OADP-6669: Use CloudStorage creationSecret and config as fallback for BSL

[kaovilai]

Description

This PR enhances the CloudStorage integration in DataProtectionApplication (DPA) resources by implementing automatic fallback mechanisms for both credentials and configuration when using CloudStorage CRs.

Changes

1. Credential Fallback (commit aa93572)

When a DPA references a CloudStorage CR without explicit credentials, the BSL controller now automatically uses the CloudStorage's creationSecret as a fallback for authentication.

Benefits:

• Eliminates credential duplication between CloudStorage and DPA resources
• Simplifies configuration when using CloudStorage CRs
• Maintains backward compatibility with existing configurations

2. Configuration and Region Fallback (commit 345b342)

The BSL now inherits configuration values from the CloudStorage CR as fallback, including automatic region propagation.

Implementation details:

• CloudStorage CR's config field values are used as base configuration
• CloudStorage CR's region field is automatically added to BSL config
• DPA's CloudStorageLocation.Config values override CloudStorage CR values (higher priority)
• Supports all provider-specific configurations (AWS, Azure, GCP)

Example use case:

# CloudStorage CR defines base configuration
apiVersion: oadp.openshift.io/v1alpha1
kind: CloudStorage
metadata:
  name: my-storage
spec:
  provider: aws
  region: us-west-2
  config:
    serverSideEncryption: "AES256"
    s3ForcePathStyle: "true"
  creationSecret:
    name: cloud-creds
    key: credentials

---
# DPA can reference CloudStorage without duplicating config
apiVersion: oadp.openshift.io/v1alpha1
kind: DataProtectionApplication
metadata:
  name: my-dpa
spec:
  backupLocations:
    - cloudStorage:
        cloudStorageRef:
          name: my-storage
        # No need to specify credential or config - inherited from CloudStorage
        # Can optionally override specific values:
        config:
          profile: "custom"  # This overrides while keeping other CloudStorage configs

Testing

• Added comprehensive test coverage for both credential and config fallback scenarios
• Updated existing tests to account for inherited region configuration
• All tests passing: go test ./internal/controller/ -run TestDPAReconciler_ReconcileBackupStorageLocations

Impact

This change is backward compatible and improves the user experience by:

1. Reducing configuration duplication
2. Centralizing cloud storage settings in CloudStorage CRs
3. Maintaining flexibility to override at the DPA level when needed

Fixes #[issue_number] (if applicable)

🤖 Generated with Claude Code

Co-Authored-By: Claude [email protected]

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kaovilai

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [kaovilai]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@kaovilai: This pull request references OADP-6669 which is a valid jira issue.

In response to this:

When a DataProtectionApplication references a CloudStorage CR without
providing explicit credentials, the BSL controller now uses the
CloudStorage's creationSecret as a fallback for authentication.

Changes:

• Enhanced BSL reconciliation to fallback to CloudStorage's creationSecret
  when DPA doesn't specify credentials
• Moved fallback logic into centralized getSecretNameAndKeyFromCloudStorage
  function for better code organization
• Updated validation to allow nil credentials when CloudStorage is referenced
• Fixed related test cases to handle the new fallback behavior

This allows users to avoid duplicating credential configuration between
CloudStorage and DataProtectionApplication resources.

🤖 Generated with Claude Code

Co-Authored-By: Claude [email protected]

Why the changes were made

How to test the changes made

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@kaovilai: This pull request references OADP-6669 which is a valid jira issue.

In response to this:

Description

This PR enhances the CloudStorage integration in DataProtectionApplication (DPA) resources by implementing automatic fallback mechanisms for both credentials and configuration when using CloudStorage CRs.

Changes

1. Credential Fallback (commit aa93572)

When a DPA references a CloudStorage CR without explicit credentials, the BSL controller now automatically uses the CloudStorage's creationSecret as a fallback for authentication.

Benefits:

• Eliminates credential duplication between CloudStorage and DPA resources
• Simplifies configuration when using CloudStorage CRs
• Maintains backward compatibility with existing configurations

2. Configuration and Region Fallback (commit 345b342)

The BSL now inherits configuration values from the CloudStorage CR as fallback, including automatic region propagation.

Implementation details:

• CloudStorage CR's config field values are used as base configuration
• CloudStorage CR's region field is automatically added to BSL config
• DPA's CloudStorageLocation.Config values override CloudStorage CR values (higher priority)
• Supports all provider-specific configurations (AWS, Azure, GCP)

Example use case:

# CloudStorage CR defines base configuration
apiVersion: oadp.openshift.io/v1alpha1
kind: CloudStorage
metadata:
 name: my-storage
spec:
 provider: aws
 region: us-west-2
 config:
   serverSideEncryption: "AES256"
   s3ForcePathStyle: "true"
 creationSecret:
   name: cloud-creds
   key: credentials

---
# DPA can reference CloudStorage without duplicating config
apiVersion: oadp.openshift.io/v1alpha1
kind: DataProtectionApplication
metadata:
 name: my-dpa
spec:
 backupLocations:
   - cloudStorage:
       cloudStorageRef:
         name: my-storage
       # No need to specify credential or config - inherited from CloudStorage
       # Can optionally override specific values:
       config:
         profile: "custom"  # This overrides while keeping other CloudStorage configs

Testing

• Added comprehensive test coverage for both credential and config fallback scenarios
• Updated existing tests to account for inherited region configuration
• All tests passing: go test ./internal/controller/ -run TestDPAReconciler_ReconcileBackupStorageLocations

Impact

This change is backward compatible and improves the user experience by:

1. Reducing configuration duplication
2. Centralizing cloud storage settings in CloudStorage CRs
3. Maintaining flexibility to override at the DPA level when needed

Fixes #[issue_number] (if applicable)

🤖 Generated with Claude Code

Co-Authored-By: Claude [email protected]

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@kaovilai: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/unit-test	345b342	link	true	/test unit-test
ci/prow/4.20-e2e-test-hcp-aws	345b342	link	false	/test 4.20-e2e-test-hcp-aws

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.