Velero Kopia Integration - Don't support Self-signed Certificate for S3 Compatible Storage

[Lyndon-Li]

Some S3 compatible storage provides secure connection with self-signed certificate.
The Restic path supports this already since restic accepts a flag in all its related CLIs, so that the caller could provides a certificate file.
However, the Kopia path doesn't support this at present, because the backend Kopia repository doesn't accept a certificate file. There is a Kopia issue kopia/kopia#1443.

We will mark this as a limitation in Velero for now. When Kopia fix the above issue, we will be able to fix this limitation with minor code change to Velero.

[reasonerjt]

Thanks @Lyndon-Li
Let's make sure this is documented in the release note.

[vrabbi]

Couldnt this be solved by mounting the certificate into the ca store on the container via a secret?

[Lyndon-Li]

@vrabbi The problem is there is no way to tell Kopia to search a certificate outside of the system's CA store. On the other hand, there is not an easy way to make a certificate into the system's CA store without changing the docker image.

[blackpiglet]

Remove from v1.10 due to limitation.

[babs]

I have a PR'd an attempt to solve this issue: kopia/kopia#2845

[Lyndon-Li]

@babs Thanks for letting us know, we will track the issue and PR.

[reasonerjt]

Let's bump up Kopia to fix this issue in v1.12 timeframe.

[babs]

@reasonerjt Kopia 0.13 including the fix is in RC phase, couldn't it be integrated in 1.11 if kopia goes stable before ?

[Lyndon-Li]

@babs
We are not planning to back porting the kopia bump to Velero v1.10 and v1.11.
The primary reason is that bumping up kopia involves upgrading some of other dependencies of Velero, which conflict with the current version of controller-gen tool(v0.7) used by Velero, specifically, the tool keeps crashing after upgrading the dependencies due to this known issue.
On the other side, upgrade the controller-gen tool will change the content of CRDs generated and we think it is risky to do this in a patch release.

[Lyndon-Li]

Fixed by #6268

[babs]

Good news, thanks!