Merge branch 'main' into vgdp-ms-pvr-data-path

pkg/cmd/cli/datamover/backup.go

@@ -39,6 +39,7 @@ import (
 	"github.com/vmware-tanzu/velero/pkg/repository"
 	"github.com/vmware-tanzu/velero/pkg/uploader"
 	"github.com/vmware-tanzu/velero/pkg/util/filesystem"
+	"github.com/vmware-tanzu/velero/pkg/util/kube"
 	"github.com/vmware-tanzu/velero/pkg/util/logging"
 
 	ctrl "sigs.k8s.io/controller-runtime"
@@ -78,7 +79,7 @@ func NewBackupCommand(f client.Factory) *cobra.Command {
 			f.SetBasename(fmt.Sprintf("%s-%s", c.Parent().Name(), c.Name()))
 			s, err := newdataMoverBackup(logger, f, config)
 			if err != nil {
-				exitWithMessage(logger, false, "Failed to create data mover backup, %v", err)
+				kube.ExitPodWithMessage(logger, false, "Failed to create data mover backup, %v", err)
 			}
 
 			s.run()
@@ -100,12 +101,6 @@ func NewBackupCommand(f client.Factory) *cobra.Command {
 	return command
 }
 
-const (
-	// defaultCredentialsDirectory is the path on disk where credential
-	// files will be written to
-	defaultCredentialsDirectory = "/tmp/credentials"
-)
-
 type dataMoverBackup struct {
 	logger      logrus.FieldLogger
 	ctx         context.Context
@@ -215,7 +210,7 @@ func newdataMoverBackup(logger logrus.FieldLogger, factory client.Factory, confi
 	return s, nil
 }
 
-var funcExitWithMessage = exitWithMessage
+var funcExitWithMessage = kube.ExitPodWithMessage
 var funcCreateDataPathService = (*dataMoverBackup).createDataPathService
 
 func (s *dataMoverBackup) run() {
@@ -277,7 +272,7 @@ func (s *dataMoverBackup) createDataPathService() (dataPathService, error) {
 	credentialFileStore, err := funcNewCredentialFileStore(
 		s.client,
 		s.namespace,
-		defaultCredentialsDirectory,
+		credentials.DefaultStoreDirectory(),
 		filesystem.NewFileSystem(),
 	)
 	if err != nil {

pkg/cmd/cli/datamover/data_mover.go

@@ -15,10 +15,7 @@ package datamover
 
 import (
 	"context"
-	"fmt"
-	"os"
 
-	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 
 	"github.com/vmware-tanzu/velero/pkg/client"
@@ -45,30 +42,3 @@ type dataPathService interface {
 	RunCancelableDataPath(context.Context) (string, error)
 	Shutdown()
 }
-
-var funcExit = os.Exit
-var funcCreateFile = os.Create
-
-func exitWithMessage(logger logrus.FieldLogger, succeed bool, message string, a ...any) {
-	exitCode := 0
-	if !succeed {
-		exitCode = 1
-	}
-
-	toWrite := fmt.Sprintf(message, a...)
-
-	podFile, err := funcCreateFile("/dev/termination-log")
-	if err != nil {
-		logger.WithError(err).Error("Failed to create termination log file")
-		exitCode = 1
-	} else {
-		if _, err := podFile.WriteString(toWrite); err != nil {
-			logger.WithError(err).Error("Failed to write error to termination log file")
-			exitCode = 1
-		}
-
-		podFile.Close()
-	}
-
-	funcExit(exitCode)
-}

pkg/cmd/cli/datamover/data_mover_test.go

@@ -1,131 +0,0 @@
-/*
-Copyright The Velero Contributors.
-Licensed under the Apache License, Version 2.0 (the "License");
-you may not use this file except in compliance with the License.
-You may obtain a copy of the License at
-    http://www.apache.org/licenses/LICENSE-2.0
-Unless required by applicable law or agreed to in writing, software
-distributed under the License is distributed on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-See the License for the specific language governing permissions and
-limitations under the License.
-*/
-
-package datamover
-
-import (
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"github.com/google/uuid"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	velerotest "github.com/vmware-tanzu/velero/pkg/test"
-)
-
-type exitWithMessageMock struct {
-	createErr error
-	writeFail bool
-	filePath  string
-	exitCode  int
-}
-
-func (em *exitWithMessageMock) Exit(code int) {
-	em.exitCode = code
-}
-
-func (em *exitWithMessageMock) CreateFile(name string) (*os.File, error) {
-	if em.createErr != nil {
-		return nil, em.createErr
-	}
-
-	if em.writeFail {
-		return os.OpenFile(em.filePath, os.O_CREATE|os.O_RDONLY, 0500)
-	} else {
-		return os.Create(em.filePath)
-	}
-}
-
-func TestExitWithMessage(t *testing.T) {
-	tests := []struct {
-		name             string
-		message          string
-		succeed          bool
-		args             []any
-		createErr        error
-		writeFail        bool
-		expectedExitCode int
-		expectedMessage  string
-	}{
-		{
-			name:             "create pod file failed",
-			createErr:        errors.New("fake-create-file-error"),
-			succeed:          true,
-			expectedExitCode: 1,
-		},
-		{
-			name:             "write pod file failed",
-			writeFail:        true,
-			succeed:          true,
-			expectedExitCode: 1,
-		},
-		{
-			name:    "not succeed",
-			message: "fake-message-1, arg-1 %s, arg-2 %v, arg-3 %v",
-			args: []any{
-				"arg-1-1",
-				10,
-				false,
-			},
-			expectedExitCode: 1,
-			expectedMessage:  fmt.Sprintf("fake-message-1, arg-1 %s, arg-2 %v, arg-3 %v", "arg-1-1", 10, false),
-		},
-		{
-			name:    "not succeed",
-			message: "fake-message-2, arg-1 %s, arg-2 %v, arg-3 %v",
-			args: []any{
-				"arg-1-2",
-				20,
-				true,
-			},
-			succeed:         true,
-			expectedMessage: fmt.Sprintf("fake-message-2, arg-1 %s, arg-2 %v, arg-3 %v", "arg-1-2", 20, true),
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.name, func(t *testing.T) {
-			podFile := filepath.Join(os.TempDir(), uuid.NewString())
-
-			em := exitWithMessageMock{
-				createErr: test.createErr,
-				writeFail: test.writeFail,
-				filePath:  podFile,
-			}
-
-			funcExit = em.Exit
-			funcCreateFile = em.CreateFile
-
-			exitWithMessage(velerotest.NewLogger(), test.succeed, test.message, test.args...)
-
-			assert.Equal(t, test.expectedExitCode, em.exitCode)
-
-			if test.createErr == nil && !test.writeFail {
-				reader, err := os.Open(podFile)
-				require.NoError(t, err)
-
-				message, err := io.ReadAll(reader)
-				require.NoError(t, err)
-
-				reader.Close()
-
-				assert.Equal(t, test.expectedMessage, string(message))
-			}
-		})
-	}
-}

pkg/cmd/cli/datamover/restore.go

@@ -42,6 +42,7 @@ import (
 	"github.com/vmware-tanzu/velero/pkg/repository"
 	"github.com/vmware-tanzu/velero/pkg/uploader"
 	"github.com/vmware-tanzu/velero/pkg/util/filesystem"
+	"github.com/vmware-tanzu/velero/pkg/util/kube"
 	"github.com/vmware-tanzu/velero/pkg/util/logging"
 
 	ctlcache "sigs.k8s.io/controller-runtime/pkg/cache"
@@ -76,7 +77,7 @@ func NewRestoreCommand(f client.Factory) *cobra.Command {
 			f.SetBasename(fmt.Sprintf("%s-%s", c.Parent().Name(), c.Name()))
 			s, err := newdataMoverRestore(logger, f, config)
 			if err != nil {
-				exitWithMessage(logger, false, "Failed to create data mover restore, %v", err)
+				kube.ExitPodWithMessage(logger, false, "Failed to create data mover restore, %v", err)
 			}
 
 			s.run()
@@ -263,7 +264,7 @@ func (s *dataMoverRestore) createDataPathService() (dataPathService, error) {
 	credentialFileStore, err := funcNewCredentialFileStore(
 		s.client,
 		s.namespace,
-		defaultCredentialsDirectory,
+		credentials.DefaultStoreDirectory(),
 		filesystem.NewFileSystem(),
 	)
 	if err != nil {

pkg/cmd/cli/nodeagent/server.go

@@ -76,10 +76,6 @@ const (
 	// the port where prometheus metrics are exposed
 	defaultMetricsAddress = ":8085"
 
-	// defaultCredentialsDirectory is the path on disk where credential
-	// files will be written to
-	defaultCredentialsDirectory = "/tmp/credentials"
-
 	defaultHostPodsPath = "/host_pods"
 
 	defaultResourceTimeout         = 10 * time.Minute
@@ -291,7 +287,7 @@ func (s *nodeAgentServer) run() {
 	credentialFileStore, err := credentials.NewNamespacedFileStore(
 		s.mgr.GetClient(),
 		s.namespace,
-		defaultCredentialsDirectory,
+		credentials.DefaultStoreDirectory(),
 		filesystem.NewFileSystem(),
 	)
 	if err != nil {

pkg/cmd/cli/podvolume/backup.go

@@ -0,0 +1,291 @@
+/*
+Copyright The Velero Contributors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+    http://www.apache.org/licenses/LICENSE-2.0
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package podvolume
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/bombsimon/logrusr/v3"
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+	"github.com/spf13/cobra"
+	corev1api "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/fields"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/klog/v2"
+
+	"github.com/vmware-tanzu/velero/internal/credentials"
+	"github.com/vmware-tanzu/velero/pkg/buildinfo"
+	"github.com/vmware-tanzu/velero/pkg/client"
+	"github.com/vmware-tanzu/velero/pkg/cmd/util/signals"
+	"github.com/vmware-tanzu/velero/pkg/datapath"
+	"github.com/vmware-tanzu/velero/pkg/podvolume"
+	"github.com/vmware-tanzu/velero/pkg/repository"
+	"github.com/vmware-tanzu/velero/pkg/uploader"
+	"github.com/vmware-tanzu/velero/pkg/util/filesystem"
+	"github.com/vmware-tanzu/velero/pkg/util/kube"
+	"github.com/vmware-tanzu/velero/pkg/util/logging"
+
+	ctrl "sigs.k8s.io/controller-runtime"
+
+	velerov1api "github.com/vmware-tanzu/velero/pkg/apis/velero/v1"
+
+	ctlcache "sigs.k8s.io/controller-runtime/pkg/cache"
+	ctlclient "sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+type podVolumeBackupConfig struct {
+	volumePath      string
+	pvbName         string
+	resourceTimeout time.Duration
+}
+
+func NewBackupCommand(f client.Factory) *cobra.Command {
+	config := podVolumeBackupConfig{}
+
+	logLevelFlag := logging.LogLevelFlag(logrus.InfoLevel)
+	formatFlag := logging.NewFormatFlag()
+
+	command := &cobra.Command{
+		Use:    "backup",
+		Short:  "Run the velero pod volume backup",
+		Long:   "Run the velero pod volume backup",
+		Hidden: true,
+		Run: func(c *cobra.Command, args []string) {
+			logLevel := logLevelFlag.Parse()
+			logrus.Infof("Setting log-level to %s", strings.ToUpper(logLevel.String()))
+
+			logger := logging.DefaultLogger(logLevel, formatFlag.Parse())
+			logger.Infof("Starting Velero pod volume backup %s (%s)", buildinfo.Version, buildinfo.FormattedGitSHA())
+
+			f.SetBasename(fmt.Sprintf("%s-%s", c.Parent().Name(), c.Name()))
+			s, err := newPodVolumeBackup(logger, f, config)
+			if err != nil {
+				kube.ExitPodWithMessage(logger, false, "Failed to create pod volume backup, %v", err)
+			}
+
+			s.run()
+		},
+	}
+
+	command.Flags().Var(logLevelFlag, "log-level", fmt.Sprintf("The level at which to log. Valid values are %s.", strings.Join(logLevelFlag.AllowedValues(), ", ")))
+	command.Flags().Var(formatFlag, "log-format", fmt.Sprintf("The format for log output. Valid values are %s.", strings.Join(formatFlag.AllowedValues(), ", ")))
+	command.Flags().StringVar(&config.volumePath, "volume-path", config.volumePath, "The full path of the volume to be backed up")
+	command.Flags().StringVar(&config.pvbName, "pod-volume-backup", config.pvbName, "The PVB name")
+	command.Flags().DurationVar(&config.resourceTimeout, "resource-timeout", config.resourceTimeout, "How long to wait for resource processes which are not covered by other specific timeout parameters.")
+
+	_ = command.MarkFlagRequired("volume-path")
+	_ = command.MarkFlagRequired("pod-volume-backup")
+	_ = command.MarkFlagRequired("resource-timeout")
+
+	return command
+}
+
+type podVolumeBackup struct {
+	logger      logrus.FieldLogger
+	ctx         context.Context
+	cancelFunc  context.CancelFunc
+	client      ctlclient.Client
+	cache       ctlcache.Cache
+	namespace   string
+	nodeName    string
+	config      podVolumeBackupConfig
+	kubeClient  kubernetes.Interface
+	dataPathMgr *datapath.Manager
+}
+
+func newPodVolumeBackup(logger logrus.FieldLogger, factory client.Factory, config podVolumeBackupConfig) (*podVolumeBackup, error) {
+	ctx, cancelFunc := context.WithCancel(context.Background())
+
+	clientConfig, err := factory.ClientConfig()
+	if err != nil {
+		cancelFunc()
+		return nil, errors.Wrap(err, "error to create client config")
+	}
+
+	ctrl.SetLogger(logrusr.New(logger))
+	klog.SetLogger(logrusr.New(logger)) // klog.Logger is used by k8s.io/client-go
+
+	scheme := runtime.NewScheme()
+	if err := velerov1api.AddToScheme(scheme); err != nil {
+		cancelFunc()
+		return nil, errors.Wrap(err, "error to add velero v1 scheme")
+	}
+
+	if err := corev1api.AddToScheme(scheme); err != nil {
+		cancelFunc()
+		return nil, errors.Wrap(err, "error to add core v1 scheme")
+	}
+
+	nodeName := os.Getenv("NODE_NAME")
+
+	// use a field selector to filter to only pods scheduled on this node.
+	cacheOption := ctlcache.Options{
+		Scheme: scheme,
+		ByObject: map[ctlclient.Object]ctlcache.ByObject{
+			&corev1api.Pod{}: {
+				Field: fields.Set{"spec.nodeName": nodeName}.AsSelector(),
+			},
+			&velerov1api.PodVolumeBackup{}: {
+				Field: fields.Set{"metadata.namespace": factory.Namespace()}.AsSelector(),
+			},
+		},
+	}
+
+	cli, err := ctlclient.New(clientConfig, ctlclient.Options{
+		Scheme: scheme,
+	})
+	if err != nil {
+		cancelFunc()
+		return nil, errors.Wrap(err, "error to create client")
+	}
+
+	var cache ctlcache.Cache
+	retry := 10
+	for {
+		cache, err = ctlcache.New(clientConfig, cacheOption)
+		if err == nil {
+			break
+		}
+
+		retry--
+		if retry == 0 {
+			break
+		}
+
+		logger.WithError(err).Warn("Failed to create client cache, need retry")
+
+		time.Sleep(time.Second)
+	}
+
+	if err != nil {
+		cancelFunc()
+		return nil, errors.Wrap(err, "error to create client cache")
+	}
+
+	s := &podVolumeBackup{
+		logger:     logger,
+		ctx:        ctx,
+		cancelFunc: cancelFunc,
+		client:     cli,
+		cache:      cache,
+		config:     config,
+		namespace:  factory.Namespace(),
+		nodeName:   nodeName,
+	}
+
+	s.kubeClient, err = factory.KubeClient()
+	if err != nil {
+		cancelFunc()
+		return nil, errors.Wrap(err, "error to create kube client")
+	}
+
+	s.dataPathMgr = datapath.NewManager(1)
+
+	return s, nil
+}
+
+var funcExitWithMessage = kube.ExitPodWithMessage
+var funcCreateDataPathService = (*podVolumeBackup).createDataPathService
+
+func (s *podVolumeBackup) run() {
+	signals.CancelOnShutdown(s.cancelFunc, s.logger)
+	go func() {
+		if err := s.cache.Start(s.ctx); err != nil {
+			s.logger.WithError(err).Warn("error starting cache")
+		}
+	}()
+
+	s.runDataPath()
+}
+
+func (s *podVolumeBackup) runDataPath() {
+	s.logger.Infof("Starting micro service in node %s for PVB %s", s.nodeName, s.config.pvbName)
+
+	dpService, err := funcCreateDataPathService(s)
+	if err != nil {
+		s.cancelFunc()
+		funcExitWithMessage(s.logger, false, "Failed to create data path service for PVB %s: %v", s.config.pvbName, err)
+		return
+	}
+
+	s.logger.Infof("Starting data path service %s", s.config.pvbName)
+
+	err = dpService.Init()
+	if err != nil {
+		dpService.Shutdown()
+		s.cancelFunc()
+		funcExitWithMessage(s.logger, false, "Failed to init data path service for PVB %s: %v", s.config.pvbName, err)
+		return
+	}
+
+	s.logger.Infof("Running data path service %s", s.config.pvbName)
+
+	result, err := dpService.RunCancelableDataPath(s.ctx)
+	if err != nil {
+		dpService.Shutdown()
+		s.cancelFunc()
+		funcExitWithMessage(s.logger, false, "Failed to run data path service for PVB %s: %v", s.config.pvbName, err)
+		return
+	}
+
+	s.logger.WithField("PVB", s.config.pvbName).Info("Data path service completed")
+
+	dpService.Shutdown()
+
+	s.logger.WithField("PVB", s.config.pvbName).Info("Data path service is shut down")
+
+	s.cancelFunc()
+
+	funcExitWithMessage(s.logger, true, result)
+}
+
+var funcNewCredentialFileStore = credentials.NewNamespacedFileStore
+var funcNewCredentialSecretStore = credentials.NewNamespacedSecretStore
+
+func (s *podVolumeBackup) createDataPathService() (dataPathService, error) {
+	credentialFileStore, err := funcNewCredentialFileStore(
+		s.client,
+		s.namespace,
+		credentials.DefaultStoreDirectory(),
+		filesystem.NewFileSystem(),
+	)
+	if err != nil {
+		return nil, errors.Wrapf(err, "error to create credential file store")
+	}
+
+	credSecretStore, err := funcNewCredentialSecretStore(s.client, s.namespace)
+	if err != nil {
+		return nil, errors.Wrapf(err, "error to create credential secret store")
+	}
+
+	credGetter := &credentials.CredentialGetter{FromFile: credentialFileStore, FromSecret: credSecretStore}
+
+	pvbInformer, err := s.cache.GetInformer(s.ctx, &velerov1api.PodVolumeBackup{})
+	if err != nil {
+		return nil, errors.Wrap(err, "error to get controller-runtime informer from manager")
+	}
+
+	repoEnsurer := repository.NewEnsurer(s.client, s.logger, s.config.resourceTimeout)
+
+	return podvolume.NewBackupMicroService(s.ctx, s.client, s.kubeClient, s.config.pvbName, s.namespace, s.nodeName, datapath.AccessPoint{
+		ByPath:  s.config.volumePath,
+		VolMode: uploader.PersistentVolumeFilesystem,
+	}, s.dataPathMgr, repoEnsurer, credGetter, pvbInformer, s.logger), nil
+}

pkg/cmd/cli/podvolume/backup_test.go

@@ -0,0 +1,216 @@
+/*
+Copyright The Velero Contributors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+    http://www.apache.org/licenses/LICENSE-2.0
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package podvolume
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/sirupsen/logrus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	ctlclient "sigs.k8s.io/controller-runtime/pkg/client"
+
+	"github.com/vmware-tanzu/velero/internal/credentials"
+	cacheMock "github.com/vmware-tanzu/velero/pkg/cmd/cli/datamover/mocks"
+	velerotest "github.com/vmware-tanzu/velero/pkg/test"
+	"github.com/vmware-tanzu/velero/pkg/util/filesystem"
+)
+
+func fakeCreateDataPathServiceWithErr(_ *podVolumeBackup) (dataPathService, error) {
+	return nil, errors.New("fake-create-data-path-error")
+}
+
+var frHelper *fakeRunHelper
+
+func fakeCreateDataPathService(_ *podVolumeBackup) (dataPathService, error) {
+	return frHelper, nil
+}
+
+type fakeRunHelper struct {
+	initErr                     error
+	runCancelableDataPathErr    error
+	runCancelableDataPathResult string
+	exitMessage                 string
+	succeed                     bool
+}
+
+func (fr *fakeRunHelper) Init() error {
+	return fr.initErr
+}
+
+func (fr *fakeRunHelper) RunCancelableDataPath(_ context.Context) (string, error) {
+	if fr.runCancelableDataPathErr != nil {
+		return "", fr.runCancelableDataPathErr
+	} else {
+		return fr.runCancelableDataPathResult, nil
+	}
+}
+
+func (fr *fakeRunHelper) Shutdown() {
+
+}
+
+func (fr *fakeRunHelper) ExitWithMessage(logger logrus.FieldLogger, succeed bool, message string, a ...any) {
+	fr.succeed = succeed
+	fr.exitMessage = fmt.Sprintf(message, a...)
+}
+
+func TestRunDataPath(t *testing.T) {
+	tests := []struct {
+		name                        string
+		pvbName                     string
+		createDataPathFail          bool
+		initDataPathErr             error
+		runCancelableDataPathErr    error
+		runCancelableDataPathResult string
+		expectedMessage             string
+		expectedSucceed             bool
+	}{
+		{
+			name:               "create data path failed",
+			pvbName:            "fake-name",
+			createDataPathFail: true,
+			expectedMessage:    "Failed to create data path service for PVB fake-name: fake-create-data-path-error",
+		},
+		{
+			name:            "init data path failed",
+			pvbName:         "fake-name",
+			initDataPathErr: errors.New("fake-init-data-path-error"),
+			expectedMessage: "Failed to init data path service for PVB fake-name: fake-init-data-path-error",
+		},
+		{
+			name:                     "run data path failed",
+			pvbName:                  "fake-name",
+			runCancelableDataPathErr: errors.New("fake-run-data-path-error"),
+			expectedMessage:          "Failed to run data path service for PVB fake-name: fake-run-data-path-error",
+		},
+		{
+			name:                        "succeed",
+			pvbName:                     "fake-name",
+			runCancelableDataPathResult: "fake-run-data-path-result",
+			expectedMessage:             "fake-run-data-path-result",
+			expectedSucceed:             true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			frHelper = &fakeRunHelper{
+				initErr:                     test.initDataPathErr,
+				runCancelableDataPathErr:    test.runCancelableDataPathErr,
+				runCancelableDataPathResult: test.runCancelableDataPathResult,
+			}
+
+			if test.createDataPathFail {
+				funcCreateDataPathService = fakeCreateDataPathServiceWithErr
+			} else {
+				funcCreateDataPathService = fakeCreateDataPathService
+			}
+
+			funcExitWithMessage = frHelper.ExitWithMessage
+
+			s := &podVolumeBackup{
+				logger:     velerotest.NewLogger(),
+				cancelFunc: func() {},
+				config: podVolumeBackupConfig{
+					pvbName: test.pvbName,
+				},
+			}
+
+			s.runDataPath()
+
+			assert.Equal(t, test.expectedMessage, frHelper.exitMessage)
+			assert.Equal(t, test.expectedSucceed, frHelper.succeed)
+		})
+	}
+}
+
+type fakeCreateDataPathServiceHelper struct {
+	fileStoreErr   error
+	secretStoreErr error
+}
+
+func (fc *fakeCreateDataPathServiceHelper) NewNamespacedFileStore(_ ctlclient.Client, _ string, _ string, _ filesystem.Interface) (credentials.FileStore, error) {
+	return nil, fc.fileStoreErr
+}
+
+func (fc *fakeCreateDataPathServiceHelper) NewNamespacedSecretStore(_ ctlclient.Client, _ string) (credentials.SecretStore, error) {
+	return nil, fc.secretStoreErr
+}
+
+func TestCreateDataPathService(t *testing.T) {
+	tests := []struct {
+		name            string
+		fileStoreErr    error
+		secretStoreErr  error
+		mockGetInformer bool
+		getInformerErr  error
+		expectedError   string
+	}{
+		{
+			name:          "create credential file store error",
+			fileStoreErr:  errors.New("fake-file-store-error"),
+			expectedError: "error to create credential file store: fake-file-store-error",
+		},
+		{
+			name:           "create credential secret store",
+			secretStoreErr: errors.New("fake-secret-store-error"),
+			expectedError:  "error to create credential secret store: fake-secret-store-error",
+		},
+		{
+			name:            "get informer error",
+			mockGetInformer: true,
+			getInformerErr:  errors.New("fake-get-informer-error"),
+			expectedError:   "error to get controller-runtime informer from manager: fake-get-informer-error",
+		},
+		{
+			name:            "succeed",
+			mockGetInformer: true,
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			fcHelper := &fakeCreateDataPathServiceHelper{
+				fileStoreErr:   test.fileStoreErr,
+				secretStoreErr: test.secretStoreErr,
+			}
+
+			funcNewCredentialFileStore = fcHelper.NewNamespacedFileStore
+			funcNewCredentialSecretStore = fcHelper.NewNamespacedSecretStore
+
+			cache := cacheMock.NewCache(t)
+			if test.mockGetInformer {
+				cache.On("GetInformer", mock.Anything, mock.Anything).Return(nil, test.getInformerErr)
+			}
+
+			funcExitWithMessage = frHelper.ExitWithMessage
+
+			s := &podVolumeBackup{
+				cache: cache,
+			}
+
+			_, err := s.createDataPathService()
+
+			if test.expectedError != "" {
+				assert.EqualError(t, err, test.expectedError)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}

pkg/cmd/cli/podvolume/podvolume.go

@@ -0,0 +1,43 @@
+/*
+Copyright The Velero Contributors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+    http://www.apache.org/licenses/LICENSE-2.0
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package podvolume
+
+import (
+	"context"
+
+	"github.com/spf13/cobra"
+
+	"github.com/vmware-tanzu/velero/pkg/client"
+)
+
+func NewCommand(f client.Factory) *cobra.Command {
+	command := &cobra.Command{
+		Use:    "pod-volume",
+		Short:  "Run the velero pod volume backup/restore",
+		Long:   "Run the velero pod volume backup/restore",
+		Hidden: true,
+	}
+
+	command.AddCommand(
+		NewBackupCommand(f),
+	)
+
+	return command
+}
+
+type dataPathService interface {
+	Init() error
+	RunCancelableDataPath(context.Context) (string, error)
+	Shutdown()
+}

pkg/cmd/cli/repomantenance/maintenance.go

@@ -121,7 +121,7 @@ func initRepoManager(namespace string, cli client.Client, kubeClient kubernetes.
 	credentialFileStore, err := credentials.NewNamespacedFileStore(
 		cli,
 		namespace,
-		"/tmp/credentials",
+		credentials.DefaultStoreDirectory(),
 		filesystem.NewFileSystem(),
 	)
 	if err != nil {