backup: custom S3 endpoint support (#1855)

this enables backup on other implementations of S3, such as ceph and minio.

pkg/apis/etcd/v1beta2/backup_types.go

@@ -99,4 +99,8 @@ type S3BackupSource struct {
 	//
 	// AWSSecret overwrites the default etcd operator wide AWS credential and config.
 	AWSSecret string `json:"awsSecret"`
+
+	// Endpoint if blank points to aws. If specified, can point to s3 compatible object
+	// stores.
+	Endpoint string `json:"endpoint,omitempty"`
 }

pkg/apis/etcd/v1beta2/restore_types.go

@@ -78,6 +78,10 @@ type S3RestoreSource struct {
 	//
 	// AWSSecret overwrites the default etcd operator wide AWS credential and config.
 	AWSSecret string `json:"awsSecret"`
+
+	// Endpoint if blank points to aws. If specified, can point to s3 compatible object
+	// stores.
+	Endpoint string `json:"endpoint"`
 }
 
 // RestoreStatus reports the status of this restore operation.

pkg/controller/backup-operator/s3_backup.go

@@ -31,7 +31,7 @@ import (
 // TODO: replace this with generic backend interface for other options (PV, Azure)
 // handleS3 saves etcd cluster's backup to specificed S3 path.
 func handleS3(kubecli kubernetes.Interface, s *api.S3BackupSource, endpoints []string, clientTLSSecret, namespace string) (*api.BackupStatus, error) {
-	cli, err := s3factory.NewClientFromSecret(kubecli, namespace, s.AWSSecret)
+	cli, err := s3factory.NewClientFromSecret(kubecli, namespace, s.Endpoint, s.AWSSecret)
 	if err != nil {
 		return nil, err
 	}

pkg/controller/restore-operator/http.go

@@ -90,7 +90,7 @@ func (r *Restore) serveBackup(w http.ResponseWriter, req *http.Request) error {
 			return errors.New("invalid s3 restore source field (spec.s3), must specify all required subfields")
 		}
 
-		s3Cli, err := s3factory.NewClientFromSecret(r.kubecli, r.namespace, s3RestoreSource.AWSSecret)
+		s3Cli, err := s3factory.NewClientFromSecret(r.kubecli, r.namespace, s3RestoreSource.Endpoint, s3RestoreSource.AWSSecret)
 		if err != nil {
 			return fmt.Errorf("failed to create S3 client: %v", err)
 		}

pkg/util/awsutil/s3factory/client.go

@@ -39,7 +39,7 @@ type S3Client struct {
 }
 
 // NewClientFromSecret returns a S3 client based on given k8s secret containing aws credentials.
-func NewClientFromSecret(kubecli kubernetes.Interface, namespace, awsSecret string) (w *S3Client, err error) {
+func NewClientFromSecret(kubecli kubernetes.Interface, namespace, endpoint, awsSecret string) (w *S3Client, err error) {
 	defer func() {
 		if err != nil {
 			err = fmt.Errorf("new S3 client failed: %v", err)
@@ -50,7 +50,7 @@ func NewClientFromSecret(kubecli kubernetes.Interface, namespace, awsSecret stri
 	if err != nil {
 		return nil, fmt.Errorf("failed to create aws config dir: (%v)", err)
 	}
-	so, err := setupAWSConfig(kubecli, namespace, awsSecret, w.configDir)
+	so, err := setupAWSConfig(kubecli, namespace, awsSecret, endpoint, w.configDir)
 	if err != nil {
 		return nil, fmt.Errorf("failed to setup aws config: (%v)", err)
 	}
@@ -68,10 +68,13 @@ func (w *S3Client) Close() {
 }
 
 // setupAWSConfig setup local AWS config/credential files from Kubernetes aws secret.
-func setupAWSConfig(kubecli kubernetes.Interface, ns, secret, configDir string) (*session.Options, error) {
+func setupAWSConfig(kubecli kubernetes.Interface, ns, secret, endpoint, configDir string) (*session.Options, error) {
 	options := &session.Options{}
 	options.SharedConfigState = session.SharedConfigEnable
 
+	// empty string defaults to aws
+	options.Config.Endpoint = &endpoint
+
 	se, err := kubecli.CoreV1().Secrets(ns).Get(secret, metav1.GetOptions{})
 	if err != nil {
 		return nil, fmt.Errorf("setup AWS config failed: get k8s secret failed: %v", err)

pkg/util/awsutil/s3factory/client_test.go

@@ -0,0 +1,40 @@
+// Copyright 2017 The etcd-operator Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package s3factory
+
+import (
+	"testing"
+
+	"k8s.io/api/core/v1"
+	"k8s.io/client-go/kubernetes/fake"
+)
+
+func TestSetupAWSConfig(t *testing.T) {
+	sec := &v1.Secret{
+		Data: map[string][]byte{},
+	}
+
+	client := fake.NewSimpleClientset(sec)
+
+	e := "example.com"
+	opts, err := setupAWSConfig(client, "", "", e, "")
+	if err != nil {
+		t.Error(err)
+	}
+
+	if e != *opts.Config.Endpoint {
+		t.Errorf("got: %s wanted: %s", *opts.Config.Endpoint, e)
+	}
+}

test/e2e/e2eslow/backup_restore_test.go

@@ -145,7 +145,7 @@ func testEtcdBackupOperatorForS3Backup(t *testing.T, clusterName, operatorClient
 	// local testing shows that it takes around 1 - 2 seconds from creating backup cr to verifying the backup from s3.
 	// 4 seconds timeout via retry is enough; duration longer than that may indicate internal issues and
 	// is worthy of investigation.
-	s3cli, err := s3factory.NewClientFromSecret(f.KubeClient, f.Namespace, os.Getenv("TEST_AWS_SECRET"))
+	s3cli, err := s3factory.NewClientFromSecret(f.KubeClient, f.Namespace, "", os.Getenv("TEST_AWS_SECRET"))
 	if err != nil {
 		t.Fatalf("failed create s3 client: %v", err)
 	}