Skip to content

Commit b39e31a

Browse files
xenolinuxxenolinux
authored
Merge pull request #84466 from shdeshpa07/OADP-4918-CA-Cert-Use-Case
Use case for self signed ca cert
2 parents c754c89 + dd2a4c7 commit b39e31a

File tree

3 files changed

+290
-0
lines changed

3 files changed

+290
-0
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3499,6 +3499,8 @@ Topics:
34993499
File: oadp-usecase-backup-using-odf
35003500
- Name: Restoring a backup to a different namespace
35013501
File: oadp-usecase-restore-different-namespace
3502+
- Name: Including a self-signed CA certificate during backup
3503+
File: oadp-usecase-enable-ca-cert
35023504
- Name: Installing and configuring OADP
35033505
Dir: installing
35043506
Topics:

‎backup_and_restore/application_backup_and_restore/oadp-use-cases/oadp-usecase-enable-ca-cert.adoc

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="oadp-use-case-enable-ca-cert"]
3+
= Including a self-signed CA certificate during backup
4+
include::_attributes/common-attributes.adoc[]
5+
:context: oadp-use-case-enable-ca-cert
6+
7+
toc::[]
8+
9+
You can include a self-signed Certificate Authority (CA) certificate in the Data Protection Application (DPA) and then back up an application. You store the backup in a NooBaa bucket provided by {odf-first}.
10+
11+
// include a CA cert and run a backup
12+
include::modules/oadp-usecase-include-ca-cert-backup.adoc[leveloffset=+1]

‎modules/oadp-usecase-include-ca-cert-backup.adoc

Lines changed: 276 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,276 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * backup_and_restore/application_backup_and_restore/oadp-use-cases/oadp-usecase-enable-ca-cert.adoc
4+
5+
:_mod-docs-content-type: PROCEDURE
6+
[id="oadp-usecase-include-ca-cert-backup_{context}"]
7+
= Backing up an application and its self-signed CA certificate
8+
9+
The `s3.openshift-storage.svc` service, provided by {odf-short}, uses a Transport Layer Security protocol (TLS) certificate that is signed with the self-signed service CA.
10+
11+
To prevent a `certificate signed by unknown authority` error, you must include a self-signed CA certificate in the backup storage location (BSL) section of `DataProtectionApplication` custom resource (CR). For this situation, you must complete the following tasks:
12+
13+
* Request a NooBaa bucket by creating an object bucket claim (OBC).
14+
* Extract the bucket details.
15+
* Include a self-signed CA certificate in the `DataProtectionApplication` CR.
16+
* Back up an application.
17+
18+
19+
.Prerequisites
20+
21+
* You installed the {oadp-short} Operator.
22+
* You installed the {odf-short} Operator.
23+
* You have an application with a database running in a separate namespace.
24+
25+
.Procedure
26+
27+
. Create an OBC manifest to request a NooBaa bucket as shown in the following example:
28+
+
29+
.Example `ObjectBucketClaim` CR
30+
[source,yaml]
31+
----
32+
apiVersion: objectbucket.io/v1alpha1
33+
kind: ObjectBucketClaim
34+
metadata:
35+
name: test-obc # <1>
36+
namespace: openshift-adp
37+
spec:
38+
storageClassName: openshift-storage.noobaa.io
39+
generateBucketName: test-backup-bucket # <2>
40+
----
41+
<1> Specifies the name of the object bucket claim.
42+
<2> Specifies the name of the bucket.
43+
44+
. Create the OBC by running the following command:
45+
+
46+
[source,terminal]
47+
----
48+
$ oc create -f <obc_file_name>
49+
----
50+
51+
. When you create an OBC, {odf-short} creates a `secret` and a `ConfigMap` with the same name as the object bucket claim. The `secret` object contains the bucket credentials, and the `ConfigMap` object contains information to access the bucket. To get the bucket name and bucket host from the generated config map, run the following command:
52+
+
53+
[source,terminal]
54+
----
55+
$ oc extract --to=- cm/test-obc # <1>
56+
----
57+
<1> The name of the OBC is `test-obc`.
58+
+
59+
.Example output
60+
[source,terminal]
61+
----
62+
# BUCKET_NAME
63+
backup-c20...41fd
64+
# BUCKET_PORT
65+
443
66+
# BUCKET_REGION
67+
68+
# BUCKET_SUBREGION
69+
70+
# BUCKET_HOST
71+
s3.openshift-storage.svc
72+
----
73+
74+
. To get the bucket credentials from the `secret` object , run the following command:
75+
+
76+
[source,terminal]
77+
----
78+
$ oc extract --to=- secret/test-obc
79+
----
80+
+
81+
.Example output
82+
[source,terminal]
83+
----
84+
# AWS_ACCESS_KEY_ID
85+
ebYR....xLNMc
86+
# AWS_SECRET_ACCESS_KEY
87+
YXf...+NaCkdyC3QPym
88+
----
89+
90+
. Create a `cloud-credentials` file with the object bucket credentials by using the following example configuration:
91+
+
92+
[source,terminal]
93+
----
94+
[default]
95+
aws_access_key_id=<AWS_ACCESS_KEY_ID>
96+
aws_secret_access_key=<AWS_SECRET_ACCESS_KEY>
97+
----
98+
99+
. Create the `cloud-credentials` secret with the `cloud-credentials` file content by running the following command:
100+
+
101+
[source,terminal]
102+
----
103+
$ oc create secret generic \
104+
cloud-credentials \
105+
-n openshift-adp \
106+
--from-file cloud=cloud-credentials
107+
----
108+
109+
. Extract the service CA certificate from the `openshift-service-ca.crt` config map by running the following command. Ensure that you encode the certificate in `Base64` format and note the value to use in the next step.
110+
+
111+
[source,terminal]
112+
----
113+
$ oc get cm/openshift-service-ca.crt \
114+
-o jsonpath='{.data.service-ca\.crt}' | base64 -w0; echo
115+
----
116+
+
117+
.Example output
118+
+
119+
[source,terminal]
120+
----
121+
LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0...
122+
....gpwOHMwaG9CRmk5a3....FLS0tLS0K
123+
----
124+
125+
. Configure the `DataProtectionApplication` CR manifest file with the bucket name and CA certificate as shown in the following example:
126+
+
127+
.Example `DataProtectionApplication` CR
128+
[source,yaml]
129+
----
130+
apiVersion: oadp.openshift.io/v1alpha1
131+
kind: DataProtectionApplication
132+
metadata:
133+
name: oadp-backup
134+
namespace: openshift-adp
135+
spec:
136+
configuration:
137+
nodeAgent:
138+
enable: true
139+
uploaderType: kopia
140+
velero:
141+
defaultPlugins:
142+
- aws
143+
- openshift
144+
- csi
145+
defaultSnapshotMoveData: true
146+
backupLocations:
147+
- velero:
148+
config:
149+
profile: "default"
150+
region: noobaa
151+
s3Url: https://s3.openshift-storage.svc
152+
s3ForcePathStyle: "true"
153+
insecureSkipTLSVerify: "false" # <1>
154+
provider: aws
155+
default: true
156+
credential:
157+
key: cloud
158+
name: cloud-credentials
159+
objectStorage:
160+
bucket: <bucket_name> # <2>
161+
prefix: oadp
162+
caCert: <ca_cert> # <3>
163+
----
164+
<1> The `insecureSkipTLSVerify` flag can be set to either `true` or `false`. If set to "true", SSL/TLS security is disabled. If set to `false`, SSL/TLS security is enabled.
165+
<2> Specify the name of the bucket extracted in an earlier step.
166+
<3> Copy and paste the `Base64` encoded certificate from the previous step.
167+
168+
. Create the `DataProtectionApplication` CR by running the following command:
169+
+
170+
[source,terminal]
171+
----
172+
$ oc apply -f <dpa_filename>
173+
----
174+
175+
. Verify that the `DataProtectionApplication` CR is created successfully by running the following command:
176+
+
177+
[source,terminal]
178+
----
179+
$ oc get dpa -o yaml
180+
----
181+
+
182+
.Example output
183+
+
184+
[source,yaml]
185+
----
186+
apiVersion: v1
187+
items:
188+
- apiVersion: oadp.openshift.io/v1alpha1
189+
kind: DataProtectionApplication
190+
metadata:
191+
namespace: openshift-adp
192+
#...#
193+
spec:
194+
backupLocations:
195+
- velero:
196+
config:
197+
#...#
198+
status:
199+
conditions:
200+
- lastTransitionTime: "20....9:54:02Z"
201+
message: Reconcile complete
202+
reason: Complete
203+
status: "True"
204+
type: Reconciled
205+
kind: List
206+
metadata:
207+
resourceVersion: ""
208+
----
209+
210+
. Verify that the backup storage location (BSL) is available by running the following command:
211+
+
212+
[source,terminal]
213+
----
214+
$ oc get bsl -n openshift-adp
215+
----
216+
+
217+
.Example output
218+
[source,terminal]
219+
----
220+
NAME PHASE LAST VALIDATED AGE DEFAULT
221+
dpa-sample-1 Available 3s 15s true
222+
----
223+
224+
. Configure the `Backup` CR by using the following example:
225+
+
226+
.Example `Backup` CR
227+
[source,yaml]
228+
----
229+
apiVersion: velero.io/v1
230+
kind: Backup
231+
metadata:
232+
name: test-backup
233+
namespace: openshift-adp
234+
spec:
235+
includedNamespaces:
236+
- <application_namespace> # <1>
237+
----
238+
<1> Specify the namespace for the application to back up.
239+
240+
. Create the `Backup` CR by running the following command:
241+
+
242+
[source,terminal]
243+
----
244+
$ oc apply -f <backup_cr_filename>
245+
----
246+
247+
.Verification
248+
249+
* Verify that the `Backup` object is in the `Completed` phase by running the following command:
250+
+
251+
[source,terminal]
252+
----
253+
$ oc describe backup test-backup -n openshift-adp
254+
----
255+
+
256+
.Example output
257+
[source,terminal]
258+
----
259+
Name: test-backup
260+
Namespace: openshift-adp
261+
# ....#
262+
Status:
263+
Backup Item Operations Attempted: 1
264+
Backup Item Operations Completed: 1
265+
Completion Timestamp: 2024-09-25T10:17:01Z
266+
Expiration: 2024-10-25T10:16:31Z
267+
Format Version: 1.1.0
268+
Hook Status:
269+
Phase: Completed
270+
Progress:
271+
Items Backed Up: 34
272+
Total Items: 34
273+
Start Timestamp: 2024-09-25T10:16:31Z
274+
Version: 1
275+
Events: <none>
276+
----

0 commit comments

Comments
 (0)