Reuse the aws session with cacerts and credentials for fetching region #71
Conversation
github-actions
bot
requested review from
ashish-amarnath,
carlisia,
dsu-igeek,
nrb and
zubron
aayushrangwala
changed the title
|
High level question - would it be possible to support the CA cert with the VolumeSnapshotter API, too? |
@nrb Yes, its possible and we should definitely do it to make this adoption across any API calls. But this might need a bit more changes as we have to decide how should we propagate the CA certs passed via |
aayushrangwala
force-pushed
the
main
branch
2 times, most recently
from
b609083
to
27b4614
Compare
carlisia
requested review from
nrb
and removed request for
carlisia,
dsu-igeek and
ashish-amarnath
velero-plugin-for-aws/helpers.go
Outdated
| } | ||
|
|
||
| // Init initializes the S3 config parameters which needs to be fetched/prepared based on the passed options | ||
| func (h *S3Config) Init() error { |
There was a problem hiding this comment.
h? s would be more appropriate.
velero-plugin-for-aws/helpers.go
Outdated
| return nil | ||
| } | ||
|
|
||
| // GetBucketRegion returns the AWS region that a bucket is in, or an error |
There was a problem hiding this comment.
Comment case should match method
velero-plugin-for-aws/helpers.go
Outdated
| } | ||
|
|
||
| // add region to the session config | ||
| if h.s3URL == "" && h.region == "" { |
There was a problem hiding this comment.
This is funky. h.getBucketRegion gets called once, the structure gets changed and then it should not be called again. getBucketRegion does not need to be a method, just keep it a func and pass in session and bucket.
There was a problem hiding this comment.
Got it. Will make that change
Signed-off-by: Ayush Rangwala <arangwala@vmware.com>
Signed-off-by: Ayush Rangwala <arangwala@vmware.com>
Signed-off-by: Ayush Rangwala <arangwala@vmware.com>
|
any updates we wanna make here? |
|
This PR won't work after the SDK is bumped up to v2. |
Velero has a way to use custom CA bundle to access the objectStore behind the proxy by providing the option
--cacertsat the time of velero install or velero client operations.s3 plugin tries to communicate the objectStore for finding out the region or to push/pull the Backup manifests. If the region is not provided in the BackupStorageLocation config, while finding the region, plugin creates a new aws session config which doesnot use any session options, such as certs or credential profile.
This PR is to add the support for aws s3 plugin also to consume the ca certificate bundle passed in
BackupStorageLocationwith thecaCertsfield.This can be tested by having a velero setup behind proxy with a sef-signed certs and pass them along with the velero install and try to perform the backup/restore operations
Fixes: vmware-tanzu/velero#3449
Signed-off-by: Ayush Rangwala arangwala@vmware.com