Auth issues when deploying with helm chart

[mgcrea]

I have trouble understanding how auth should be configured when deploying with a helm chart. Especially what is the proper format for the velero-crendentials secret.

So far I created a clouds.yaml that is deployed as as a velero-credentials secret:

clouds:
  ovh:
    region_name: GRA7
    auth:
      auth_url: https://auth.cloud.ovh.net/v3
      tenant_id: XXX
      tenant_name: 'XXX'
      username: 'user-XXX'
      password: 'XXX'
      allow_reauth: true

So my secret looks likes this:

data:
  clouds.yaml: >-
    Y2xvdWRzOgoXXXXX

But encountering failed to authenticate against Openstack: unable to load clouds.yaml: no clouds.yml file found: file does not exist.

Thanks!

[Lirt]

Hi @mgcrea

Thank you for reaching here. In your case you should create BSL like this:

---
apiVersion: velero.io/v1
kind: BackupStorageLocation
metadata:
  name: ovh-gra7
  namespace: velero
spec:
  accessMode: ReadWrite
  config:
    cloud: ovh
    # optional region
    region: GRA7
  default: false
  objectStorage:
    bucket: <BUCKET_NAME>
  provider: community.openstack.org/openstack

Then the clouds.yaml file must be mounted as a volume to /etc/openstack/clouds.yaml (this is default location where it's read from) from Secret. Here is what I use in values.yaml.

extraVolumes:
- name: cloud-config-velero
  secret:
    secretName: cloud-config-velero
    items:
    - key: clouds.yaml
      path: clouds.yaml
extraVolumeMounts:
- name: cloud-config-velero
  mountPath: /etc/openstack/clouds.yaml
  readOnly: true
  subPath: clouds.yaml

And secret needs to contain the key clouds.yaml because of items/key/path/subPath I used above.

---
apiVersion: v1
kind: Secret
metadata:
  name: cloud-config-velero
  namespace: velero
stringData:
  clouds.yaml: |
    clouds:
      my-cloud:
        region_name: GRA7
        auth:
          auth_url: ...
          username: ...
          password: ...
          project_name: ...
          project_domain_name: ..
          user_domain_name: ...

It's just example, so please check it carefully and update based on your config. I hope I didn't paste some mistake here but that should work.

I think secret can also be created using the helm chart - see this secret.yaml, but you need to try yourself to achieve proper structure.

Note: Not sure if you need to specify GRA7 both in BSL and secret. I will check it later, but most likely you only need to do it in one place.

[Lirt]

Closing as no reply was given