Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

podLabels for DataUpload pods #627

Open
noltedennis opened this issue Nov 14, 2024 · 0 comments
Open

podLabels for DataUpload pods #627

noltedennis opened this issue Nov 14, 2024 · 0 comments

Comments

@noltedennis
Copy link

noltedennis commented Nov 14, 2024

What steps did you take and what happened:
On AKS, we backup persistent volumes backed by Azure Disk via CSI snapshot data movement.
Authentication against the object storage (Azure blob) used to upload backup metadata and CSI snapshot data is performed via Workload Identity.

Starting with HELM chart version 8.0.0 (i.e. Velero 1.15) the data upload jobs, to my understanding, were moved outside of the node agent into dedicated pods. These pods, however, do not inherit the podLabels set via this HELM chart's values.yml file.

Azure Workload identity requires the label azure.workload.identity/use: "true" to be set such that the pod can source the client id from the service account.
As a consequence, authentication against Azure blob fails and the data upload cannot be completed.

What did you expect to happen:

The CSI snapshot is restored into a temporary PVC and uploaded towards Azure Blob.

The output of the following commands will help us better understand what's going on:
(Pasting long output into a GitHub gist or other pastebin is fine.)

Anything else you would like to add:

Environment:

  • helm version (use helm version):
  • helm chart version and app version (use helm list -n <YOUR NAMESPACE>):
  • Kubernetes version (use kubectl version): 1.29.x
  • Kubernetes installer & version:
  • Cloud provider or hardware configuration:
  • OS (e.g. from /etc/os-release):
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant