Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Plugin doesn't respect AWS BackupStorageLocation insecureSkipTLSVerify flag #471

Open
mymasse opened this issue May 12, 2022 · 2 comments
Open
Assignees

Comments

@mymasse
Copy link

mymasse commented May 12, 2022

Describe the bug

We use a private S3 storage appliance which doesn't have a valid TLS certificate. In our AWS we have set the insecureSkipTLSVerify config value to 'true'. However when the vSphere plugin attempts to upload snapshots to S3 if fails with x509: certificate is not valid for any names, but wanted to match. Looking at the BackupRepository and BackupRespositoryClaim CR we see that that flag is not brought over.

To Reproduce

On a private S3 with an invalid TLS certificate with a BackupStorageLocation like this:

apiVersion: velero.io/v1
kind: BackupStorageLocation
metadata:
  name: default
  namespace: velero
spec:
  provider: velero.io/aws
  objectStorage:
    bucket: my-bucket
    prefix: my-prefix
  config:
    region: us-east-1
    s3ForcePathStyle: "true"
    s3Url: "http://minio:9000"
    profile: "default"
    insecureSkipTLSVerify: "true"

Expected behavior

Backup should be succesful

Troubleshooting Information

Chart version: 2.29.4
Velero server version: 1.8.1
AWS plugin version: v1.4.1
vSphere plugin version: v1.3.1
Kubernetes: Vanilla
Kubernetes version: 1.21.5+rke2r2
vSphere CSI driver: v2.2.1

@xing-yang
Copy link
Contributor

To support this, we need to handle the insecureSkipTLSVerify flag in the plugin code: https://github.com/vmware-tanzu/velero-plugin-for-vsphere/blob/v1.4.0/pkg/utils/utils.go#L345.

@CmdrSharp
Copy link

This feels like a not uncommon use-case, given that backup storage is often an on-premise task. What are the odds of this being handled in the near future?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants