OADP-6235: Add CaCert support for DPT

[shubham-pampattiwar]

Why the changes were made

This PR adds CA certificate support for Data Protection Tests (DPT) to enable secure connections to object storage backends that use custom or self-signed certificates. This enhancement allows DPT to work with enterprise environments and private cloud deployments where object storage services use custom certificate authorities, addressing scenarios where the default system certificate store doesn't contain the required CA certificates.

The changes implement a flexible TLS configuration system that respects user preferences while maintaining security by:

• Supporting custom CA certificates from Backup Storage Location (BSL) specifications
• Allowing TLS verification bypass when explicitly configured

How to test the changes made

1. Test with skipTLSVerify enabled:

  apiVersion: oadp.openshift.io/v1alpha1
  kind: DataProtectionTest
  metadata:
    name: dpt-skip-tls
  spec:
    skipTLSVerify: true
    backupLocationSpec:
      provider: aws
      objectStorage:
        bucket: test-bucket

2. Test with custom CA certificate:

  apiVersion: oadp.openshift.io/v1alpha1
  kind: DataProtectionTest
  metadata:
    name: dpt-custom-ca
  spec:
    skipTLSVerify: false
    backupLocationSpec:
      provider: aws
      objectStorage:
        bucket: test-bucket
        caCert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0t...  # Base64-encoded PEM certificate

3. Verify TLS configuration priority:
   - When skipTLSVerify: true is set, it takes precedence over any CA certificate configuration
   - When CA certificate is provided without skipTLSVerify, the custom certificate is used

🤖 Generated with https://claude.ai/code

Co-Authored-By: Claude [email protected]

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci-robot]

@shubham-pampattiwar: This pull request references OADP-6235 which is a valid jira issue.

In response to this:

Why the changes were made

This PR adds CA certificate support for Data Protection Tests (DPT) to enable secure connections to object storage backends that use custom or self-signed certificates. This enhancement allows DPT to work with enterprise environments and private cloud deployments where object storage services use custom certificate authorities, addressing scenarios where the default system certificate store doesn't contain the required CA certificates.

The changes implement a flexible TLS configuration system that respects user preferences while maintaining security by:

• Supporting custom CA certificates from Backup Storage Location (BSL) specifications
• Allowing TLS verification bypass when explicitly configured

How to test the changes made

1. Test with skipTLSVerify enabled:

 apiVersion: oadp.openshift.io/v1alpha1
 kind: DataProtectionTest
 metadata:
   name: dpt-skip-tls
 spec:
   skipTLSVerify: true
   backupLocationSpec:
     provider: aws
     objectStorage:
       bucket: test-bucket

2. Test with custom CA certificate:

 apiVersion: oadp.openshift.io/v1alpha1
 kind: DataProtectionTest
 metadata:
   name: dpt-custom-ca
 spec:
   skipTLSVerify: false
   backupLocationSpec:
     provider: aws
     objectStorage:
       bucket: test-bucket
       caCert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0t...  # Base64-encoded PEM certificate

3. Verify TLS configuration priority:

• When skipTLSVerify: true is set, it takes precedence over any CA certificate configuration
• When CA certificate is provided without skipTLSVerify, the custom certificate is used

🤖 Generated with https://claude.ai/code

Co-Authored-By: Claude [email protected]

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[shubham-pampattiwar]

/cherry-pick oadp-1.5

[openshift-cherrypick-robot]

@shubham-pampattiwar: once the present PR merges, I will cherry-pick it on top of oadp-1.5 in a new PR and assign it to you.

In response to this:

/cherry-pick oadp-1.5

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[shubham-pampattiwar]

✅ Dev Testing Results - CA Certificate Support for DPT

Successfully tested the CA certificate functionality for DataProtectionTest with MinIO using custom TLS certificates.

Test Environment

• Target: MinIO S3 with self-signed certificates
• BSL: minio-bsl with custom caCert configured
• Test File: 50MB upload test

BackupStorageLocation Configuration

apiVersion: velero.io/v1
kind: BackupStorageLocation
metadata:
  name: minio-bsl
  namespace: openshift-adp
spec:
  config:
    region: minio
    s3ForcePathStyle: "true"
    s3Url: https://minio-s3-minio.apps.mtvoadpvgs.rhos-psi.cnv-qe.rhood.us
  credential:
    key: cloud
    name: cloud-credentials-minio
  objectStorage:
    bucket: dpt-minio-test
    caCert: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0t... # [REDACTED - Base64 encoded CA cert]
    prefix: velero
  provider: aws
status:
  lastSyncedTime: "2025-08-05T20:32:47Z"
  lastValidationTime: "2025-08-05T20:32:57Z"
  phase: Available

Test Results

✅ Test 1: With TLS Verification Enabled (skipTLSVerify: false)

DPT Spec:

spec:
  backupLocationName: minio-bsl
  forceRun: false
  skipTLSVerify: false
  uploadSpeedTestConfig:
    fileSize: 50MB
    timeout: 90s

DPT Status:

status:
  bucketMetadata:
    encryptionAlgorithm: None
    versioningStatus: None
  lastTested: "2025-08-05T20:29:16Z"
  phase: Complete
  s3Vendor: MinIO
  uploadTest:
    duration: 453ms
    speedMbps: 925
    success: true

Result Summary:

$ oc get dpt
NAME            PHASE      UPLOADSPEED(MBPS)   ENCRYPTION   VERSIONING
dpt-minio-test  Complete   925                 None         None

✅ Test 2: With TLS Verification Disabled (skipTLSVerify: true)

DPT Spec:

spec:
  backupLocationName: minio-bsl
  forceRun: false
  skipTLSVerify: true
  uploadSpeedTestConfig:
    fileSize: 50MB
    timeout: 90s

DPT Status:

status:
  bucketMetadata:
    encryptionAlgorithm: None
    versioningStatus: None
  lastTested: "2025-08-05T20:32:08Z"
  phase: Complete
  s3Vendor: MinIO
  uploadTest:
    duration: 379ms
    speedMbps: 1104
    success: true

Result Summary:

$ oc get dpt
NAME            PHASE      UPLOADSPEED(MBPS)   ENCRYPTION   VERSIONING
dpt-minio-test  Complete   1104                None         None

✅ BSL Validation

$ oc get bsl
NAME       PHASE      LAST VALIDATED   DEFAULT
minio-bsl  Available  12s             true

Key Validation Points

• CA Certificate Integration: DPT successfully uses custom CA cert from BSL objectStorage.caCert field
• TLS Validation: Proper certificate validation without requiring skipTLSVerify
• Performance: Consistent high-speed uploads (900+ Mbps) in both modes
• S3 Vendor Detection: Correctly identifies MinIO backend
• Bucket Metadata: Successfully retrieves encryption and versioning information
• BSL Compatibility: BSL remains Available and functional with CA cert configuration

Conclusion

The CA certificate support is working as expected. DPT can now validate TLS connections to S3-compatible storage using custom certificates, eliminating the need for skipTLSVerify: true in secure environments.

[kaovilai]

Just my opinion non blockers

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kaovilai, shubham-pampattiwar

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [kaovilai,shubham-pampattiwar]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@shubham-pampattiwar: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.