Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update integrated Restic version and add insecureSkipTLSVerify for Re… #4839

Merged

Conversation

blackpiglet
Copy link
Contributor

…stic CLI

  1. Add --insecure-tls for ResticManager's commands.
  2. Add --insecure-tls in PodVolumeBackup and PodVolumeRestore controller.
  3. Upgrade integrated Restic version to v0.13.1
  4. Change --last flag in Restic command to --latest=1 due to Restic version update.

Signed-off-by: Xun Jiang jxun@vmware.com

Thank you for contributing to Velero!

Please add a summary of your change

Does your change fix a particular issue?

Fixes #4820

Please indicate you've done the following:

  • Accepted the DCO. Commits without the DCO will delay acceptance.
  • Created a changelog file or added /kind changelog-not-required as a comment on this pull request.
  • Updated the corresponding documentation in site/content/docs/main.

…stic CLI

1. Add --insecure-tls for ResticManager's commands.
2. Add --insecure-tls in PodVolumeBackup and PodVolumeRestore controller.
3. Upgrade integrated Restic version to v0.13.1
4. Change --last flag in Restic command to --latest=1 due to Restic version update.

Signed-off-by: Xun Jiang <jxun@vmware.com>
@blackpiglet
Copy link
Contributor Author

Test done for this modification:

Setup MinIO with TLS:

1. Install certgen, then add certgen into PATH: 
go install[ github.com/minio/certgen](http://github.com/minio/certgen)
2. Generate key and cert: 
certgen -ca -host "127.0.0.1,minio.velero.svc,minio.minio.svc"
3. Create TLS needed secret from generated key and cert: 
kubectl create ns minio; kubectl -n minio create secret generic tls-ssl-minio --from-file=./private.key --from-file=./public.crt
4. Install MinIO with TLS enabled by helm chart: 
helm repo add minio https://charts.min.io/; helm install minio -n minio --set tls.enabled=true,tls.certSecret=tls-ssl-minio,replicas=1,persistence.enabled=true,resources.requests.memory=1Gi,mode=standalone,rootUser=minio,rootPassword=minio123 minio/minio
5. Setup up MinIO host and add bucket:
kubectl apply -f https://raw.githubusercontent.com/blackpiglet/public_files/main/minio-setup.yaml

Install Velero with the MinIO and not provide CA to Velero and Restic.

velero install \
  --provider aws \
  --plugins velero/velero-plugin-for-aws:main \
  --image=gcr.io/velero-gcp/velero:test \
  --bucket=velero \
  --use-volume-snapshots=false \
  --backup-location-config region=minio,s3ForcePathStyle="true",s3Url=https://minio.minio.svc:9000,insecureSkipTLSVerify=true \
  --use-restic \
  --secret-file=../../credentials-velero-minio \
  --default-volumes-to-restic

Tests:

  • Create a deployment on K8S cluster with PV
  • Create backup with no error: velero backup create 4821-2 --selector app=redis
  • Check the ResticRepository is created and Status.Phase is ready.
  • Modify ResticRepository's Spec.MaintenanceFrequency to 1m0s, and check the periodically Restic prune command running without error.
  • Create restore with no error: velero restore create --from-backup=4821-2
  • Delete backup with no error: velero backup delete 4821-2

@qiuming-best qiuming-best merged commit 2f83bb8 into vmware-tanzu:main Apr 19, 2022
@blackpiglet blackpiglet deleted the add-skip-tls-verify-for-restic branch October 15, 2022 04:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Update integrated Restic version and add insecureSkipTLSVerify for Restic CLI
3 participants