Add different cloud provider support between BSL and VSL

README.md

@@ -104,7 +104,7 @@ To install OADP operator and the essential Velero components follow the steps gi
   ```
   oc project oadp-operator
   ```
-- Create secret for the cloud provider credentials to be used. Also, the credentials file present at `CREDENTIALS_FILE_PATH` shoud be in proper format, for instance if the provider is AWS it should follow this AWS credentials [template](https://github.com/konveyor/velero-examples/blob/master/velero-install/aws-credentials)
+- Create secret for the cloud provider credentials to be used. Also, the credentials file present at `CREDENTIALS_FILE_PATH` shoud be in proper format, for instance if the provider is AWS it should follow this AWS credentials [template](https://github.com/konveyor/velero-examples/blob/master/velero-install/aws-credentials). Also, not that if you have different cloud providers for `BackupStorageLocation` and `VolumeSnapshotLocation`, make sure you create secrets for each of these cloud providers.
   ```
   oc create secret generic <SECRET_NAME> --namespace oadp-operator --from-file cloud=<CREDENTIALS_FILE_PATH>
   ```

deploy/crds/konveyor.openshift.io_v1alpha1_velero_cr.yaml

@@ -26,5 +26,7 @@ spec:
     config:
       region: us-west-2
       profile: "default"
+    credentials_secret_ref:
+      name: cloud-credentials
+      namespace: oadp-operator
   enable_restic: true
-  velero_feature_flags: EnableCSI

deploy/olm-catalog/bundle/manifests/oadp-operator.v0.2.6.clusterserviceversion.yaml

@@ -56,6 +56,10 @@ metadata:
                   "profile": "default",
                   "region": "us-west-1"
                 },
+                "credentials_secret_ref": {
+                  "name": "cloud-credentials",
+                  "namespace": "oadp-operator"
+                },
                 "name": "default",
                 "provider": "aws"
               }

docs/bsl_and_vsl.md

@@ -34,9 +34,12 @@ spec:
     config:
       region: us-west-2
       profile: "default"
+    credentials_secret_ref:
+      name: cloud-credentials
+      namespace: oadp-operator
 ```
 <b>Note:</b> 
-- Be sure to use the same `secret` name you used while creating the cloud credentials secret in step 3 of Operator   installation section.
+- Be sure to use the same `secret` name you used while creating the cloud credentials secret in step 3 of Operator installation section.
 - Another thing to consider are the CR file specs, they should be tailored in accordance to your own cloud provider accounts, for instance `bucket` spec value should be according to your own bucket name and so on.
 - Do not configure more than one `backupStorageLocations` per cloud provider, the velero installation will fail.
 - bsl/vsl parameters in the OADP Velero CR must be specified using `snake_case` rather than `camelCase`.

roles/velero/defaults/main.yml

@@ -9,9 +9,6 @@ registry: "{{ lookup( 'env', 'REGISTRY') }}"
 project: "{{ lookup( 'env', 'PROJECT') }}"
 velero_namespace: "{{ lookup( 'env', 'WATCH_NAMESPACE') | default('oadp-operator') }}"
 velero_state: "present"
-velero_aws_bsl_configs: 0
-velero_gcp_bsl_configs: 0
-velero_azure_bsl_configs: 0
 velero_aws_secret_name: cloud-credentials
 velero_gcp_secret_name: gcp-cloud-credentials
 velero_azure_secret_name: azure-cloud-credentials

roles/velero/tasks/main.yml

@@ -17,7 +17,7 @@
 - name: "Check if the AWS credentials secret exists or not"
   fail:
     msg: "AWS credentials secret does not exist, Please create the secret {{ velero_aws_secret_name }} in order to proceed further with Velero installation"
-  when: '"aws" in default_velero_plugins and secret_status.resources | length == 0 and not noobaa'
+  when: '"aws" in default_velero_plugins and secret_status is defined and secret_status.resources | length == 0 and not noobaa and (velero_aws_bsl or velero_aws_vsl)'
 
 - name: "Discover GCP credentials secret"
   k8s_info:
@@ -31,7 +31,7 @@
 - name: "Check if the GCP credentials secret exists or not"
   fail:
     msg: "GCP credentials secret does not exist, Please create the secret {{ velero_gcp_secret_name }} in order to proceed further with velero installation"
-  when: '"gcp" in default_velero_plugins and gcp_secret_status.resources | length == 0 and not noobaa'
+  when: '"gcp" in default_velero_plugins and gcp_secret_status is defined and gcp_secret_status.resources | length == 0 and not noobaa and (velero_gcp_bsl or velero_gcp_vsl)'
 
 - name: "Discover Azure credentials secret"
   k8s_info:
@@ -45,9 +45,9 @@
 - name: "Check if the Azure credentials secret exists or not"
   fail:
     msg: "Azure credentials secret does not exist, Please create the secret {{ velero_azure_secret_name }} in order to proceed further with velero installation"
-  when: '"azure" in default_velero_plugins and azure_secret_status.resources | length == 0 and not noobaa'
+  when: '"azure" in default_velero_plugins and azure_secret_status is defined and azure_secret_status.resources | length == 0 and not noobaa and (velero_azure_bsl or velero_azure_vsl)'
 
-- when: '"aws" in default_velero_plugins and secret_status.resources | length > 0 and not noobaa'
+- when: '"aws" in default_velero_plugins and secret_status is defined and secret_status.resources | length > 0 and not noobaa and velero_aws_bsl'
   block:
   - name: Discover AWS credentials
     k8s_info:

roles/velero/tasks/preflight.yml

@@ -3,6 +3,7 @@
   set_fact:
     velero_aws_secret_name: "{{ item.credentials_secret_ref.name }}"
     velero_aws_bsl_configs: "{{ velero_aws_bsl_configs | int + 1 }}"
+    velero_aws_bsl: true
     aws_bsl_res: "{{ item }}"
   loop: "{{ backup_storage_locations }}"
   when: item.provider == 'aws'
@@ -26,6 +27,7 @@
     velero_gcp_secret_name: "{{ item.credentials_secret_ref.name }}"
     velero_gcp_bsl_configs: "{{ velero_gcp_bsl_configs | int + 1 }}"
     gcp_bsl_res: "{{ item }}"
+    velero_gcp_bsl: true
   loop: "{{ backup_storage_locations }}"
   when: item.provider == 'gcp'
 
@@ -48,6 +50,7 @@
     velero_azure_secret_name: "{{ item.credentials_secret_ref.name }}"
     velero_azure_bsl_configs: "{{ velero_azure_bsl_configs | int + 1 }}"
     azure_bsl_res: "{{ item }}"
+    velero_azure_bsl: true
   loop: "{{ backup_storage_locations }}"
   when: item.provider == 'azure'
 
@@ -64,3 +67,42 @@
     - fail:
         msg: "The provided caCert for azure is not in valid base64 format"
   when: azure_bsl_res.object_storage.ca_cert is defined
+
+- name: "Discover aws as provider in Volume Snapshot Locations and associate aws secret name"
+  set_fact:
+    velero_aws_secret_name: "{{ item.credentials_secret_ref.name }}"
+    velero_aws_vsl_configs: "{{ velero_aws_vsl_configs | int + 1 }}"
+    velero_aws_vsl: true
+  loop: "{{ volume_snapshot_locations }}"
+  when: item.provider == 'aws'
+
+- name: "Validate that there is only one aws VSL config"
+  fail:
+    msg: "More than one VolumeSnapshotLocations are configured for aws"
+  when: velero_aws_vsl_configs | int > 1
+
+- name: "Discover gcp as provider in Volume Snapshot Locations and associate gcp secret name"
+  set_fact:
+    velero_gcp_secret_name: "{{ item.credentials_secret_ref.name }}"
+    velero_gcp_vsl_configs: "{{ velero_gcp_vsl_configs | int + 1 }}"
+    velero_gcp_vsl: true
+  loop: "{{ volume_snapshot_locations }}"
+  when: item.provider == 'gcp'
+
+- name: "Validate that there is only one gcp VSL config"
+  fail:
+    msg: "More than one VolumeSnapshotLocations are configured for gcp"
+  when: velero_gcp_vsl_configs | int > 1
+
+- name: "Discover azure as provider in Volume Snapshot Locations and associate azure secret name"
+  set_fact:
+    velero_azure_secret_name: "{{ item.credentials_secret_ref.name }}"
+    velero_azure_vsl_configs: "{{ velero_azure_vsl_configs | int + 1 }}"
+    velero_azure_vsl: true
+  loop: "{{ volume_snapshot_locations }}"
+  when: item.provider == 'azure'
+
+- name: "Validate that there is only one azure VSL config"
+  fail:
+    msg: "More than one VolumeSnapshotLocations are configured for azure"
+  when: velero_azure_vsl_configs | int > 1

roles/velero/templates/restic.yml.j2

@@ -29,17 +29,17 @@ spec:
         runAsUser: 0
         supplementalGroups: {{ restic_supplemental_groups }}
       volumes:
-{% if 'aws' in default_velero_plugins %}
+{% if 'aws' in default_velero_plugins and (velero_aws_bsl or velero_aws_vsl) %}
         - name: {{ velero_aws_secret_name }}
           secret:
             secretName: {{ velero_aws_secret_name }}
 {% endif %}
-{% if 'gcp' in default_velero_plugins %}
+{% if 'gcp' in default_velero_plugins and (velero_gcp_bsl or velero_gcp_vsl) %}
         - name: {{ velero_gcp_secret_name }}
           secret:
             secretName: {{ velero_gcp_secret_name }}
 {% endif %}
-{% if 'azure' in default_velero_plugins %}
+{% if 'azure' in default_velero_plugins and (velero_azure_bsl or velero_azure_vsl) %}
         - name: {{ velero_azure_secret_name }}
           secret:
             secretName: {{ velero_azure_secret_name }}
@@ -100,15 +100,15 @@ spec:
             - restic
             - server
           volumeMounts:
-{% if 'aws' in default_velero_plugins %}
+{% if 'aws' in default_velero_plugins and (velero_aws_bsl or velero_aws_vsl) %}
             - name: {{ velero_aws_secret_name }}
               mountPath: /credentials
 {% endif %}
-{% if 'gcp' in default_velero_plugins %}
+{% if 'gcp' in default_velero_plugins and (velero_gcp_bsl or velero_gcp_vsl) %}
             - name: {{ velero_gcp_secret_name }}
               mountPath: /credentials-gcp
 {% endif %}
-{% if 'azure' in default_velero_plugins %}
+{% if 'azure' in default_velero_plugins and (velero_azure_bsl or velero_azure_vsl) %}
             - name: {{ velero_azure_secret_name }}
               mountPath: /credentials-azure
 {% endif %}
@@ -144,15 +144,15 @@ spec:
               valueFrom:
                 fieldRef:
                   fieldPath: metadata.namespace
-{% if 'aws' in default_velero_plugins %}
+{% if 'aws' in default_velero_plugins and (velero_aws_bsl or velero_aws_vsl) %}
             - name: AWS_SHARED_CREDENTIALS_FILE
               value: /credentials/cloud
 {% endif %}
-{% if 'gcp' in default_velero_plugins %}
+{% if 'gcp' in default_velero_plugins and (velero_gcp_bsl or velero_gcp_vsl) %}
             - name: GOOGLE_APPLICATION_CREDENTIALS
               value: /credentials-gcp/cloud
 {% endif %}
-{% if 'azure' in default_velero_plugins %}
+{% if 'azure' in default_velero_plugins and (velero_azure_bsl or velero_azure_vsl) %}
             - name: AZURE_CREDENTIALS_FILE
               value: /credentials-azure/cloud
 {% endif %}
@@ -174,8 +174,16 @@ spec:
           volumeMounts:
             - name: certs
               mountPath: /certs
-{% if 'aws' in default_velero_plugins %}
+{% if 'aws' in default_velero_plugins and (velero_aws_bsl or velero_aws_vsl) %}
             - name: {{ velero_aws_secret_name }}
               mountPath: /credentials
 {% endif %}
+{% if 'gcp' in default_velero_plugins and (velero_gcp_bsl or velero_gcp_vsl) %}
+            - name: {{ velero_gcp_secret_name }}
+              mountPath: /credentials-gcp
+{% endif %}
+{% if 'azure' in default_velero_plugins and (velero_azure_bsl or velero_azure_vsl) %}
+            - name: {{ velero_azure_secret_name }}
+              mountPath: /credentials-azure
+{% endif %}
 

roles/velero/templates/velero.yml.j2

@@ -99,15 +99,15 @@ spec:
             - debug
 {% endif %}
           volumeMounts:
-{% if 'aws' in default_velero_plugins %}
+{% if 'aws' in default_velero_plugins and (velero_aws_bsl or velero_aws_vsl) %}
             - name: {{ velero_aws_secret_name }}
               mountPath: /credentials
 {% endif %}
-{% if 'gcp' in default_velero_plugins %}
+{% if 'gcp' in default_velero_plugins and (velero_gcp_bsl or velero_gcp_vsl) %}
             - name: {{ velero_gcp_secret_name }}
               mountPath: /credentials-gcp
 {% endif %}
-{% if 'azure' in default_velero_plugins %}
+{% if 'azure' in default_velero_plugins and (velero_azure_bsl or velero_azure_vsl) %}
             - name: {{ velero_azure_secret_name }}
               mountPath: /credentials-azure
 {% endif %}
@@ -120,15 +120,15 @@ spec:
           env:
             - name: LD_LIBRARY_PATH
               value: /plugins
-{% if 'aws' in default_velero_plugins %}
+{% if 'aws' in default_velero_plugins and (velero_aws_bsl or velero_aws_vsl) %}
             - name: AWS_SHARED_CREDENTIALS_FILE
               value: /credentials/cloud
 {% endif %}
-{% if 'gcp' in default_velero_plugins %}
+{% if 'gcp' in default_velero_plugins and (velero_gcp_bsl or velero_gcp_vsl) %}
             - name: GOOGLE_APPLICATION_CREDENTIALS
               value: /credentials-gcp/cloud
 {% endif %}
-{% if 'azure' in default_velero_plugins %}
+{% if 'azure' in default_velero_plugins and (velero_azure_bsl or velero_azure_vsl) %}
             - name: AZURE_CREDENTIALS_FILE
               value: /credentials-azure/cloud
 {% endif %}
@@ -149,17 +149,17 @@ spec:
               value: {{ no_proxy }}
 {% endif %}
       volumes:
-{% if 'aws' in default_velero_plugins %}
+{% if 'aws' in default_velero_plugins and (velero_aws_bsl or velero_aws_vsl) %}
         - name: {{ velero_aws_secret_name }}
           secret:
             secretName: {{ velero_aws_secret_name }}
 {% endif %}
-{% if 'gcp' in default_velero_plugins %}
+{% if 'gcp' in default_velero_plugins and (velero_gcp_bsl or velero_gcp_vsl) %}
         - name: {{ velero_gcp_secret_name }}
           secret:
             secretName: {{ velero_gcp_secret_name }}
 {% endif %}
-{% if 'azure' in default_velero_plugins %}
+{% if 'azure' in default_velero_plugins and (velero_azure_bsl or velero_azure_vsl) %}
         - name: {{ velero_azure_secret_name }}
           secret:
             secretName: {{ velero_azure_secret_name }}
@@ -252,10 +252,18 @@ spec:
           volumeMounts:
           - mountPath: /certs
             name: certs
-{% if 'aws' in default_velero_plugins %}
+{% if 'aws' in default_velero_plugins and (velero_aws_bsl or velero_aws_vsl) %}
           - mountPath: /credentials
             name: {{ velero_aws_secret_name }}
 {% endif %}
+{% if 'gcp' in default_velero_plugins and (velero_gcp_bsl or velero_gcp_vsl) %}
+          - name: {{ velero_gcp_secret_name }}
+            mountPath: /credentials-gcp
+{% endif %}
+{% if 'azure' in default_velero_plugins and (velero_azure_bsl or velero_azure_vsl) %}
+          - name: {{ velero_azure_secret_name }}
+            mountPath: /credentials-azure
+{% endif %}
 {% for plugin in custom_velero_plugins %}
         - image: {{ plugin.image }}
           imagePullPolicy: "{{ image_pull_policy }}"

roles/velero/vars/main.yml

@@ -1,2 +1,8 @@
 ---
 # vars file for velero
+velero_aws_bsl_configs: 0
+velero_gcp_bsl_configs: 0
+velero_azure_bsl_configs: 0
+velero_aws_vsl_configs: 0
+velero_gcp_vsl_configs: 0
+velero_azure_vsl_configs: 0