA
 	}
 	return nil
 }
+
+// processCACertForBSLs creates a ConfigMap containing CA certificates from BackupStorageLocations.
+// Returns the ConfigMap name if certificates were found, empty string otherwise.
+func (r *DPAReconciler) processCACertForBSLs(dpa *oadpv1alpha1.DataProtectionApplication) (string, error) {
+	var caCertData []byte
+
+	for _, bslSpec := range dpa.Spec.BackupLocations {
+		var caCert []byte
+
+		if bslSpec.Velero != nil && bslSpec.Velero.ObjectStorage != nil {
+			caCert = bslSpec.Velero.ObjectStorage.CACert
+		}
+		if bslSpec.CloudStorage != nil {
+			caCert = bslSpec.CloudStorage.CACert
+		}
+
+		if len(caCert) > 0 {
+			caCertData = append(caCertData, caCert...)
+			caCertData = append(caCertData, '\n')
+		}
+	}
+
+	if len(caCertData) == 0 {
+		return "", nil
+	}
+
+	configMapName := caBundleConfigMapName
+	configMap := &corev1.ConfigMap{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      configMapName,
+			Namespace: dpa.Namespace,
+		},
+	}
+
+	op, err := controllerutil.CreateOrPatch(r.Context, r.Client, configMap, func() error {
+		if configMap.Labels == nil {
+			configMap.Labels = make(map[string]string)
+		}
+		configMap.Labels["app.kubernetes.io/name"] = common.Velero
+		configMap.Labels["app.kubernetes.io/managed-by"] = common.OADPOperator
+		configMap.Labels["app.kubernetes.io/component"] = "ca-bundle"
+		configMap.Labels[oadpv1alpha1.OadpOperatorLabel] = "True"
+
+		if configMap.Data == nil {
+			configMap.Data = make(map[string]string)
+		}
+		configMap.Data[caBundleFileName] = string(caCertData)
+
+		return nil
+	})
+
+	if err != nil {
+		return "", fmt.Errorf("failed to create/update CA bundle ConfigMap: %w", err)
+	}
+
+	if op == controllerutil.OperationResultCreated || op == controllerutil.OperationResultUpdated {
+		r.Log.Info("CA certificate ConfigMap processed", "configMap", configMapName, "operation", op)
+		r.EventRecorder.Event(configMap,
+			corev1.EventTypeNormal,
+			"CACertificateConfigMapReconciled",
+			fmt.Sprintf("performed %s on CA certificate ConfigMap %s/%s", op, configMap.Namespace, configMap.Name),
+		)
+	}
+
+	return configMapName, nil
+}

controllers/bsl_test.go

@@ -2591,3 +2591,146 @@ func TestDPAReconciler_ReconcileBackupStorageLocations(t *testing.T) {
 		})
 	}
 }
+
+func TestProcessCACertForBSLs(t *testing.T) {
+	testCACertPEM := `-----BEGIN CERTIFICATE-----
+MIIDNzCCAh+gAwIBAgIJAJ7qAHESwpNwMA0GCSqGSIb3DQEBCwUAMDMxMTAvBgNV
+BAMMKGVjMi01NC0yMTEtOC0yNDguY29tcHV0ZS0xLmFtYXpvbmF3cy5jb20wHhcN
+MjUwMTI0MTcxNjQyWhcNMjYwMTI0MTcxNjQyWjAzMTEwLwYDVQQDDChlYzItNTQt
+-----END CERTIFICATE-----`
+
+	tests := []struct {
+		name              string
+		backupLocations   []oadpv1alpha1.BackupLocation
+		wantConfigMapName string
+		wantError         bool
+	}{
+		{
+			name: "BSL with Velero CA certificate",
+			backupLocations: []oadpv1alpha1.BackupLocation{
+				{
+					Velero: &velerov1.BackupStorageLocationSpec{
+						Provider: "aws",
+						StorageType: velerov1.StorageType{
+							ObjectStorage: &velerov1.ObjectStorageLocation{
+								Bucket: "test-bucket",
+								CACert: []byte(testCACertPEM),
+							},
+						},
+					},
+				},
+			},
+			wantConfigMapName: caBundleConfigMapName,
+			wantError:         false,
+		},
+		{
+			name: "BSL with CloudStorage CA certificate",
+			backupLocations: []oadpv1alpha1.BackupLocation{
+				{
+					CloudStorage: &oadpv1alpha1.CloudStorageLocation{
+						CloudStorageRef: corev1.LocalObjectReference{Name: "test-bucket"},
+						CACert:          []byte(testCACertPEM),
+					},
+				},
+			},
+			wantConfigMapName: caBundleConfigMapName,
+			wantError:         false,
+		},
+		{
+			name: "BSL without CA certificate",
+			backupLocations: []oadpv1alpha1.BackupLocation{
+				{
+					Velero: &velerov1.BackupStorageLocationSpec{
+						Provider: "aws",
+						StorageType: velerov1.StorageType{
+							ObjectStorage: &velerov1.ObjectStorageLocation{
+								Bucket: "test-bucket",
+							},
+						},
+					},
+				},
+			},
+			wantConfigMapName: "",
+			wantError:         false,
+		},
+		{
+			name:              "No backup locations",
+			backupLocations:   []oadpv1alpha1.BackupLocation{},
+			wantConfigMapName: "",
+			wantError:         false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dpa := &oadpv1alpha1.DataProtectionApplication{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-dpa",
+					Namespace: "test-ns",
+				},
+				Spec: oadpv1alpha1.DataProtectionApplicationSpec{
+					BackupLocations: tt.backupLocations,
+				},
+			}
+
+			fakeClient, err := getFakeClientFromObjects(dpa)
+			if err != nil {
+				t.Fatalf("error creating fake client: %v", err)
+			}
+
+			r := &DPAReconciler{
+				Client:        fakeClient,
+				Scheme:        fakeClient.Scheme(),
+				Log:           logr.Discard(),
+				Context:       context.Background(),
+				EventRecorder: record.NewFakeRecorder(10),
+				NamespacedName: types.NamespacedName{
+					Name:      dpa.Name,
+					Namespace: dpa.Namespace,
+				},
+			}
+
+			gotConfigMapName, err := r.processCACertForBSLs(dpa)
+
+			if tt.wantError {
+				if err == nil {
+					t.Errorf("expected error but got nil")
+				}
+				return
+			}
+			if err != nil {
+				t.Errorf("unexpected error: %v", err)
+				return
+			}
+
+			if gotConfigMapName != tt.wantConfigMapName {
+				t.Errorf("expected ConfigMap name %q, got %q", tt.wantConfigMapName, gotConfigMapName)
+			}
+
+			if tt.wantConfigMapName != "" {
+				configMap := &corev1.ConfigMap{}
+				err := fakeClient.Get(context.Background(), types.NamespacedName{
+					Name:      tt.wantConfigMapName,
+					Namespace: dpa.Namespace,
+				}, configMap)
+				if err != nil {
+					t.Fatalf("expected ConfigMap to exist: %v", err)
+				}
+
+				if _, ok := configMap.Data[caBundleFileName]; !ok {
+					t.Error("ConfigMap missing ca-bundle.pem data key")
+				}
+
+				if configMap.Labels["app.kubernetes.io/name"] != "velero" {
+					t.Errorf("expected label app.kubernetes.io/name=velero, got %s", configMap.Labels["app.kubernetes.io/name"])
+				}
+				if configMap.Labels["app.kubernetes.io/component"] != "ca-bundle" {
+					t.Errorf("expected label app.kubernetes.io/component=ca-bundle, got %s", configMap.Labels["app.kubernetes.io/component"])
+				}
+				if configMap.Labels[oadpv1alpha1.OadpOperatorLabel] != "True" {
+					t.Errorf("expected OADP operator label to be True")
+				}
+			}
+		})
+	}
+}

controllers/velero.go

@@ -46,6 +46,12 @@ const (
 
 	TrueVal  = "true"
 	FalseVal = "false"
+
+	// CA certificate related constants
+	caCertVolumeName      = "ca-certificate-bundle"
+	caCertMountPath       = "/etc/velero/ca-certs"
+	caBundleFileName      = "ca-bundle.pem"
+	caBundleConfigMapName = "velero-ca-bundle"
 )
 
 var (
@@ -411,6 +417,11 @@ func (r *DPAReconciler) customizeVeleroDeployment(dpa *oadpv1alpha1.DataProtecti
 		}
 	}
 
+	// Process CA certificates from BackupStorageLocations
+	if err := r.processCACertificatesForVelero(dpa, veleroDeployment, veleroContainer); err != nil {
+		return fmt.Errorf("failed to process CA certificates: %w", err)
+	}
+
 	return nil
 }
 
@@ -819,3 +830,45 @@ func (r DPAReconciler) noDefaultCredentials(dpa oadpv1alpha1.DataProtectionAppli
 	return providerNeedsDefaultCreds, hasCloudStorage, nil
 
 }
+
+// processCACertificatesForVelero processes CA certificates from BSLs and configures Velero deployment
+func (r *DPAReconciler) processCACertificatesForVelero(dpa *oadpv1alpha1.DataProtectionApplication, veleroDeployment *appsv1.Deployment, veleroContainer *corev1.Container) error {
+	configMapName, err := r.processCACertForBSLs(dpa)
+	if err != nil {
+		return fmt.Errorf("failed to process CA certificates from BSLs: %w", err)
+	}
+
+	if configMapName == "" {
+		return nil
+	}
+
+	caCertVolume := corev1.Volume{
+		Name: caCertVolumeName,
+		VolumeSource: corev1.VolumeSource{
+			ConfigMap: &corev1.ConfigMapVolumeSource{
+				LocalObjectReference: corev1.LocalObjectReference{
+					Name: configMapName,
+				},
+			},
+		},
+	}
+	veleroDeployment.Spec.Template.Spec.Volumes = append(veleroDeployment.Spec.Template.Spec.Volumes, caCertVolume)
+
+	caCertVolumeMount := corev1.VolumeMount{
+		Name:      caCertVolumeName,
+		MountPath: caCertMountPath,
+		ReadOnly:  true,
+	}
+	veleroContainer.VolumeMounts = append(veleroContainer.VolumeMounts, caCertVolumeMount)
+
+	// AWS_CA_BUNDLE is a standard AWS SDK environment variable that specifies a custom CA bundle
+	// for TLS certificate validation. When set, the AWS SDK for Go automatically uses this bundle
+	// for all S3 API calls, enabling imagestream backup in air-gapped environments with custom CAs.
+	awsCABundleEnv := corev1.EnvVar{
+		Name:  "AWS_CA_BUNDLE",
+		Value: caCertMountPath + "/" + caBundleFileName,
+	}
+	veleroContainer.Env = common.AppendUniqueEnvVars(veleroContainer.Env, []corev1.EnvVar{awsCABundleEnv})
+
+	return nil
+}