Mounted cloud credentials should not be world-readable by sseago · Pull Request #8919 · velero-io/velero

sseago · 2025-05-08T16:37:09Z

Thank you for contributing to Velero!

Please add a summary of your change

Cloud credentials (both default and BSL-named) should not be world-readable. This PR makes the file access permissions more restrictive.

sh-5.1$ ls -l /tmp/credentials/openshift-adp 
total 4
-rw-r-----. 1 1000740000 root 112 May  8 16:36 cloud-credentials-cloud

Does your change fix a particular issue?

Fixes #8906

Please indicate you've done the following:

[x ] Accepted the DCO. Commits without the DCO will delay acceptance.
[x ] Created a changelog file (make new-changelog) or comment /kind changelog-not-required on this PR.
[x ] Updated the corresponding documentation in site/content/docs/main.

kaovilai

  Error: pkg/install/daemonset.go:183:1: File is not properly formatted (gofmt)
  						SecretName: "cloud-credentials",
  ^

Please fix linters.

codecov · 2025-05-08T19:56:34Z

Codecov Report

Attention: Patch coverage is 36.36364% with 28 lines in your changes missing coverage. Please review.

Project coverage is 60.02%. Comparing base (5b29a87) to head (80b829b).
Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
...g/controller/backup_storage_location_controller.go	22.22%	25 Missing and 3 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8919      +/-   ##
==========================================
- Coverage   60.05%   60.02%   -0.04%     
==========================================
  Files         378      378              
  Lines       42883    42940      +57     
==========================================
+ Hits        25754    25775      +21     
- Misses      15582    15615      +33     
- Partials     1547     1550       +3

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

reasonerjt · 2025-07-11T09:10:35Z

The changes LGTM, could you please check the failures in git actions?

kaovilai · 2025-07-11T18:24:23Z

Velero test on include resources from the cluster restore [It] Run E2E test case [ResourceFiltering, IncludeResources, Restore]
/home/runner/work/velero/velero/test/e2e/test/test.go:94

  [FAILED] Failed to backup resources
  Expected success, but got an error:
      <*errors.fundamental | 0xc000a5acc0>: 
      Unexpected backup phase got FailedValidation, expecting Completed
      {
          msg: "Unexpected backup phase got FailedValidation, expecting Completed",
          stack: [0x201471d, 0x20167c6, 0x26b7a19, 0x8e626c, 0x8f6e76, 0x26b7965, 0x26b8c70, 0x26b760c, 0x8da973, 0x8ee97b, 0x47f021],
      }
  In [It] at: /home/runner/work/velero/velero/test/e2e/test/test.go:120 @ 07/10/25 02:37:42.696

sseago · 2025-07-11T19:24:00Z

@kaovilai Hmm. That doesn't seem like it should be related to my change. I guess I'll update the branch (it's out of date anyway) and see what happens on retest. If it's still failig, I'll dig into it in more detail on Monday.

sseago · 2025-07-14T20:47:39Z

e2e tests are all failing with BSL validation failures.

"BackupStorageLocation \"default\" is unavailable: rpc error: code = Unknown desc = failed to refresh cached credentials, no EC2 IMDS role found, operation error ec2imds: GetMetadata, failed to get API token, operation error ec2imds: getToken, http response error StatusCode: 400, request to EC2 IMDS failed",

What I don't quite understand is that the only change made by this PR is to update file permissions for the secret to remove the world-read permission. If this caused errors in the e2e Kind cluster, I would expect to see a "permission denied" error originating in velero code, not in the AWS APIs. If we're able to make the AWS call at all, that suggests that velero was able to read the file. If velero was able to read the file, then the AWS API call should be identical with and without this change.

blackpiglet · 2025-07-15T07:33:31Z

I think it's still related to the credentials permission.
The error could be caused by the AWS SDK automatically falling back to the EC2 IMDS way on failing with the provided credentials.

sseago · 2025-07-15T14:42:25Z

@blackpiglet I need to do some extra logging and see what's going on with the actual velero UID/GID and the file permissions. It could be that the kind clusters don't work properly without everything being world-readable here, or it could be that the e2e tests are doing something weird with the uid/gid for velero causing problems. In theory the velero server should have no problems accessing files with read permission for the owner and group, since the owner and group for the file should be the same as for the velero server process.

sseago · 2025-07-15T23:34:25Z

After adding some logging, it looks like what's happening is that the default credentials, mounted from the secret at /credentials/cloud is showing up in the velero container as owned by uid/gid=0/0:
From my extra debug logging:
velero uid/gid 1002/1000, config map[region:minio s3ForcePathStyle:true s3Url:http://10.1.0.214:9000], perms /credentials/cloud: 0440; uid/gid: 0/0:
What's not yet clear to me is whether this is a problem with the kind cluster configuration or whether we need some additional specification in the velero deployment pod template spec to force the secret credentials mount to have the same owner as the container's runAsUser.

blackpiglet · 2025-07-15T23:47:33Z

After adding some logging, it looks like what's happening is that the default credentials, mounted from the secret at /credentials/cloud is showing up in the velero container as owned by uid/gid=0/0: From my extra debug logging: velero uid/gid 1002/1000, config map[region:minio s3ForcePathStyle:true s3Url:http://10.1.0.214:9000], perms /credentials/cloud: 0440; uid/gid: 0/0: What's not yet clear to me is whether this is a problem with the kind cluster configuration or whether we need some additional specification in the velero deployment pod template spec to force the secret credentials mount to have the same owner as the container's runAsUser.

Thanks for the detailed information.
I will do some tests in my environment.
By the way, how does the ODAP install Velero, by Velero CLI or using client-go to talk to the kube-apiserver?

blackpiglet · 2025-07-16T03:28:40Z

@sseago
The reason is that Velero CLI installation doesn't set the securityContext for the Velero Deployment and DaemonSet.
By default, the mounted secret's ownership is set as root.

As a result, adding the securityContext section to the Velero deployment and the DaemonSet should fix the issue.

The Velero server image, Ubuntu Jammy, uses the user cnb(Cloud Native Buildpack). Its UID and GID are both 1000.

I will create a PR to add the SecurityContext for the Velero install CLI and the E2E tests.

sseago · 2025-07-16T15:51:02Z

@blackpiglet ok, so I figured out what was different between the OpenShift cluster and the Kind e2e cluster.

So for mounted secrets, there is no way to change the user ownership. It will always be root/0. However, if the pod sets fsGroup in the security context, then the mounted secret's group ownership will be modified to match. OpenShift sets fsGroup automatically when launching pods if it's not set explicitly. So it was actually an OpenShift quirk that allowed this to work by just setting defaultMode. I don't think we have an issue with the restricted permissions for named non-default credentials, since those files are created by the velero server process, so the uid/gids on those files should always match whatever user is running the pod.

One possible fix is this:

Add an optional --fsgroup flag to the velero installer
If --fsgroup is specified, then add fsgroup to the security context of the velero deployment pod spec template and set the mounted credentials secret mode to 0440
If --fsgroup is not specified, then just set the mode to 0444 (readonly, but world readable)
Leave the named credentials change in this PR as-is, always making that one 0640 (read-write, but not world-readable)

Another option would be to skip the --fsgroup addition and just always set the mounted default credentials to mode 0444.

blackpiglet · 2025-07-17T05:55:37Z

@sseago
Thanks for investigating this issue.

Are there any security hardening rules required to make the secret non-world-readable?

If we go the first way, there would be a potential need to modify the fsGroup value when the Velero server image changes. It would be the same if we choose to use a default value.
The stricter limitation may increase the knowledge demands for the users.

If there is no clear requirement for that, I prefer to go the second way.

sseago · 2025-07-17T13:07:20Z

@blackpiglet I wasn't suggesting that we hard-code any fsGroup values but making it an optional parameter. If the user doesn't specify fsGroup, then we don't add the security context, and we can just mount it read-only as 444. If the user supplies fsGroup at install, then we set it in the security context and then the velero server will run with that group set.

But we could go with the simpler second approach. @weshayutin do you know whether the OADP request for modifying these permissions was related to any specific security hardening rule, or was it just a general sense that we shouldn't have world-readable secrets? I think the practical impact here is relatively small, since in general, users who aren't authorized to access the credentials shouldn't be able to run processes in the velero pod anyway.

blackpiglet · 2025-07-17T14:49:15Z

@blackpiglet I wasn't suggesting that we hard-code any fsGroup values but making it an optional parameter. If the user doesn't specify fsGroup, then we don't add the security context, and we can just mount it read-only as 444. If the user supplies fsGroup at install, then we set it in the security context and then the velero server will run with that group set.

But we could go with the simpler second approach. @weshayutin do you know whether the OADP request for modifying these permissions was related to any specific security hardening rule, or was it just a general sense that we shouldn't have world-readable secrets? I think the practical impact here is relatively small, since in general, users who aren't authorized to access the credentials shouldn't be able to run processes in the velero pod anyway.

That should work.
If there is a need from the OADP side, we can go that way.

Signed-off-by: Scott Seago <sseago@redhat.com>

sseago · 2025-07-17T18:40:18Z

@blackpiglet Updated with option 2: default creds mounted 444 (read-only), non-default cred files created 640 (no world-read).

Signed-off-by: Scott Seago <sseago@redhat.com>

Signed-off-by: Scott Seago <sseago@redhat.com> Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

Signed-off-by: Scott Seago <sseago@redhat.com>

* Add BSL status check for backup/restore operations. Signed-off-by: Xun Jiang <xun.jiang@broadcom.com> * Bump golang to v1.23.10 to fix CVEs for 1.16.2 release (velero-io#9058) * Bump golang to v1.23.10 to fix CVEs Signed-off-by: Adarsh Saxena <adarsh.saxena@acquia.com> * Dockerfile restic miss 1.23.10 Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> * restic cve go1.23.10 Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> --------- Signed-off-by: Adarsh Saxena <adarsh.saxena@acquia.com> Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> Co-authored-by: Tiger Kaovilai <tkaovila@redhat.com> * Allow for proper tracking of multiple hooks per container Signed-off-by: Scott Seago <sseago@redhat.com> * Mounted cloud credentials should not be world-readable (velero-io#8919) (velero-io#9094) Signed-off-by: Scott Seago <sseago@redhat.com> * issue 9077: don't block backup deletion on list VS error (velero-io#9101) Signed-off-by: Lyndon-Li <lyonghui@vmware.com> * Fix missing defaultVolumesToFsBackup flag output in Velero describe backup cmd (velero-io#9056) add changelog file Show defaultVolumesToFsBackup in describe only when set by the user minor ut fix minor fix Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com> (cherry picked from commit 60a6c73) update changelog filename Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com> * Update Backup describe string for DefaultVolumesToFSBackup flag (velero-io#9105) add changelog file Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com> (cherry picked from commit aa2e09c) * Add imagePullSecrets inheritance for VGDP pod and maintenance job. (velero-io#9102) Signed-off-by: Xun Jiang <xun.jiang@broadcom.com> * Bump Golang, Ubuntu, and golang.org/x/oauth2 to fix CVEs. (velero-io#9104) Signed-off-by: Xun Jiang <xun.jiang@broadcom.com> * 1.16.2 changelog Signed-off-by: Lyndon-Li <lyonghui@vmware.com> * Bump the Velero and plugin image versions for the upgrade and migration tests. Signed-off-by: Xun Jiang <xun.jiang@broadcom.com> * skip subresource in resource discovery (velero-io#6688) Signed-off-by: lou <alex1988@outlook.com> Co-authored-by: lou <alex1988@outlook.com> * fix issue 6753 Signed-off-by: Lyndon-Li <lyonghui@vmware.com> * Update restore controller logic for restore deletion (velero-io#6761) 1. Skip deleting the restore files from storage if the backup/BSL is not found 2. Allow deleting the restore files from storage even though the BSL is readonly Signed-off-by: Wenkai Yin(尹文开) <yinw@vmware.com> * Fix velero-io#6752: add namespace exclude check. Add PSA audit and warn labels. Signed-off-by: Xun Jiang <jxun@vmware.com> * add csi snapshot data movement doc Signed-off-by: Lyndon-Li <lyonghui@vmware.com> * Modify changelogs for v1.12 Signed-off-by: allenxu404 <qix2@vmware.com> * issue 6786:always delete VSC regardless of the deletion policy Signed-off-by: Lyndon-Li <lyonghui@vmware.com> * issue: move plugin depdending podvolume functions to util pkg Signed-off-by: Lyndon-Li <lyonghui@vmware.com> * issue 6880: set ParallelUploadAboveSize as MaxInt64 Signed-off-by: Lyndon-Li <lyonghui@vmware.com> * changelog Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> * Add support for block volumes (velero-io#6680) (velero-io#6897) (cherry picked from commit 8e01d1b) Signed-off-by: David Zaninovic <dzaninovic@catalogicsoftware.com> * Replace the base image with paketobuildpacks image Replace the base image with paketobuildpacks image Fixes velero-io#6851 Signed-off-by: Wenkai Yin(尹文开) <yinw@vmware.com> * issue 6734: spread backup pod evenly Signed-off-by: Lyndon-Li <lyonghui@vmware.com> * Add doc links for new features to release note Signed-off-by: allenxu404 <qix2@vmware.com> * fix issue 6647 Signed-off-by: Lyndon-Li <lyonghui@vmware.com> * Perf improvements for existing resource restore Use informer cache with dynamic client for Get calls on restore When enabled, also make the Get call before create. Add server and install parameter to allow disabling this feature, but enable by default Signed-off-by: Scott Seago <sseago@redhat.com> * issue velero-io#6807: Retry failed create when using generateName When creating resources with generateName, apimachinery does not guarantee uniqueness when it appends the random suffix to the generateName stub, so if it fails with already exists error, we need to retry. Signed-off-by: Scott Seago <sseago@redhat.com> * Import auth provider plugins Signed-off-by: Sebastian Glab <sglab@catalogicsoftware.com> * Add v1.12.1 changelog Signed-off-by: allenxu404 <qix2@vmware.com> * Make Windows build skip BlockMode code. PVC block mode backup and restore introduced some OS specific system calls. Those calls are not available for Windows, so add both non Windows version and Windows version code, and return error for block mode on the Windows platform. Signed-off-by: Xun Jiang <jxun@vmware.com> * udmrepo use region specified in BSL when s3URL is empty Signed-off-by: Lyndon-Li <lyonghui@vmware.com> * Change v1.12.1 changelog Signed-off-by: allenxu404 <qix2@vmware.com> * Dockerfile.ubi/travis local files add UBI dockerfiles Use numeric user for velero-restic-restore-helper Enable multiarch builds (#135) Use arm64-graviton2 for arm builds (#137) Add required keys for arm builds (#139) Update Travis build job to work w/o changes on new branches Use a full VM for arm Use numeric non-root user for nonroot SCC compatibility * Add BZ + Publish automation to repo (#82) (cherry picked from commit ccb545f) Update PR-BZ automation mapping (#84) (cherry picked from commit aa2b019) Update PR-BZ automation (#92) Co-authored-by: Rayford Johnson <rjohnson@redhat.com> (cherry picked from commit ecc563f) Add publish workflow (#108) (cherry picked from commit f87b779) * remove dependabot config from fork * Create Makefile.prow Code-gen no longer required on verify due to velero-io#6039 Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> oadp-1.2: Update Makefile.prow to velero-restore-helper * set HOME in velero image for kopia, update controller-gen for CI (#280) Signed-off-by: Scott Seago <sseago@redhat.com> * build velero-helper binary for datamover pod * restore: Use warning when Create IsAlreadyExist and Get error Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> * kopia/repository/config/aws.go: Set session.Options profile from config Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> * use ubi9-latest to build * OADP-4225: add tzdata to Dockerfile.ubi * fix: CI (#316) Signed-off-by: Mateus Oliveira <msouzaol@redhat.com> * fix: ARM images (#332) * fix: ARM images Signed-off-by: Mateus Oliveira <msouzaol@redhat.com> * fixup! fix: ARM images Signed-off-by: Mateus Oliveira <msouzaol@redhat.com> --------- Signed-off-by: Mateus Oliveira <msouzaol@redhat.com> * ubi: BUILDPLATFORM to build stage to enable cross compile. (#336) Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> * OADP-4640: Downstream only to allow override kopia default algorithms (#334) (#338) add missing unit test for kopia hashing algo (#337) Introduction of downstream only option to override Kopia default: - hashing algorithm - splitting algorithm - encryption algorithm With introduction of 3 environment variables it is possible to override Kopia algorithms used by Velero: KOPIA_HASHING_ALGORITHM KOPIA_SPLITTER_ALGORITHM KOPIA_ENCRYPTION_ALGORITHM If the env algorithms are not set or they are not within Kopia SupportedAlgorithms, the default algorithm will be used. This behavior is consistent with current behavior without this change. Signed-off-by: Michal Pryc <mpryc@redhat.com> Signed-off-by: Shubham Pampattiwar <shubhampampattiwar7@gmail.com> * Downstream only: Rework of Makefile and incusion of lint The rework of Makefile to make it more readable and inclusion of lint as a target as well extract golangci-lint version from the upstream Dockerfile, so we test in PROW or locally on the same version as upstream. Signed-off-by: Michal Pryc <mpryc@redhat.com> * Downstream only - fix lint error in downtream change (#343) This fixes the PR #334 where one additional line was in the code. This was not exposed previously as we did not had downstream CI Lint jobs. Signed-off-by: Michal Pryc <mpryc@redhat.com> * run oadp-operator e2e test from the velero repo (#353) * run oadp-operator e2e test from the velero repo execute openshift/oadp-operator e2e tests directly against the velero repo locally or via prow ci Signed-off-by: Wesley Hayutin <weshayutin@gmail.com> * update variable names, add a cleanup * make sure env variable overrides default velero_image Signed-off-by: Wesley Hayutin <weshayutin@gmail.com> * add options to build, push, and only test Signed-off-by: Wesley Hayutin <weshayutin@gmail.com> * add arch to name Signed-off-by: Wesley Hayutin <weshayutin@gmail.com> * remove duplicated clean/rm operator checkout * simplify by dropping export var and use a oneliner Co-authored-by: Tiger Kaovilai <passawit.kaovilai@gmail.com> * drop export and use oneliner Co-authored-by: Tiger Kaovilai <passawit.kaovilai@gmail.com> * just in case, allow oadp to be deployed from makefile Signed-off-by: Wesley Hayutin <weshayutin@gmail.com> * Update Makefile.prow Co-authored-by: Tiger Kaovilai <passawit.kaovilai@gmail.com> --------- Signed-off-by: Wesley Hayutin <weshayutin@gmail.com> Co-authored-by: Tiger Kaovilai <passawit.kaovilai@gmail.com> * DS Owners * updated controller-gen version * Include velero-restore-helper binary in velero image (#375) Co-authored-by: Scott Seago <sseago@redhat.com> * OADP-5952: downstream only, update error message disableFsBackup (#380) * OADP-5952: clear error for disableFsBackup This error message can be carried in OADP-1.5 Upstream issue: velero-io#8185 Signed-off-by: Wesley Hayutin <weshayutin@gmail.com> * fix error message and test --------- Signed-off-by: Wesley Hayutin <weshayutin@gmail.com> * Summary of Changes: (#381) Move PVC Request Size Patch to Backup CSI Action Shifted the logic that patches the PVC request size (to match the corresponding VolumeSnapshot size) from the CSI Restore action to the CSI Backup action. ✅ This enables restoring a PVC independently using label selectors, without requiring the VolumeSnapshot to be restored first. Include VolumeSnapshot in CSI Additional Items for PVC Added VolumeSnapshot as an additional item in the PVC CSI backup logic to ensure necessary metadata is available during restore. Include VolumeSnapshotContent in CSI Restore Additional Items Added VolumeSnapshotContent to the additional items in the CSI restore action to support a more complete restore workflow. ✅ This to make sure those resources are restored even if filters out by label from the resources list to restore Author: Amos Mastbaum <amastbau@redhat.com> Signed-off-by: Amos Mastbaum <68001528+amastbau@users.noreply.github.com> fixing-after-michal wait-for-vsc.Status.RestoreSize wait-for-vsc.Status.RestoreSize Update pkg/util/csi/volume_snapshot.go Update pkg/util/csi/volume_snapshot.go Update pkg/util/csi/volume_snapshot.go Co-authored-by: Scott Seago <sseago@redhat.com> * Prep for Konflux (#385) * Prep for Konflux * Update git submodule restic commit --------- Co-authored-by: Rayford Johnson <rayfordj@users.noreply.github.com> * Red Hat Konflux update oadp-velero-oadp-1-5 (#386) * Red Hat Konflux update oadp-velero-oadp-1-5 Signed-off-by: red-hat-konflux <konflux@no-reply.konflux-ci.dev> * hermetic, prefetch-input --------- Co-authored-by: red-hat-konflux <konflux@no-reply.konflux-ci.dev> Co-authored-by: Rayford Johnson <rayfordj@users.noreply.github.com> * Konflux: multiarch, tags, labels (#402) * build-platforms * generate-labels, LABELS * ADDITIONAL_TAGS --------- Co-authored-by: Rayford Johnson <rayfordj@users.noreply.github.com> * Red Hat Konflux update oadp-velero-oadp-1-5 (#411) * Red Hat Konflux update oadp-velero-oadp-1-5 Signed-off-by: red-hat-konflux <konflux@no-reply.konflux-ci.dev> * Konflux: openshift-preflight: failed: HasLicense "suggestion": "Create a directory named /licenses and include all relevant licensing and/or terms and conditions as text file(s) in that directory." https://docs.redhat.com/en/documentation/red_hat_software_certification/2025/html-single/red_hat_openshift_software_certification_policy_guide/index#assembly-requirements-for-container-ima > Container images must contain a “licenses” directory. Use this > directory to add files containing software terms and conditions for your > product and any open source software included in the image. > > Test name: HasLicense --------- Co-authored-by: red-hat-konflux <konflux@no-reply.konflux-ci.dev> Co-authored-by: Rayford Johnson <rayfordj@users.noreply.github.com> * chore(deps): update konflux references (#394) Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com> * chore(deps): update konflux references (#413) Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com> * add velero release to the velero container tags (#424) Signed-off-by: Wesley Hayutin <weshayutin@gmail.com> * oadp-1.5: Update Konflux references (#430) * oadp-1.5: Update Konflux references Update konflux-ci image references Changes committed via automation for oadp-1-5/velero. * Use restic's release branch --------- Co-authored-by: Rayford Johnson <rayfordj@users.noreply.github.com> --------- Signed-off-by: Xun Jiang <xun.jiang@broadcom.com> Signed-off-by: Adarsh Saxena <adarsh.saxena@acquia.com> Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com> Signed-off-by: Scott Seago <sseago@redhat.com> Signed-off-by: Lyndon-Li <lyonghui@vmware.com> Signed-off-by: Shubham Pampattiwar <spampatt@redhat.com> Signed-off-by: lou <alex1988@outlook.com> Signed-off-by: Wenkai Yin(尹文开) <yinw@vmware.com> Signed-off-by: Xun Jiang <jxun@vmware.com> Signed-off-by: allenxu404 <qix2@vmware.com> Signed-off-by: David Zaninovic <dzaninovic@catalogicsoftware.com> Signed-off-by: Sebastian Glab <sglab@catalogicsoftware.com> Signed-off-by: Mateus Oliveira <msouzaol@redhat.com> Signed-off-by: Michal Pryc <mpryc@redhat.com> Signed-off-by: Shubham Pampattiwar <shubhampampattiwar7@gmail.com> Signed-off-by: Wesley Hayutin <weshayutin@gmail.com> Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com> Co-authored-by: Xun Jiang <xun.jiang@broadcom.com> Co-authored-by: Wenkai Yin(尹文开) <yinw@vmware.com> Co-authored-by: Adarsh Saxena <adarsh.saxena@acquia.com> Co-authored-by: Tiger Kaovilai <tkaovila@redhat.com> Co-authored-by: Scott Seago <sseago@redhat.com> Co-authored-by: lyndon-li <98304688+Lyndon-Li@users.noreply.github.com> Co-authored-by: Shubham Pampattiwar <spampatt@redhat.com> Co-authored-by: Xun Jiang/Bruce Jiang <59276555+blackpiglet@users.noreply.github.com> Co-authored-by: Lyndon-Li <lyonghui@vmware.com> Co-authored-by: Daniel Jiang <jiangd@vmware.com> Co-authored-by: lou <alex1988@outlook.com> Co-authored-by: Xun Jiang <jxun@vmware.com> Co-authored-by: allenxu404 <qix2@vmware.com> Co-authored-by: David Zaninovic <74072514+dzaninovic@users.noreply.github.com> Co-authored-by: Sebastian Glab <sglab@catalogicsoftware.com> Co-authored-by: Dylan Murray <dymurray@redhat.com> Co-authored-by: RayfordJ <rayfordj@users.noreply.github.com> Co-authored-by: Mateus Oliveira <msouzaol@redhat.com> Co-authored-by: Wesley Hayutin <138787+weshayutin@users.noreply.github.com> Co-authored-by: Tiger Kaovilai <passawit.kaovilai@gmail.com> Co-authored-by: OpenShift Cherrypick Robot <openshift-cherrypick-robot@redhat.com> Co-authored-by: RayfordJ <4580787+rayfordj@users.noreply.github.com> Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com> Co-authored-by: red-hat-konflux <konflux@no-reply.konflux-ci.dev>

github-actions Bot requested review from Lyndon-Li and reasonerjt May 8, 2025 16:37

github-actions Bot assigned sseago May 8, 2025

sseago force-pushed the secret-perms branch from 27675df to ee7a32a Compare May 8, 2025 16:37

github-actions Bot added the has-changelog label May 8, 2025

shubham-pampattiwar previously approved these changes May 8, 2025

View reviewed changes

kaovilai requested changes May 8, 2025

View reviewed changes

sseago dismissed shubham-pampattiwar’s stale review via 19c4ddc May 8, 2025 19:47

sseago force-pushed the secret-perms branch from ee7a32a to 19c4ddc Compare May 8, 2025 19:47

kaovilai force-pushed the secret-perms branch from 19c4ddc to 7126cfd Compare May 13, 2025 21:33

sseago force-pushed the secret-perms branch from 7126cfd to 77e5e6d Compare June 10, 2025 14:02

sseago force-pushed the secret-perms branch from 77e5e6d to face1ae Compare June 24, 2025 14:48

sseago force-pushed the secret-perms branch 2 times, most recently from b372610 to de248e8 Compare July 8, 2025 13:45

kaovilai force-pushed the secret-perms branch from de248e8 to 604028a Compare July 10, 2025 02:05

shubham-pampattiwar previously approved these changes Jul 10, 2025

View reviewed changes

reasonerjt added the carvel-package-impacted label Jul 11, 2025

sseago force-pushed the secret-perms branch from 604028a to 9589103 Compare July 14, 2025 16:12

sseago dismissed shubham-pampattiwar’s stale review via 5b61c50 July 15, 2025 16:31

sseago marked this pull request as draft July 15, 2025 16:31

sseago force-pushed the secret-perms branch 3 times, most recently from 4a68116 to 20b4deb Compare July 15, 2025 16:59

sseago force-pushed the secret-perms branch from 20b4deb to f658367 Compare July 15, 2025 20:05

sseago force-pushed the secret-perms branch from f658367 to 80b829b Compare July 17, 2025 15:22

Mounted cloud credentials should not be world-readable

ecb12a4

Signed-off-by: Scott Seago <sseago@redhat.com>

sseago force-pushed the secret-perms branch from 80b829b to ecb12a4 Compare July 17, 2025 16:28

sseago marked this pull request as ready for review July 17, 2025 16:28

github-actions Bot requested review from kaovilai and ywk253100 July 17, 2025 16:28

kaovilai approved these changes Jul 17, 2025

View reviewed changes

shubham-pampattiwar approved these changes Jul 17, 2025

View reviewed changes

blackpiglet approved these changes Jul 18, 2025

View reviewed changes

blackpiglet merged commit 29a8bc4 into velero-io:main Jul 18, 2025
47 checks passed

sseago added a commit to sseago/velero that referenced this pull request Jul 18, 2025

Mounted cloud credentials should not be world-readable (velero-io#8919)

6325749

Signed-off-by: Scott Seago <sseago@redhat.com>

sseago mentioned this pull request Jul 18, 2025

[release-1.16] Mounted cloud credentials should not be world-readable (#8919) #9094

Merged

sseago added a commit to sseago/velero that referenced this pull request Jul 18, 2025

Mounted cloud credentials should not be world-readable (velero-io#8919)

82ed0cd

Signed-off-by: Scott Seago <sseago@redhat.com>

sseago added a commit to sseago/velero that referenced this pull request Jul 18, 2025

Mounted cloud credentials should not be world-readable (velero-io#8919)

812bedf

Signed-off-by: Scott Seago <sseago@redhat.com>

blackpiglet pushed a commit that referenced this pull request Jul 21, 2025

Mounted cloud credentials should not be world-readable (#8919) (#9094)

043005c

Signed-off-by: Scott Seago <sseago@redhat.com>

sseago added the target/1.16.2 label Jul 22, 2025

kaovilai pushed a commit to kaovilai/velero that referenced this pull request Jul 23, 2025

Mounted cloud credentials should not be world-readable (velero-io#8919)

04bc9e9

Signed-off-by: Scott Seago <sseago@redhat.com> Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

MaloLelandais mentioned this pull request Jul 28, 2025

Rebase velero clcondorcet/velero#1

Closed

3 tasks

MaloLelandais pushed a commit to MaloLelandais/velero that referenced this pull request Jul 28, 2025

Mounted cloud credentials should not be world-readable (velero-io#8919)

983c500

Signed-off-by: Scott Seago <sseago@redhat.com>

Conversation

sseago commented May 8, 2025

Please add a summary of your change

Does your change fix a particular issue?

Please indicate you've done the following:

Uh oh!

kaovilai left a comment

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented May 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

reasonerjt commented Jul 11, 2025

Uh oh!

kaovilai commented Jul 11, 2025

Uh oh!

sseago commented Jul 11, 2025

Uh oh!

sseago commented Jul 14, 2025

Uh oh!

blackpiglet commented Jul 15, 2025

Uh oh!

sseago commented Jul 15, 2025

Uh oh!

sseago commented Jul 15, 2025

Uh oh!

blackpiglet commented Jul 15, 2025

Uh oh!

blackpiglet commented Jul 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sseago commented Jul 16, 2025

Uh oh!

blackpiglet commented Jul 17, 2025

Uh oh!

sseago commented Jul 17, 2025

Uh oh!

blackpiglet commented Jul 17, 2025

Uh oh!

sseago commented Jul 17, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

codecov Bot commented May 8, 2025 •

edited

Loading

blackpiglet commented Jul 16, 2025 •

edited

Loading