From 5b52fd3efdf3df19f35524e895fdbb895ed7dd68 Mon Sep 17 00:00:00 2001
From: Steve Kriss <krisss@vmware.com>
Date: Wed, 27 May 2020 17:03:52 -0600
Subject: [PATCH] re-instantiate backup store just before persisting artifacts
 (#2550)

Signed-off-by: Steve Kriss <krisss@vmware.com>
---
 changelogs/unreleased/2550-skriss    |  1 +
 pkg/controller/backup_controller.go  | 10 +++++++++-
 pkg/controller/restore_controller.go |  9 +++++++++
 3 files changed, 19 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/2550-skriss

diff --git a/changelogs/unreleased/2550-skriss b/changelogs/unreleased/2550-skriss
new file mode 100644
index 000000000..445436a80
--- /dev/null
+++ b/changelogs/unreleased/2550-skriss
@@ -0,0 +1 @@
+backup/restore: reinstantiate backup store just before uploading artifacts to ensure credentials are up-to-date
diff --git a/pkg/controller/backup_controller.go b/pkg/controller/backup_controller.go
index ef71b0a89..05f549df5 100644
--- a/pkg/controller/backup_controller.go
+++ b/pkg/controller/backup_controller.go
@@ -533,7 +533,7 @@ func (c *backupController) runBackup(backup *pkgbackup.Request) error {
 		return err
 	}
 
-	backupLog.Info("Setting up backup store")
+	backupLog.Info("Setting up backup store to check for backup existence")
 	backupStore, err := c.newBackupStore(backup.StorageLocation, pluginManager, backupLog)
 	if err != nil {
 		return err
@@ -612,6 +612,14 @@ func (c *backupController) runBackup(backup *pkgbackup.Request) error {
 		backup.Status.Phase = velerov1api.BackupPhaseCompleted
 	}
 
+	// re-instantiate the backup store because credentials could have changed since the original
+	// instantiation, if this was a long-running backup
+	backupLog.Info("Setting up backup store to persist the backup")
+	backupStore, err = c.newBackupStore(backup.StorageLocation, pluginManager, backupLog)
+	if err != nil {
+		return err
+	}
+
 	if errs := persistBackup(backup, backupFile, logFile, backupStore, c.logger, volumeSnapshots, volumeSnapshotContents); len(errs) > 0 {
 		fatalErrs = append(fatalErrs, errs...)
 	}
diff --git a/pkg/controller/restore_controller.go b/pkg/controller/restore_controller.go
index cfee38fc0..343af150f 100644
--- a/pkg/controller/restore_controller.go
+++ b/pkg/controller/restore_controller.go
@@ -274,6 +274,7 @@ func (c *restoreController) processRestore(restore *api.Restore) error {
 
 type backupInfo struct {
 	backup      *api.Backup
+	location    *api.BackupStorageLocation
 	backupStore persistence.BackupStore
 }
 
@@ -407,6 +408,7 @@ func (c *restoreController) fetchBackupInfo(backupName string, pluginManager cli
 
 	return backupInfo{
 		backup:      backup,
+		location:    location,
 		backupStore: backupStore,
 	}, nil
 }
@@ -467,6 +469,13 @@ func (c *restoreController) runValidatedRestore(restore *api.Restore, info backu
 	restoreWarnings, restoreErrors := c.restorer.Restore(restoreReq, actions, c.snapshotLocationLister, pluginManager)
 	restoreLog.Info("restore completed")
 
+	// re-instantiate the backup store because credentials could have changed since the original
+	// instantiation, if this was a long-running restore
+	info.backupStore, err = c.newBackupStore(info.location, pluginManager, c.logger)
+	if err != nil {
+		return errors.Wrap(err, "error setting up backup store to persist log and results files")
+	}
+
 	if logReader, err := restoreLog.done(c.logger); err != nil {
 		restoreErrors.Velero = append(restoreErrors.Velero, fmt.Sprintf("error getting restore log reader: %v", err))
 	} else {