Implement caCertRef support for BackupStorageLocation ObjectStorage

[coderabbitai]

Background

The upstream Velero project added support for caCertRef in PR velero-io/velero#9141, which allows referencing a Secret containing the CA certificate bundle instead of embedding it directly in the caCert field.

Current State

In PR #2096, the caCertRef field was added to the CRD manifests:

• bundle/manifests/oadp.openshift.io_dataprotectionapplications.yaml
• config/crd/bases/oadp.openshift.io_dataprotectionapplications.yaml
• bundle/manifests/oadp.openshift.io_dataprotectiontests.yaml
• config/crd/bases/oadp.openshift.io_dataprotectiontests.yaml

However, the OADP controller does not yet implement support for this field. The controller only handles the CACert byte array field in:

• Go type: api/v1alpha1/dataprotectionapplication_types.go (ObjectStorageLocation struct)
• Controller: internal/controller/bsl.go

This means if users set caCertRef, it will be silently ignored, potentially leading to broken TLS verification.

Required Implementation

To properly support caCertRef, we need to:

1. Update Go types (api/v1alpha1/dataprotectionapplication_types.go):

   • Add CACertRef *corev1.SecretKeySelector field to ObjectStorageLocation struct
   • Ensure it matches the CRD schema (name, key, optional fields)

2. Update BSL controller (internal/controller/bsl.go):

   • Add logic to resolve the referenced Secret when CACertRef is set
   • Respect the name, key, and optional fields
   • Load the Secret contents and populate the CACert byte slice for TLS verification
   • Handle error cases (Secret not found, key not present, etc.)

3. Validation:

   • Ensure CRD validation (required: [key]) aligns with Go type
   • Consider mutual exclusivity between CACert and CACertRef (if needed)

Related

• Upstream Velero PR: feat: Enhance BackupStorageLocation with Secret-based CA certificate support velero-io/velero#9141
• OADP PR introducing CRD changes: openshift/velero:oadp-dev rebase + Adapt ToSystemAffinity calls to new Velero API signature #2096
• Discussion: openshift/velero:oadp-dev rebase + Adapt ToSystemAffinity calls to new Velero API signature #2096 (comment)

Requested by: @kaovilai