Support setting CA cert for BSL

Support setting CA cert for BSL

Signed-off-by: Wenkai Yin(尹文开) <yinw@vmware.com>

pkg/repository/provider/unified_repo.go

@@ -498,10 +498,6 @@ func getStorageVariables(backupLocation *velerov1api.BackupStorageLocation, repo
 		result[udmrepo.StoreOptionS3Endpoint] = strings.Trim(s3URL, "/")
 		result[udmrepo.StoreOptionS3DisableTLSVerify] = config["insecureSkipTLSVerify"]
 		result[udmrepo.StoreOptionS3DisableTLS] = strconv.FormatBool(disableTLS)
-
-		if backupLocation.Spec.ObjectStorage != nil && backupLocation.Spec.ObjectStorage.CACert != nil {
-			result[udmrepo.StoreOptionS3CustomCA] = base64.StdEncoding.EncodeToString(backupLocation.Spec.ObjectStorage.CACert)
-		}
 	} else if backendType == repoconfig.AzureBackend {
 		for k, v := range config {
 			result[k] = v
@@ -510,6 +506,9 @@ func getStorageVariables(backupLocation *velerov1api.BackupStorageLocation, repo
 
 	result[udmrepo.StoreOptionOssBucket] = bucket
 	result[udmrepo.StoreOptionPrefix] = prefix
+	if backupLocation.Spec.ObjectStorage != nil && backupLocation.Spec.ObjectStorage.CACert != nil {
+		result[udmrepo.StoreOptionCACert] = base64.StdEncoding.EncodeToString(backupLocation.Spec.ObjectStorage.CACert)
+	}
 	result[udmrepo.StoreOptionOssRegion] = strings.Trim(region, "/")
 	result[udmrepo.StoreOptionFsPath] = config["fspath"]
 

pkg/repository/provider/unified_repo_test.go

@@ -384,7 +384,7 @@ func TestGetStorageVariables(t *testing.T) {
 				"endpoint":      "fake-url",
 				"doNotUseTLS":   "false",
 				"skipTLSVerify": "false",
-				"customCA":      base64.StdEncoding.EncodeToString([]byte{0x01, 0x02, 0x03, 0x04, 0x05}),
+				"caCert":        base64.StdEncoding.EncodeToString([]byte{0x01, 0x02, 0x03, 0x04, 0x05}),
 			},
 		},
 		{

pkg/repository/udmrepo/kopialib/backend/azure.go

@@ -21,6 +21,7 @@ import (
 
 	"github.com/kopia/kopia/repo/blob"
 
+	"github.com/vmware-tanzu/velero/pkg/repository/udmrepo"
 	"github.com/vmware-tanzu/velero/pkg/repository/udmrepo/kopialib/backend/azure"
 )
 
@@ -29,6 +30,9 @@ type AzureBackend struct {
 }
 
 func (c *AzureBackend) Setup(ctx context.Context, flags map[string]string) error {
+	if flags[udmrepo.StoreOptionCACert] != "" {
+		flags["caCertEncoded"] = "true"
+	}
 	c.option = azure.Option{
 		Config: flags,
 		Limits: setupLimits(ctx, flags),

pkg/repository/udmrepo/kopialib/backend/azure/azure_storage_wrapper.go

@@ -20,10 +20,10 @@ import (
 	"context"
 
 	"github.com/kopia/kopia/repo/blob"
+	"github.com/kopia/kopia/repo/blob/azure"
 	"github.com/kopia/kopia/repo/blob/throttling"
 	"github.com/sirupsen/logrus"
 
-	"github.com/kopia/kopia/repo/blob/azure"
 	"github.com/vmware-tanzu/velero/pkg/repository/udmrepo"
 	azureutil "github.com/vmware-tanzu/velero/pkg/util/azure"
 )

pkg/repository/udmrepo/kopialib/backend/s3.go

@@ -44,7 +44,7 @@ func (c *S3Backend) Setup(ctx context.Context, flags map[string]string) error {
 	c.options.DoNotUseTLS = optionalHaveBool(ctx, udmrepo.StoreOptionS3DisableTLS, flags)
 	c.options.DoNotVerifyTLS = optionalHaveBool(ctx, udmrepo.StoreOptionS3DisableTLSVerify, flags)
 	c.options.SessionToken = optionalHaveString(udmrepo.StoreOptionS3Token, flags)
-	c.options.RootCA = optionalHaveBase64(ctx, udmrepo.StoreOptionS3CustomCA, flags)
+	c.options.RootCA = optionalHaveBase64(ctx, udmrepo.StoreOptionCACert, flags)
 
 	c.options.Limits = setupLimits(ctx, flags)
 

pkg/repository/udmrepo/kopialib/backend/s3_test.go

@@ -95,8 +95,8 @@ func TestS3Setup(t *testing.T) {
 		{
 			name: "with wrong ca",
 			flags: map[string]string{
-				udmrepo.StoreOptionOssBucket:  "fake-bucket",
-				udmrepo.StoreOptionS3CustomCA: "fake-base-64",
+				udmrepo.StoreOptionOssBucket: "fake-bucket",
+				udmrepo.StoreOptionCACert:    "fake-base-64",
 			},
 			expectedOptions: s3.Options{
 				BucketName: "fake-bucket",
@@ -105,8 +105,8 @@ func TestS3Setup(t *testing.T) {
 		{
 			name: "with correct ca",
 			flags: map[string]string{
-				udmrepo.StoreOptionOssBucket:  "fake-bucket",
-				udmrepo.StoreOptionS3CustomCA: "ZmFrZS1jYQ==",
+				udmrepo.StoreOptionOssBucket: "fake-bucket",
+				udmrepo.StoreOptionCACert:    "ZmFrZS1jYQ==",
 			},
 			expectedOptions: s3.Options{
 				BucketName: "fake-bucket",

pkg/repository/udmrepo/repo_options.go

@@ -42,7 +42,6 @@ const (
 	StoreOptionS3Endpoint         = "endpoint"
 	StoreOptionS3DisableTLS       = "doNotUseTLS"
 	StoreOptionS3DisableTLSVerify = "skipTLSVerify"
-	StoreOptionS3CustomCA         = "customCA"
 
 	StoreOptionFsPath = "fspath"
 
@@ -50,6 +49,7 @@ const (
 
 	StoreOptionOssBucket = "bucket"
 	StoreOptionOssRegion = "region"
+	StoreOptionCACert    = "caCert"
 
 	StoreOptionCredentialFile = "credFile"
 	StoreOptionPrefix         = "prefix"