[oadp-1.6] CNTRLPLANE-3167: support STS/IRSA credentials and standalone Velero - #297
[oadp-1.6] CNTRLPLANE-3167: support STS/IRSA credentials and standalone Velero#297kaovilai wants to merge 5 commits into
Conversation
…or etcd backup/restore Add support for AWS STS/IRSA credential detection and pre-signing, and handle standalone Velero deployments (no DPA) where the BSL has no explicit credential reference. - Add ParseAWSCredentialData to auto-detect credential type (static, bare ARN, INI with role_arn) and STSClient for AssumeRoleWithWebIdentity without AWS SDK dependency - Detect OADP+DPA vs standalone Velero at plugin init via DPA CRD check - Fall back to well-known cloud-credentials secret when BSL has no .spec.credential (ARO with WI, future ROSA without DPA) - Preserve original secret key alongside "credentials" in copied secret so the HCPEtcdBackup controller can auto-detect credential type - Refactor copyCredentialSecret to accept resolved SecretKeySelector Ref: openshift/hypershift#8368 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com> (cherry picked from commit e8b5f4a)
The HyperShift hcpetcdbackup controller sets the CR name as a label value on the Job and Pod template. Kubernetes label values are capped at 63 bytes (RFC 1123). Schedule-triggered backups produce names that exceed this limit, causing Job creation to fail. Truncate the backup name portion of the CR name so the total never exceeds 63 bytes, and trim any trailing hyphens left by truncation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> (cherry picked from commit a554423)
…tore Adds Service SAS (account key) and User Delegation SAS (AAD) signing for Azure Blob Storage snapshot URLs during OADP restore, matching the existing S3 pre-signing capability. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> (cherry picked from commit eefaab8)
When using the etcdSnapshot backup method, the etcd StatefulSet was being restored by Velero with a stale RESTORE_URL_ETCD environment variable baked into its pod template from a previous backup/restore cycle. The StatefulSet controller would create etcd pods with the wrong snapshot URL before the HyperShift operator could reconcile the correct URL from the HCP spec, causing etcd to restore data from the wrong snapshot. Skip restoring the etcd StatefulSet when etcdBackupMethod is etcdSnapshot, matching the existing pattern for etcd Pods and PVCs. The control plane operator creates the StatefulSet fresh with the correct RESTORE_URL_ETCD derived from the RestoreSnapshotURL already injected into the HCP spec by this plugin. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> (cherry picked from commit 0537002)
…rt to STS - Add context.Context to STSClient.AssumeRoleWithWebIdentity for cancellation support - Define STSAssumeRoler interface and inject into RestorePlugin for testability - Centralize credential fallback logic into common.ResolveCredentialRef() - Extract signSnapshotURL() dispatcher to eliminate duplicate s3/azblob dispatch - Extract fetchBSLCredentials() to consolidate BSL+secret fetch pattern - Add missing test for AAD token acquisition failure path - Replace custom contains/searchSubstring with strings.Contains in sts_test.go Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Juan Manuel Parrilla Madrid <jparrill@redhat.com> (cherry picked from commit 9eb63b5)
openshift-ci-robot
added
the
jira/valid-reference
|
@kaovilai: This pull request references CNTRLPLANE-3167 which is a valid jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: kaovilai The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
@kaovilai: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/cc @mgencur |
|
/cc @jparrill |
4 participants
Cherry-pick of #247 to
oadp-1.6.Original commits:
go.mod/go.sum/vendorconflicts resolved viago mod tidy+go mod vendoragainst theoadp-1.6dependency baseline.go build ./...andgo test ./pkg/...pass.Note
Responses generated with Claude