Description of problem:

Following DPA spec with caCert should use provided caCert to communicate with s3 for imagestream backup.

spec:
  backupLocations:
  - velero:
      objectStorage:
        caCert: <base64-of-caCert>

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1.
2.
3.

Actual results:

Expected results:

Additional info:

Tiger's Notes:

Two solutions

• PR to openshift/docker-distribution and distribution/distribution such that s3 driver code accepts CustomCABundle option.
  • Cleaner result, can accept updated BSL's customca without restarting velero pod
• Set ENV in velero pod AWS_CA_BUNDLE by OADP Operator
  • Less changes, faster to implement, may require pod restart for new ENV to take effect, and will require that CACert be specified in DPA, and won't work for BSL outside DPA.

References

• Environment variables to configure the AWS CLI - AWS Command Line Interface (amazon.com)
• Command line options - AWS Command Line Interface (amazon.com)
• Code search results (github.com)