From a5718fff7d6cd85a697fd2f4374aaf61070223ab Mon Sep 17 00:00:00 2001
From: Shubham Dilip Pampattiwar <shubhampampattiwar7@gmail.com>
Date: Tue, 29 Jun 2021 11:34:58 -0400
Subject: [PATCH 1/5] diff-bsl-vsl-support

---
 roles/velero/defaults/main.yml   |  9 +++++++
 roles/velero/tasks/main.yml      |  8 +++---
 roles/velero/tasks/preflight.yml | 42 ++++++++++++++++++++++++++++++++
 3 files changed, 55 insertions(+), 4 deletions(-)

diff --git a/roles/velero/defaults/main.yml b/roles/velero/defaults/main.yml
index f05aa03fe5b..821d40d20e0 100644
--- a/roles/velero/defaults/main.yml
+++ b/roles/velero/defaults/main.yml
@@ -12,9 +12,18 @@ velero_state: "present"
 velero_aws_bsl_configs: 0
 velero_gcp_bsl_configs: 0
 velero_azure_bsl_configs: 0
+velero_aws_vsl_configs: 0
+velero_gcp_vsl_configs: 0
+velero_azure_vsl_configs: 0
 velero_aws_secret_name: cloud-credentials
 velero_gcp_secret_name: gcp-cloud-credentials
 velero_azure_secret_name: azure-cloud-credentials
+velero_aws_bsl: false
+velero_gcp_bsl: false
+velero_azure_bsl: false
+velero_aws_vsl: false
+velero_gcp_vsl: false
+velero_azure_vsl: false
 velero_debug: false
 velero_upstream_project: velero
 velero_vsphere_upstream_project: vsphereveleroplugin
diff --git a/roles/velero/tasks/main.yml b/roles/velero/tasks/main.yml
index 7f52df5fe42..dbc98df7438 100644
--- a/roles/velero/tasks/main.yml
+++ b/roles/velero/tasks/main.yml
@@ -12,7 +12,7 @@
     name: "{{ velero_aws_secret_name }}"
     namespace: "{{ velero_namespace }}"
   register: secret_status
-  when: '"aws" in default_velero_plugins'
+  when: '"aws" in default_velero_plugins and (velero_aws_bsl or velero_aws_vsl)'
 
 - name: "Check if the AWS credentials secret exists or not"
   fail:
@@ -26,7 +26,7 @@
     name: "{{ velero_gcp_secret_name }}"
     namespace: "{{ velero_namespace }}"
   register: gcp_secret_status
-  when: '"gcp" in default_velero_plugins'
+  when: '"gcp" in default_velero_plugins and (velero_gcp_bsl or velero_gcp_vsl)'
 
 - name: "Check if the GCP credentials secret exists or not"
   fail:
@@ -40,14 +40,14 @@
     name: "{{ velero_azure_secret_name }}"
     namespace: "{{ velero_namespace }}"
   register: azure_secret_status
-  when: '"azure" in default_velero_plugins'
+  when: '"azure" in default_velero_plugins and (velero_azure_bsl or velero_azure_vsl)'
 
 - name: "Check if the Azure credentials secret exists or not"
   fail:
     msg: "Azure credentials secret does not exist, Please create the secret {{ velero_azure_secret_name }} in order to proceed further with velero installation"
   when: '"azure" in default_velero_plugins and azure_secret_status.resources | length == 0 and not noobaa'
 
-- when: '"aws" in default_velero_plugins and secret_status.resources | length > 0 and not noobaa'
+- when: '"aws" in default_velero_plugins and secret_status.resources | length > 0 and not noobaa and (velero_aws_bsl or velero_aws_vsl)'
   block:
   - name: Discover AWS credentials
     k8s_info:
diff --git a/roles/velero/tasks/preflight.yml b/roles/velero/tasks/preflight.yml
index 03cd9a3abf1..ff3fff07d55 100644
--- a/roles/velero/tasks/preflight.yml
+++ b/roles/velero/tasks/preflight.yml
@@ -3,6 +3,7 @@
   set_fact:
     velero_aws_secret_name: "{{ item.credentials_secret_ref.name }}"
     velero_aws_bsl_configs: "{{ velero_aws_bsl_configs | int + 1 }}"
+    velero_aws_bsl: true
     aws_bsl_res: "{{ item }}"
   loop: "{{ backup_storage_locations }}"
   when: item.provider == 'aws'
@@ -26,6 +27,7 @@
     velero_gcp_secret_name: "{{ item.credentials_secret_ref.name }}"
     velero_gcp_bsl_configs: "{{ velero_gcp_bsl_configs | int + 1 }}"
     gcp_bsl_res: "{{ item }}"
+    velero_gcp_bsl: true
   loop: "{{ backup_storage_locations }}"
   when: item.provider == 'gcp'
 
@@ -48,6 +50,7 @@
     velero_azure_secret_name: "{{ item.credentials_secret_ref.name }}"
     velero_azure_bsl_configs: "{{ velero_azure_bsl_configs | int + 1 }}"
     azure_bsl_res: "{{ item }}"
+    velero_azure_bsl: true
   loop: "{{ backup_storage_locations }}"
   when: item.provider == 'azure'
 
@@ -64,3 +67,42 @@
     - fail:
         msg: "The provided caCert for azure is not in valid base64 format"
   when: azure_bsl_res.object_storage.ca_cert is defined
+
+- name: "Discover aws as provider in Volume Snapshot Locations and associate aws secret name"
+  set_fact:
+    velero_aws_secret_name: "{{ item.credentials_secret_ref.name }}"
+    velero_aws_vsl_configs: "{{ velero_aws_vsl_configs | int + 1 }}"
+    velero_aws_vsl: true
+  loop: "{{ volume_snapshot_locations }}"
+  when: item.provider == 'aws'
+
+- name: "Validate that there is only one aws VSL config"
+  fail:
+    msg: "More than one VolumeSnapshotLocations are configured for aws"
+  when: velero_aws_vsl_configs | int > 1
+
+- name: "Discover gcp as provider in Volume Snapshot Locations and associate gcp secret name"
+  set_fact:
+    velero_gcp_secret_name: "{{ item.credentials_secret_ref.name }}"
+    velero_gcp_vsl_configs: "{{ velero_gcp_vsl_configs | int + 1 }}"
+    velero_gcp_vsl: true
+  loop: "{{ volume_snapshot_locations }}"
+  when: item.provider == 'gcp'
+
+- name: "Validate that there is only one gcp VSL config"
+  fail:
+    msg: "More than one VolumeSnapshotLocations are configured for gcp"
+  when: velero_gcp_vsl_configs | int > 1
+
+- name: "Discover azure as provider in Volume Snapshot Locations and associate azure secret name"
+  set_fact:
+    velero_azure_secret_name: "{{ item.credentials_secret_ref.name }}"
+    velero_azure_vsl_configs: "{{ velero_azure_vsl_configs | int + 1 }}"
+    velero_azure_vsl: true
+  loop: "{{ volume_snapshot_locations }}"
+  when: item.provider == 'azure'
+
+- name: "Validate that there is only one azure VSL config"
+  fail:
+    msg: "More than one VolumeSnapshotLocations are configured for azure"
+  when: velero_azure_vsl_configs | int > 1
\ No newline at end of file

From dd2d179ef8a339fa13069ba4b97f8d7580bd4db7 Mon Sep 17 00:00:00 2001
From: Shubham Dilip Pampattiwar <shubhampampattiwar7@gmail.com>
Date: Wed, 30 Jun 2021 19:42:33 -0400
Subject: [PATCH 2/5] update tasks and templates

---
 roles/velero/tasks/main.yml          | 14 +++---
 roles/velero/tasks/preflight.yml     | 66 ++++++++++++++--------------
 roles/velero/templates/restic.yml.j2 | 28 +++++++-----
 roles/velero/templates/velero.yml.j2 | 28 +++++++-----
 4 files changed, 76 insertions(+), 60 deletions(-)

diff --git a/roles/velero/tasks/main.yml b/roles/velero/tasks/main.yml
index dbc98df7438..cd48b34bc5a 100644
--- a/roles/velero/tasks/main.yml
+++ b/roles/velero/tasks/main.yml
@@ -12,12 +12,12 @@
     name: "{{ velero_aws_secret_name }}"
     namespace: "{{ velero_namespace }}"
   register: secret_status
-  when: '"aws" in default_velero_plugins and (velero_aws_bsl or velero_aws_vsl)'
+  when: '"aws" in default_velero_plugins'
 
 - name: "Check if the AWS credentials secret exists or not"
   fail:
     msg: "AWS credentials secret does not exist, Please create the secret {{ velero_aws_secret_name }} in order to proceed further with Velero installation"
-  when: '"aws" in default_velero_plugins and secret_status.resources | length == 0 and not noobaa'
+  when: '"aws" in default_velero_plugins and secret_status is defined and secret_status.resources | length == 0 and not noobaa and velero_aws_bsl'
 
 - name: "Discover GCP credentials secret"
   k8s_info:
@@ -26,12 +26,12 @@
     name: "{{ velero_gcp_secret_name }}"
     namespace: "{{ velero_namespace }}"
   register: gcp_secret_status
-  when: '"gcp" in default_velero_plugins and (velero_gcp_bsl or velero_gcp_vsl)'
+  when: '"gcp" in default_velero_plugins'
 
 - name: "Check if the GCP credentials secret exists or not"
   fail:
     msg: "GCP credentials secret does not exist, Please create the secret {{ velero_gcp_secret_name }} in order to proceed further with velero installation"
-  when: '"gcp" in default_velero_plugins and gcp_secret_status.resources | length == 0 and not noobaa'
+  when: '"gcp" in default_velero_plugins and gcp_secret_status is defined and gcp_secret_status.resources | length == 0 and not noobaa and velero_gcp_bsl'
 
 - name: "Discover Azure credentials secret"
   k8s_info:
@@ -40,14 +40,14 @@
     name: "{{ velero_azure_secret_name }}"
     namespace: "{{ velero_namespace }}"
   register: azure_secret_status
-  when: '"azure" in default_velero_plugins and (velero_azure_bsl or velero_azure_vsl)'
+  when: '"azure" in default_velero_plugins'
 
 - name: "Check if the Azure credentials secret exists or not"
   fail:
     msg: "Azure credentials secret does not exist, Please create the secret {{ velero_azure_secret_name }} in order to proceed further with velero installation"
-  when: '"azure" in default_velero_plugins and azure_secret_status.resources | length == 0 and not noobaa'
+  when: '"azure" in default_velero_plugins and azure_secret_status is defined and azure_secret_status.resources | length == 0 and not noobaa and velero_azure_bsl'
 
-- when: '"aws" in default_velero_plugins and secret_status.resources | length > 0 and not noobaa and (velero_aws_bsl or velero_aws_vsl)'
+- when: '"aws" in default_velero_plugins and secret_status is defined and secret_status.resources | length > 0 and not noobaa and velero_aws_bsl'
   block:
   - name: Discover AWS credentials
     k8s_info:
diff --git a/roles/velero/tasks/preflight.yml b/roles/velero/tasks/preflight.yml
index ff3fff07d55..adb0a839b37 100644
--- a/roles/velero/tasks/preflight.yml
+++ b/roles/velero/tasks/preflight.yml
@@ -68,41 +68,41 @@
         msg: "The provided caCert for azure is not in valid base64 format"
   when: azure_bsl_res.object_storage.ca_cert is defined
 
-- name: "Discover aws as provider in Volume Snapshot Locations and associate aws secret name"
-  set_fact:
-    velero_aws_secret_name: "{{ item.credentials_secret_ref.name }}"
-    velero_aws_vsl_configs: "{{ velero_aws_vsl_configs | int + 1 }}"
-    velero_aws_vsl: true
-  loop: "{{ volume_snapshot_locations }}"
-  when: item.provider == 'aws'
+# - name: "Discover aws as provider in Volume Snapshot Locations and associate aws secret name"
+#   set_fact:
+#     velero_aws_secret_name: "{{ item.credentials_secret_ref.name }}"
+#     velero_aws_vsl_configs: "{{ velero_aws_vsl_configs | int + 1 }}"
+#     velero_aws_vsl: true
+#   loop: "{{ volume_snapshot_locations }}"
+#   when: item.provider == 'aws'
 
-- name: "Validate that there is only one aws VSL config"
-  fail:
-    msg: "More than one VolumeSnapshotLocations are configured for aws"
-  when: velero_aws_vsl_configs | int > 1
+# - name: "Validate that there is only one aws VSL config"
+#   fail:
+#     msg: "More than one VolumeSnapshotLocations are configured for aws"
+#   when: velero_aws_vsl_configs | int > 1
 
-- name: "Discover gcp as provider in Volume Snapshot Locations and associate gcp secret name"
-  set_fact:
-    velero_gcp_secret_name: "{{ item.credentials_secret_ref.name }}"
-    velero_gcp_vsl_configs: "{{ velero_gcp_vsl_configs | int + 1 }}"
-    velero_gcp_vsl: true
-  loop: "{{ volume_snapshot_locations }}"
-  when: item.provider == 'gcp'
+# - name: "Discover gcp as provider in Volume Snapshot Locations and associate gcp secret name"
+#   set_fact:
+#     velero_gcp_secret_name: "{{ item.credentials_secret_ref.name }}"
+#     velero_gcp_vsl_configs: "{{ velero_gcp_vsl_configs | int + 1 }}"
+#     velero_gcp_vsl: true
+#   loop: "{{ volume_snapshot_locations }}"
+#   when: item.provider == 'gcp'
 
-- name: "Validate that there is only one gcp VSL config"
-  fail:
-    msg: "More than one VolumeSnapshotLocations are configured for gcp"
-  when: velero_gcp_vsl_configs | int > 1
+# - name: "Validate that there is only one gcp VSL config"
+#   fail:
+#     msg: "More than one VolumeSnapshotLocations are configured for gcp"
+#   when: velero_gcp_vsl_configs | int > 1
 
-- name: "Discover azure as provider in Volume Snapshot Locations and associate azure secret name"
-  set_fact:
-    velero_azure_secret_name: "{{ item.credentials_secret_ref.name }}"
-    velero_azure_vsl_configs: "{{ velero_azure_vsl_configs | int + 1 }}"
-    velero_azure_vsl: true
-  loop: "{{ volume_snapshot_locations }}"
-  when: item.provider == 'azure'
+# - name: "Discover azure as provider in Volume Snapshot Locations and associate azure secret name"
+#   set_fact:
+#     velero_azure_secret_name: "{{ item.credentials_secret_ref.name }}"
+#     velero_azure_vsl_configs: "{{ velero_azure_vsl_configs | int + 1 }}"
+#     velero_azure_vsl: true
+#   loop: "{{ volume_snapshot_locations }}"
+#   when: item.provider == 'azure'
 
-- name: "Validate that there is only one azure VSL config"
-  fail:
-    msg: "More than one VolumeSnapshotLocations are configured for azure"
-  when: velero_azure_vsl_configs | int > 1
\ No newline at end of file
+# - name: "Validate that there is only one azure VSL config"
+#   fail:
+#     msg: "More than one VolumeSnapshotLocations are configured for azure"
+#   when: velero_azure_vsl_configs | int > 1
\ No newline at end of file
diff --git a/roles/velero/templates/restic.yml.j2 b/roles/velero/templates/restic.yml.j2
index 730361ba609..451d7cb9ac4 100644
--- a/roles/velero/templates/restic.yml.j2
+++ b/roles/velero/templates/restic.yml.j2
@@ -29,17 +29,17 @@ spec:
         runAsUser: 0
         supplementalGroups: {{ restic_supplemental_groups }}
       volumes:
-{% if 'aws' in default_velero_plugins %}
+{% if 'aws' in default_velero_plugins and velero_aws_bsl %}
         - name: {{ velero_aws_secret_name }}
           secret:
             secretName: {{ velero_aws_secret_name }}
 {% endif %}
-{% if 'gcp' in default_velero_plugins %}
+{% if 'gcp' in default_velero_plugins and velero_gcp_bsl %}
         - name: {{ velero_gcp_secret_name }}
           secret:
             secretName: {{ velero_gcp_secret_name }}
 {% endif %}
-{% if 'azure' in default_velero_plugins %}
+{% if 'azure' in default_velero_plugins and velero_azure_bsl %}
         - name: {{ velero_azure_secret_name }}
           secret:
             secretName: {{ velero_azure_secret_name }}
@@ -100,15 +100,15 @@ spec:
             - restic
             - server
           volumeMounts:
-{% if 'aws' in default_velero_plugins %}
+{% if 'aws' in default_velero_plugins and velero_aws_bsl %}
             - name: {{ velero_aws_secret_name }}
               mountPath: /credentials
 {% endif %}
-{% if 'gcp' in default_velero_plugins %}
+{% if 'gcp' in default_velero_plugins and velero_gcp_bsl %}
             - name: {{ velero_gcp_secret_name }}
               mountPath: /credentials-gcp
 {% endif %}
-{% if 'azure' in default_velero_plugins %}
+{% if 'azure' in default_velero_plugins and velero_azure_bsl %}
             - name: {{ velero_azure_secret_name }}
               mountPath: /credentials-azure
 {% endif %}
@@ -144,15 +144,15 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.namespace
-{% if 'aws' in default_velero_plugins %}
+{% if 'aws' in default_velero_plugins and velero_aws_bsl %}
             - name: AWS_SHARED_CREDENTIALS_FILE
               value: /credentials/cloud
 {% endif %}
-{% if 'gcp' in default_velero_plugins %}
+{% if 'gcp' in default_velero_plugins and velero_gcp_bsl %}
             - name: GOOGLE_APPLICATION_CREDENTIALS
               value: /credentials-gcp/cloud
 {% endif %}
-{% if 'azure' in default_velero_plugins %}
+{% if 'azure' in default_velero_plugins and velero_azure_bsl %}
             - name: AZURE_CREDENTIALS_FILE
               value: /credentials-azure/cloud
 {% endif %}
@@ -174,8 +174,16 @@ spec:
           volumeMounts:
             - name: certs
               mountPath: /certs
-{% if 'aws' in default_velero_plugins %}
+{% if 'aws' in default_velero_plugins and velero_aws_bsl %}
             - name: {{ velero_aws_secret_name }}
               mountPath: /credentials
 {% endif %}
+{% if 'gcp' in default_velero_plugins and velero_gcp_bsl %}
+            - name: {{ velero_gcp_secret_name }}
+              mountPath: /credentials-gcp
+{% endif %}
+{% if 'azure' in default_velero_plugins and velero_azure_bsl %}
+            - name: {{ velero_azure_secret_name }}
+              mountPath: /credentials-azure
+{% endif %}
 
diff --git a/roles/velero/templates/velero.yml.j2 b/roles/velero/templates/velero.yml.j2
index 6e69682a8a7..1890d8e870c 100644
--- a/roles/velero/templates/velero.yml.j2
+++ b/roles/velero/templates/velero.yml.j2
@@ -99,15 +99,15 @@ spec:
             - debug
 {% endif %}
           volumeMounts:
-{% if 'aws' in default_velero_plugins %}
+{% if 'aws' in default_velero_plugins and velero_aws_bsl %}
             - name: {{ velero_aws_secret_name }}
               mountPath: /credentials
 {% endif %}
-{% if 'gcp' in default_velero_plugins %}
+{% if 'gcp' in default_velero_plugins and velero_gcp_bsl %}
             - name: {{ velero_gcp_secret_name }}
               mountPath: /credentials-gcp
 {% endif %}
-{% if 'azure' in default_velero_plugins %}
+{% if 'azure' in default_velero_plugins and velero_azure_bsl %}
             - name: {{ velero_azure_secret_name }}
               mountPath: /credentials-azure
 {% endif %}
@@ -120,15 +120,15 @@ spec:
           env:
             - name: LD_LIBRARY_PATH
               value: /plugins
-{% if 'aws' in default_velero_plugins %}
+{% if 'aws' in default_velero_plugins and velero_aws_bsl %}
             - name: AWS_SHARED_CREDENTIALS_FILE
               value: /credentials/cloud
 {% endif %}
-{% if 'gcp' in default_velero_plugins %}
+{% if 'gcp' in default_velero_plugins and velero_gcp_bsl %}
             - name: GOOGLE_APPLICATION_CREDENTIALS
               value: /credentials-gcp/cloud
 {% endif %}
-{% if 'azure' in default_velero_plugins %}
+{% if 'azure' in default_velero_plugins and velero_azure_bsl %}
             - name: AZURE_CREDENTIALS_FILE
               value: /credentials-azure/cloud
 {% endif %}
@@ -149,17 +149,17 @@ spec:
               value: {{ no_proxy }}
 {% endif %}
       volumes:
-{% if 'aws' in default_velero_plugins %}
+{% if 'aws' in default_velero_plugins and velero_aws_bsl %}
         - name: {{ velero_aws_secret_name }}
           secret:
             secretName: {{ velero_aws_secret_name }}
 {% endif %}
-{% if 'gcp' in default_velero_plugins %}
+{% if 'gcp' in default_velero_plugins and velero_gcp_bsl %}
         - name: {{ velero_gcp_secret_name }}
           secret:
             secretName: {{ velero_gcp_secret_name }}
 {% endif %}
-{% if 'azure' in default_velero_plugins %}
+{% if 'azure' in default_velero_plugins and velero_azure_bsl %}
         - name: {{ velero_azure_secret_name }}
           secret:
             secretName: {{ velero_azure_secret_name }}
@@ -252,10 +252,18 @@ spec:
           volumeMounts:
           - mountPath: /certs
             name: certs
-{% if 'aws' in default_velero_plugins %}
+{% if 'aws' in default_velero_plugins and velero_aws_bsl %}
           - mountPath: /credentials
             name: {{ velero_aws_secret_name }}
 {% endif %}
+{% if 'gcp' in default_velero_plugins and velero_gcp_bsl %}
+          - name: {{ velero_gcp_secret_name }}
+            mountPath: /credentials-gcp
+{% endif %}
+{% if 'azure' in default_velero_plugins and velero_azure_bsl %}
+          - name: {{ velero_azure_secret_name }}
+            mountPath: /credentials-azure
+{% endif %}
 {% for plugin in custom_velero_plugins %}
         - image: {{ plugin.image }}
           imagePullPolicy: "{{ image_pull_policy }}"

From 11e205a2aed3451775ce9d6742d0028ad34344af Mon Sep 17 00:00:00 2001
From: Shubham Dilip Pampattiwar <shubhampampattiwar7@gmail.com>
Date: Tue, 6 Jul 2021 14:38:45 -0400
Subject: [PATCH 3/5] add changes for VSL checks and cred reference

---
 roles/velero/tasks/main.yml          |  6 +--
 roles/velero/tasks/preflight.yml     | 66 ++++++++++++++--------------
 roles/velero/templates/restic.yml.j2 | 24 +++++-----
 roles/velero/templates/velero.yml.j2 | 24 +++++-----
 4 files changed, 60 insertions(+), 60 deletions(-)

diff --git a/roles/velero/tasks/main.yml b/roles/velero/tasks/main.yml
index cd48b34bc5a..cd7750bda8a 100644
--- a/roles/velero/tasks/main.yml
+++ b/roles/velero/tasks/main.yml
@@ -17,7 +17,7 @@
 - name: "Check if the AWS credentials secret exists or not"
   fail:
     msg: "AWS credentials secret does not exist, Please create the secret {{ velero_aws_secret_name }} in order to proceed further with Velero installation"
-  when: '"aws" in default_velero_plugins and secret_status is defined and secret_status.resources | length == 0 and not noobaa and velero_aws_bsl'
+  when: '"aws" in default_velero_plugins and secret_status is defined and secret_status.resources | length == 0 and not noobaa and (velero_aws_bsl or velero_aws_vsl)'
 
 - name: "Discover GCP credentials secret"
   k8s_info:
@@ -31,7 +31,7 @@
 - name: "Check if the GCP credentials secret exists or not"
   fail:
     msg: "GCP credentials secret does not exist, Please create the secret {{ velero_gcp_secret_name }} in order to proceed further with velero installation"
-  when: '"gcp" in default_velero_plugins and gcp_secret_status is defined and gcp_secret_status.resources | length == 0 and not noobaa and velero_gcp_bsl'
+  when: '"gcp" in default_velero_plugins and gcp_secret_status is defined and gcp_secret_status.resources | length == 0 and not noobaa and (velero_gcp_bsl or velero_gcp_vsl)'
 
 - name: "Discover Azure credentials secret"
   k8s_info:
@@ -45,7 +45,7 @@
 - name: "Check if the Azure credentials secret exists or not"
   fail:
     msg: "Azure credentials secret does not exist, Please create the secret {{ velero_azure_secret_name }} in order to proceed further with velero installation"
-  when: '"azure" in default_velero_plugins and azure_secret_status is defined and azure_secret_status.resources | length == 0 and not noobaa and velero_azure_bsl'
+  when: '"azure" in default_velero_plugins and azure_secret_status is defined and azure_secret_status.resources | length == 0 and not noobaa and (velero_azure_bsl or velero_azure_vsl)'
 
 - when: '"aws" in default_velero_plugins and secret_status is defined and secret_status.resources | length > 0 and not noobaa and velero_aws_bsl'
   block:
diff --git a/roles/velero/tasks/preflight.yml b/roles/velero/tasks/preflight.yml
index adb0a839b37..ff3fff07d55 100644
--- a/roles/velero/tasks/preflight.yml
+++ b/roles/velero/tasks/preflight.yml
@@ -68,41 +68,41 @@
         msg: "The provided caCert for azure is not in valid base64 format"
   when: azure_bsl_res.object_storage.ca_cert is defined
 
-# - name: "Discover aws as provider in Volume Snapshot Locations and associate aws secret name"
-#   set_fact:
-#     velero_aws_secret_name: "{{ item.credentials_secret_ref.name }}"
-#     velero_aws_vsl_configs: "{{ velero_aws_vsl_configs | int + 1 }}"
-#     velero_aws_vsl: true
-#   loop: "{{ volume_snapshot_locations }}"
-#   when: item.provider == 'aws'
+- name: "Discover aws as provider in Volume Snapshot Locations and associate aws secret name"
+  set_fact:
+    velero_aws_secret_name: "{{ item.credentials_secret_ref.name }}"
+    velero_aws_vsl_configs: "{{ velero_aws_vsl_configs | int + 1 }}"
+    velero_aws_vsl: true
+  loop: "{{ volume_snapshot_locations }}"
+  when: item.provider == 'aws'
 
-# - name: "Validate that there is only one aws VSL config"
-#   fail:
-#     msg: "More than one VolumeSnapshotLocations are configured for aws"
-#   when: velero_aws_vsl_configs | int > 1
+- name: "Validate that there is only one aws VSL config"
+  fail:
+    msg: "More than one VolumeSnapshotLocations are configured for aws"
+  when: velero_aws_vsl_configs | int > 1
 
-# - name: "Discover gcp as provider in Volume Snapshot Locations and associate gcp secret name"
-#   set_fact:
-#     velero_gcp_secret_name: "{{ item.credentials_secret_ref.name }}"
-#     velero_gcp_vsl_configs: "{{ velero_gcp_vsl_configs | int + 1 }}"
-#     velero_gcp_vsl: true
-#   loop: "{{ volume_snapshot_locations }}"
-#   when: item.provider == 'gcp'
+- name: "Discover gcp as provider in Volume Snapshot Locations and associate gcp secret name"
+  set_fact:
+    velero_gcp_secret_name: "{{ item.credentials_secret_ref.name }}"
+    velero_gcp_vsl_configs: "{{ velero_gcp_vsl_configs | int + 1 }}"
+    velero_gcp_vsl: true
+  loop: "{{ volume_snapshot_locations }}"
+  when: item.provider == 'gcp'
 
-# - name: "Validate that there is only one gcp VSL config"
-#   fail:
-#     msg: "More than one VolumeSnapshotLocations are configured for gcp"
-#   when: velero_gcp_vsl_configs | int > 1
+- name: "Validate that there is only one gcp VSL config"
+  fail:
+    msg: "More than one VolumeSnapshotLocations are configured for gcp"
+  when: velero_gcp_vsl_configs | int > 1
 
-# - name: "Discover azure as provider in Volume Snapshot Locations and associate azure secret name"
-#   set_fact:
-#     velero_azure_secret_name: "{{ item.credentials_secret_ref.name }}"
-#     velero_azure_vsl_configs: "{{ velero_azure_vsl_configs | int + 1 }}"
-#     velero_azure_vsl: true
-#   loop: "{{ volume_snapshot_locations }}"
-#   when: item.provider == 'azure'
+- name: "Discover azure as provider in Volume Snapshot Locations and associate azure secret name"
+  set_fact:
+    velero_azure_secret_name: "{{ item.credentials_secret_ref.name }}"
+    velero_azure_vsl_configs: "{{ velero_azure_vsl_configs | int + 1 }}"
+    velero_azure_vsl: true
+  loop: "{{ volume_snapshot_locations }}"
+  when: item.provider == 'azure'
 
-# - name: "Validate that there is only one azure VSL config"
-#   fail:
-#     msg: "More than one VolumeSnapshotLocations are configured for azure"
-#   when: velero_azure_vsl_configs | int > 1
\ No newline at end of file
+- name: "Validate that there is only one azure VSL config"
+  fail:
+    msg: "More than one VolumeSnapshotLocations are configured for azure"
+  when: velero_azure_vsl_configs | int > 1
\ No newline at end of file
diff --git a/roles/velero/templates/restic.yml.j2 b/roles/velero/templates/restic.yml.j2
index 451d7cb9ac4..374011888a9 100644
--- a/roles/velero/templates/restic.yml.j2
+++ b/roles/velero/templates/restic.yml.j2
@@ -29,17 +29,17 @@ spec:
         runAsUser: 0
         supplementalGroups: {{ restic_supplemental_groups }}
       volumes:
-{% if 'aws' in default_velero_plugins and velero_aws_bsl %}
+{% if 'aws' in default_velero_plugins and (velero_aws_bsl or velero_aws_vsl) %}
         - name: {{ velero_aws_secret_name }}
           secret:
             secretName: {{ velero_aws_secret_name }}
 {% endif %}
-{% if 'gcp' in default_velero_plugins and velero_gcp_bsl %}
+{% if 'gcp' in default_velero_plugins and (velero_gcp_bsl or velero_gcp_vsl) %}
         - name: {{ velero_gcp_secret_name }}
           secret:
             secretName: {{ velero_gcp_secret_name }}
 {% endif %}
-{% if 'azure' in default_velero_plugins and velero_azure_bsl %}
+{% if 'azure' in default_velero_plugins and (velero_azure_bsl or velero_azure_vsl) %}
         - name: {{ velero_azure_secret_name }}
           secret:
             secretName: {{ velero_azure_secret_name }}
@@ -100,15 +100,15 @@ spec:
             - restic
             - server
           volumeMounts:
-{% if 'aws' in default_velero_plugins and velero_aws_bsl %}
+{% if 'aws' in default_velero_plugins and (velero_aws_bsl or velero_aws_vsl) %}
             - name: {{ velero_aws_secret_name }}
               mountPath: /credentials
 {% endif %}
-{% if 'gcp' in default_velero_plugins and velero_gcp_bsl %}
+{% if 'gcp' in default_velero_plugins and (velero_gcp_bsl or velero_gcp_vsl) %}
             - name: {{ velero_gcp_secret_name }}
               mountPath: /credentials-gcp
 {% endif %}
-{% if 'azure' in default_velero_plugins and velero_azure_bsl %}
+{% if 'azure' in default_velero_plugins and (velero_azure_bsl or velero_azure_vsl) %}
             - name: {{ velero_azure_secret_name }}
               mountPath: /credentials-azure
 {% endif %}
@@ -144,15 +144,15 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.namespace
-{% if 'aws' in default_velero_plugins and velero_aws_bsl %}
+{% if 'aws' in default_velero_plugins and (velero_aws_bsl or velero_aws_vsl) %}
             - name: AWS_SHARED_CREDENTIALS_FILE
               value: /credentials/cloud
 {% endif %}
-{% if 'gcp' in default_velero_plugins and velero_gcp_bsl %}
+{% if 'gcp' in default_velero_plugins and (velero_gcp_bsl or velero_gcp_vsl) %}
             - name: GOOGLE_APPLICATION_CREDENTIALS
               value: /credentials-gcp/cloud
 {% endif %}
-{% if 'azure' in default_velero_plugins and velero_azure_bsl %}
+{% if 'azure' in default_velero_plugins and (velero_azure_bsl or velero_azure_vsl) %}
             - name: AZURE_CREDENTIALS_FILE
               value: /credentials-azure/cloud
 {% endif %}
@@ -174,15 +174,15 @@ spec:
           volumeMounts:
             - name: certs
               mountPath: /certs
-{% if 'aws' in default_velero_plugins and velero_aws_bsl %}
+{% if 'aws' in default_velero_plugins and (velero_aws_bsl or velero_aws_vsl) %}
             - name: {{ velero_aws_secret_name }}
               mountPath: /credentials
 {% endif %}
-{% if 'gcp' in default_velero_plugins and velero_gcp_bsl %}
+{% if 'gcp' in default_velero_plugins and (velero_gcp_bsl or velero_gcp_vsl) %}
             - name: {{ velero_gcp_secret_name }}
               mountPath: /credentials-gcp
 {% endif %}
-{% if 'azure' in default_velero_plugins and velero_azure_bsl %}
+{% if 'azure' in default_velero_plugins and (velero_azure_bsl or velero_azure_vsl) %}
             - name: {{ velero_azure_secret_name }}
               mountPath: /credentials-azure
 {% endif %}
diff --git a/roles/velero/templates/velero.yml.j2 b/roles/velero/templates/velero.yml.j2
index 1890d8e870c..5884ce0ce93 100644
--- a/roles/velero/templates/velero.yml.j2
+++ b/roles/velero/templates/velero.yml.j2
@@ -99,15 +99,15 @@ spec:
             - debug
 {% endif %}
           volumeMounts:
-{% if 'aws' in default_velero_plugins and velero_aws_bsl %}
+{% if 'aws' in default_velero_plugins and (velero_aws_bsl or velero_aws_vsl) %}
             - name: {{ velero_aws_secret_name }}
               mountPath: /credentials
 {% endif %}
-{% if 'gcp' in default_velero_plugins and velero_gcp_bsl %}
+{% if 'gcp' in default_velero_plugins and (velero_gcp_bsl or velero_gcp_vsl) %}
             - name: {{ velero_gcp_secret_name }}
               mountPath: /credentials-gcp
 {% endif %}
-{% if 'azure' in default_velero_plugins and velero_azure_bsl %}
+{% if 'azure' in default_velero_plugins and (velero_azure_bsl or velero_azure_vsl) %}
             - name: {{ velero_azure_secret_name }}
               mountPath: /credentials-azure
 {% endif %}
@@ -120,15 +120,15 @@ spec:
           env:
             - name: LD_LIBRARY_PATH
               value: /plugins
-{% if 'aws' in default_velero_plugins and velero_aws_bsl %}
+{% if 'aws' in default_velero_plugins and (velero_aws_bsl or velero_aws_vsl) %}
             - name: AWS_SHARED_CREDENTIALS_FILE
               value: /credentials/cloud
 {% endif %}
-{% if 'gcp' in default_velero_plugins and velero_gcp_bsl %}
+{% if 'gcp' in default_velero_plugins and (velero_gcp_bsl or velero_gcp_vsl) %}
             - name: GOOGLE_APPLICATION_CREDENTIALS
               value: /credentials-gcp/cloud
 {% endif %}
-{% if 'azure' in default_velero_plugins and velero_azure_bsl %}
+{% if 'azure' in default_velero_plugins and (velero_azure_bsl or velero_azure_vsl) %}
             - name: AZURE_CREDENTIALS_FILE
               value: /credentials-azure/cloud
 {% endif %}
@@ -149,17 +149,17 @@ spec:
               value: {{ no_proxy }}
 {% endif %}
       volumes:
-{% if 'aws' in default_velero_plugins and velero_aws_bsl %}
+{% if 'aws' in default_velero_plugins and (velero_aws_bsl or velero_aws_vsl) %}
         - name: {{ velero_aws_secret_name }}
           secret:
             secretName: {{ velero_aws_secret_name }}
 {% endif %}
-{% if 'gcp' in default_velero_plugins and velero_gcp_bsl %}
+{% if 'gcp' in default_velero_plugins and (velero_gcp_bsl or velero_gcp_vsl) %}
         - name: {{ velero_gcp_secret_name }}
           secret:
             secretName: {{ velero_gcp_secret_name }}
 {% endif %}
-{% if 'azure' in default_velero_plugins and velero_azure_bsl %}
+{% if 'azure' in default_velero_plugins and (velero_azure_bsl or velero_azure_vsl) %}
         - name: {{ velero_azure_secret_name }}
           secret:
             secretName: {{ velero_azure_secret_name }}
@@ -252,15 +252,15 @@ spec:
           volumeMounts:
           - mountPath: /certs
             name: certs
-{% if 'aws' in default_velero_plugins and velero_aws_bsl %}
+{% if 'aws' in default_velero_plugins and (velero_aws_bsl or velero_aws_vsl) %}
           - mountPath: /credentials
             name: {{ velero_aws_secret_name }}
 {% endif %}
-{% if 'gcp' in default_velero_plugins and velero_gcp_bsl %}
+{% if 'gcp' in default_velero_plugins and (velero_gcp_bsl or velero_gcp_vsl) %}
           - name: {{ velero_gcp_secret_name }}
             mountPath: /credentials-gcp
 {% endif %}
-{% if 'azure' in default_velero_plugins and velero_azure_bsl %}
+{% if 'azure' in default_velero_plugins and (velero_azure_bsl or velero_azure_vsl) %}
           - name: {{ velero_azure_secret_name }}
             mountPath: /credentials-azure
 {% endif %}

From e3e48df358730701d18c7c374a8850b862f26401 Mon Sep 17 00:00:00 2001
From: Shubham Dilip Pampattiwar <shubhampampattiwar7@gmail.com>
Date: Tue, 6 Jul 2021 16:09:17 -0400
Subject: [PATCH 4/5] update default CR and docs

---
 README.md                                                    | 2 +-
 deploy/crds/konveyor.openshift.io_v1alpha1_velero_cr.yaml    | 5 +++--
 .../oadp-operator.v0.2.6.clusterserviceversion.yaml          | 4 ++++
 docs/bsl_and_vsl.md                                          | 5 ++++-
 4 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index af656dc58ca..a3bd0f48c38 100644
--- a/README.md
+++ b/README.md
@@ -104,7 +104,7 @@ To install OADP operator and the essential Velero components follow the steps gi
   ```
   oc project oadp-operator
   ```
-- Create secret for the cloud provider credentials to be used. Also, the credentials file present at `CREDENTIALS_FILE_PATH` shoud be in proper format, for instance if the provider is AWS it should follow this AWS credentials [template](https://github.com/konveyor/velero-examples/blob/master/velero-install/aws-credentials)
+- Create secret for the cloud provider credentials to be used. Also, the credentials file present at `CREDENTIALS_FILE_PATH` shoud be in proper format, for instance if the provider is AWS it should follow this AWS credentials [template](https://github.com/konveyor/velero-examples/blob/master/velero-install/aws-credentials). Also, not that if you have different cloud providers for `BackupStorageLocation` and `VolumeSnapshotLocation`, make sure you create secrets for each of these cloud providers.
   ```
   oc create secret generic <SECRET_NAME> --namespace oadp-operator --from-file cloud=<CREDENTIALS_FILE_PATH>
   ```
diff --git a/deploy/crds/konveyor.openshift.io_v1alpha1_velero_cr.yaml b/deploy/crds/konveyor.openshift.io_v1alpha1_velero_cr.yaml
index bacc2341d98..d8b4de51310 100644
--- a/deploy/crds/konveyor.openshift.io_v1alpha1_velero_cr.yaml
+++ b/deploy/crds/konveyor.openshift.io_v1alpha1_velero_cr.yaml
@@ -7,7 +7,6 @@ spec:
   default_velero_plugins:
   - aws
   - openshift
-  - csi
   backup_storage_locations:
   - name: default
     provider: aws
@@ -26,5 +25,7 @@ spec:
     config:
       region: us-west-2
       profile: "default"
+    credentials_secret_ref:
+      name: cloud-credentials
+      namespace: oadp-operator
   enable_restic: true
-  velero_feature_flags: EnableCSI
diff --git a/deploy/olm-catalog/bundle/manifests/oadp-operator.v0.2.6.clusterserviceversion.yaml b/deploy/olm-catalog/bundle/manifests/oadp-operator.v0.2.6.clusterserviceversion.yaml
index 022af3c2c3a..621546913f2 100644
--- a/deploy/olm-catalog/bundle/manifests/oadp-operator.v0.2.6.clusterserviceversion.yaml
+++ b/deploy/olm-catalog/bundle/manifests/oadp-operator.v0.2.6.clusterserviceversion.yaml
@@ -56,6 +56,10 @@ metadata:
                   "profile": "default",
                   "region": "us-west-1"
                 },
+                "credentials_secret_ref": {
+                  "name": "cloud-credentials",
+                  "namespace": "oadp-operator"
+                },
                 "name": "default",
                 "provider": "aws"
               }
diff --git a/docs/bsl_and_vsl.md b/docs/bsl_and_vsl.md
index 87e1ca7838f..f6d6452b2c5 100644
--- a/docs/bsl_and_vsl.md
+++ b/docs/bsl_and_vsl.md
@@ -34,9 +34,12 @@ spec:
     config:
       region: us-west-2
       profile: "default"
+    credentials_secret_ref:
+      name: cloud-credentials
+      namespace: oadp-operator
 ```
 <b>Note:</b> 
-- Be sure to use the same `secret` name you used while creating the cloud credentials secret in step 3 of Operator   installation section.
+- Be sure to use the same `secret` name you used while creating the cloud credentials secret in step 3 of Operator installation section.
 - Another thing to consider are the CR file specs, they should be tailored in accordance to your own cloud provider accounts, for instance `bucket` spec value should be according to your own bucket name and so on.
 - Do not configure more than one `backupStorageLocations` per cloud provider, the velero installation will fail.
 - bsl/vsl parameters in the OADP Velero CR must be specified using `snake_case` rather than `camelCase`.

From e5569179286bcfae47eb25ecb7fe9e628dc489ba Mon Sep 17 00:00:00 2001
From: Shubham Dilip Pampattiwar <shubhampampattiwar7@gmail.com>
Date: Fri, 23 Jul 2021 14:27:13 -0400
Subject: [PATCH 5/5] minor updates

---
 .../konveyor.openshift.io_v1alpha1_velero_cr.yaml    |  1 +
 roles/velero/defaults/main.yml                       | 12 ------------
 roles/velero/vars/main.yml                           |  6 ++++++
 3 files changed, 7 insertions(+), 12 deletions(-)

diff --git a/deploy/crds/konveyor.openshift.io_v1alpha1_velero_cr.yaml b/deploy/crds/konveyor.openshift.io_v1alpha1_velero_cr.yaml
index d8b4de51310..cbae1c36d95 100644
--- a/deploy/crds/konveyor.openshift.io_v1alpha1_velero_cr.yaml
+++ b/deploy/crds/konveyor.openshift.io_v1alpha1_velero_cr.yaml
@@ -7,6 +7,7 @@ spec:
   default_velero_plugins:
   - aws
   - openshift
+  - csi
   backup_storage_locations:
   - name: default
     provider: aws
diff --git a/roles/velero/defaults/main.yml b/roles/velero/defaults/main.yml
index 821d40d20e0..d358254569a 100644
--- a/roles/velero/defaults/main.yml
+++ b/roles/velero/defaults/main.yml
@@ -9,21 +9,9 @@ registry: "{{ lookup( 'env', 'REGISTRY') }}"
 project: "{{ lookup( 'env', 'PROJECT') }}"
 velero_namespace: "{{ lookup( 'env', 'WATCH_NAMESPACE') | default('oadp-operator') }}"
 velero_state: "present"
-velero_aws_bsl_configs: 0
-velero_gcp_bsl_configs: 0
-velero_azure_bsl_configs: 0
-velero_aws_vsl_configs: 0
-velero_gcp_vsl_configs: 0
-velero_azure_vsl_configs: 0
 velero_aws_secret_name: cloud-credentials
 velero_gcp_secret_name: gcp-cloud-credentials
 velero_azure_secret_name: azure-cloud-credentials
-velero_aws_bsl: false
-velero_gcp_bsl: false
-velero_azure_bsl: false
-velero_aws_vsl: false
-velero_gcp_vsl: false
-velero_azure_vsl: false
 velero_debug: false
 velero_upstream_project: velero
 velero_vsphere_upstream_project: vsphereveleroplugin
diff --git a/roles/velero/vars/main.yml b/roles/velero/vars/main.yml
index 8f1533e9960..91c2d414aef 100644
--- a/roles/velero/vars/main.yml
+++ b/roles/velero/vars/main.yml
@@ -1,2 +1,8 @@
 ---
 # vars file for velero
+velero_aws_bsl_configs: 0
+velero_gcp_bsl_configs: 0
+velero_azure_bsl_configs: 0
+velero_aws_vsl_configs: 0
+velero_gcp_vsl_configs: 0
+velero_azure_vsl_configs: 0
\ No newline at end of file