Skip to content

Commit 3048c13

Browse files
shdeshpa07shdeshpa07
authored
Merge pull request #99533 from shdeshpa07/azure-auth-bug-fix
[enterprise-4.18] azure auth bug fix
2 parents 0f586ee + d23cbb8 commit 3048c13

5 files changed

Lines changed: 129 additions & 13 deletions

File tree

‎backup_and_restore/application_backup_and_restore/installing/installing-oadp-azure.adoc‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17,24 +17,21 @@ You configure Azure for Velero, create a default `Secret`, and then install the
1717

1818
To install the OADP Operator in a restricted network environment, you must first disable the default OperatorHub sources and mirror the Operator catalog. See xref:../../../disconnected/using-olm.adoc#olm-restricted-networks[Using Operator Lifecycle Manager in disconnected environments] for details.
1919

20-
// include::modules/oadp-installing-operator.adoc[leveloffset=+1]
20+
2121
include::modules/migration-configuring-azure.adoc[leveloffset=+1]
2222
include::modules/oadp-about-backup-snapshot-locations-secrets.adoc[leveloffset=+1]
23-
include::modules/oadp-creating-default-secret.adoc[leveloffset=+2]
24-
include::modules/oadp-secrets-for-different-credentials.adoc[leveloffset=+2]
25-
26-
[id="configuring-dpa-azure"]
27-
== Configuring the Data Protection Application
23+
include::modules/oadp-auth-azure-methods.adoc[leveloffset=+1]
24+
include::modules/oadp-auth-azure-secret-based.adoc[leveloffset=+1]
2825

2926
You can configure the Data Protection Application by setting Velero resource allocations or enabling self-signed CA certificates.
3027

31-
include::modules/oadp-setting-resource-limits-and-requests.adoc[leveloffset=+2]
28+
include::modules/oadp-setting-resource-limits-and-requests.adoc[leveloffset=+1]
3229

3330
include::snippets/oadp-nodeselector-snippet.adoc[]
3431

3532
For more details, see xref:../../../backup_and_restore/application_backup_and_restore/installing/installing-oadp-azure.adoc#oadp-configuring-node-agents_installing-oadp-azure[Configuring node agents and node labels].
3633

37-
include::modules/oadp-self-signed-certificate.adoc[leveloffset=+2]
34+
include::modules/oadp-self-signed-certificate.adoc[leveloffset=+1]
3835

3936
// include::modules/oadp-installing-dpa-1-2-and-earlier.adoc[leveloffset=+1]
4037
include::modules/oadp-installing-dpa-1-3.adoc[leveloffset=+1]

‎modules/oadp-auth-azure-methods.adoc‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
// Module included in the following assemblies:
2+
3+
// * backup_and_restore/application_backup_and_restore/installing/installing-oadp-azure.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="oadp-auth-azure-methods_{context}"]
7+
= About authenticating OADP with Azure
8+
9+
You can authenticate {oadp-short} with Azure by using the following methods:
10+
11+
* A Velero-specific service principal with secret-based authentication.
12+
* A Velero-specific storage account access key with secret-based authentication.

‎modules/oadp-auth-azure-secret-based.adoc‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
// Module included in the following assemblies:
2+
3+
// * backup_and_restore/application_backup_and_restore/installing/installing-oadp-azure.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="oadp-auth-azure-secret-based_{context}"]
7+
= Using a service principal or a storage account access key
8+
9+
[role="_abstract"]
10+
You create a default `Secret` object and reference it in the backup storage location custom resource. The credentials file for the `Secret` object can contain information about the Azure service principal or a storage account access key.
11+
12+
The default name of the `Secret` is `{credentials}`.
13+
14+
[NOTE]
15+
====
16+
The `DataProtectionApplication` custom resource (CR) requires a default `Secret`. Otherwise, the installation will fail. If the name of the backup location `Secret` is not specified, the default name is used.
17+
18+
If you do not want to use the backup location credentials during the installation, you can create a `Secret` with the default name by using an empty `credentials-velero` file.
19+
====
20+
21+
22+
.Prerequisites
23+
24+
* You have access to the OpenShift cluster as a user with `cluster-admin` privileges.
25+
* You have an Azure subscription with appropriate permissions.
26+
* You have installed {oadp-short}.
27+
* You have configured an object storage for storing the backups.
28+
29+
.Procedure
30+
31+
. Create a `credentials-velero` file for the backup storage location in the appropriate format for your cloud provider.
32+
+
33+
You can use one of the following two methods to authenticate {oadp-short} with Azure.
34+
35+
* Use the service principal with secret-based authentication. See the following example:
36+
+
37+
[source,terminal]
38+
----
39+
AZURE_SUBSCRIPTION_ID=<azure_subscription_id>
40+
AZURE_TENANT_ID=<azure_tenant_id>
41+
AZURE_CLIENT_ID=<azure_client_id>
42+
AZURE_CLIENT_SECRET=<azure_client_secret>
43+
AZURE_RESOURCE_GROUP=<azure_resource_group>
44+
AZURE_CLOUD_NAME=<azure_cloud_name>
45+
----
46+
47+
* Use a storage account access key. See the following example:
48+
+
49+
[source,terminal]
50+
----
51+
AZURE_STORAGE_ACCOUNT_ACCESS_KEY=<azure_storage_account_access_key>
52+
AZURE_SUBSCRIPTION_ID=<azure_subscription_id>
53+
AZURE_RESOURCE_GROUP=<azure_resource_group>
54+
AZURE_CLOUD_NAME=<azure_cloud_name>
55+
----
56+
57+
. Create a `Secret` custom resource (CR) with the default name:
58+
+
59+
[source,terminal,subs="attributes+"]
60+
----
61+
$ oc create secret generic {credentials} -n openshift-adp --from-file cloud=credentials-velero
62+
----
63+
64+
. Reference the `Secret` in the `spec.backupLocations.velero.credential` block of the `DataProtectionApplication` CR when you install the Data Protection Application as shown in the following example:
65+
+
66+
[source,yaml,subs="attributes+"]
67+
----
68+
apiVersion: oadp.openshift.io/v1alpha1
69+
kind: DataProtectionApplication
70+
metadata:
71+
name: <dpa_sample>
72+
namespace: openshift-adp
73+
spec:
74+
...
75+
backupLocations:
76+
- velero:
77+
config:
78+
resourceGroup: <azure_resource_group>
79+
storageAccount: <azure_storage_account_id>
80+
subscriptionId: <azure_subscription_id>
81+
credential:
82+
key: cloud
83+
name: <custom_secret> # <1>
84+
provider: azure
85+
default: true
86+
objectStorage:
87+
bucket: <bucket_name>
88+
prefix: <prefix>
89+
snapshotLocations:
90+
- velero:
91+
config:
92+
resourceGroup: <azure_resource_group>
93+
subscriptionId: <azure_subscription_id>
94+
incremental: "true"
95+
provider: {provider}
96+
----
97+
<1> Backup location `Secret` with custom name.

‎modules/oadp-creating-default-secret.adoc‎

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -48,18 +48,29 @@ aws_secret_access_key=<AWS_SECRET_ACCESS_KEY>
4848
endif::[]
4949
ifdef::installing-oadp-azure[]
5050
+
51-
See the following example:
51+
You can use one of the following two methods to authenticate {oadp-short} with Azure.
52+
53+
* Use the service principal with secret-based authentication. See the following example:
5254
+
5355
[source,terminal]
5456
----
55-
AZURE_SUBSCRIPTION_ID= <azure_subscription_id>
57+
AZURE_SUBSCRIPTION_ID=<azure_subscription_id>
5658
AZURE_TENANT_ID=<azure_tenant_id>
5759
AZURE_CLIENT_ID=<azure_client_id>
5860
AZURE_CLIENT_SECRET=<azure_client_secret>
59-
AZURE_STORAGE_ACCOUNT_ACCESS_KEY=<azure_storage_account_access_key>
6061
AZURE_RESOURCE_GROUP=<azure_resource_group>
6162
AZURE_CLOUD_NAME=<azure_cloud_name>
6263
----
64+
65+
* Use a storage account access key. See the following example:
66+
+
67+
[source,terminal]
68+
----
69+
AZURE_STORAGE_ACCOUNT_ACCESS_KEY=<azure_storage_account_access_key>
70+
AZURE_SUBSCRIPTION_ID=<azure_subscription_id>
71+
AZURE_RESOURCE_GROUP=<azure_resource_group>
72+
AZURE_CLOUD_NAME=<azure_cloud_name>
73+
----
6374
endif::[]
6475
6576
. Create a `Secret` custom resource (CR) with the default name:

‎modules/oadp-installing-dpa-1-3.adoc‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -174,8 +174,7 @@ spec:
174174
config:
175175
resourceGroup: <azure_resource_group> # <8>
176176
storageAccount: <azure_storage_account_id> # <9>
177-
subscriptionId: <azure_subscription_id> # <10>
178-
storageAccountKeyEnvVar: AZURE_STORAGE_ACCOUNT_ACCESS_KEY
177+
subscriptionId: <azure_subscription_id> # <10>
179178
credential:
180179
key: cloud
181180
name: {credentials} # <11>

0 commit comments

Comments
 (0)